Cloud Compliance as Code GCSA Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is the primary characteristic of 'compliance as code'?

   • ACompliance is enforced by configuring cloud provider default settings and relying on the provider's built-in security features.
   • BCompliance policies are expressed as machine-readable, version-controlled artifacts that can be automatically applied and tested.
   • CCompliance is achieved by purchasing a compliance certification and displaying it in the organization's security documentation.
   • DCompliance requirements are documented in human-readable policy manuals and enforced manually by security teams.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A team uses Azure DevOps to deploy ARM templates. They have separate pipelines for dev, test, and prod. They want to enforce that a policy requiring 'Deny public IP on NIC' is checked at every stage, but they also want to allow exceptions for a specific legacy workload in prod. How should they design the policy check?

   • AUse the same Azure Policy definition in all stages and assign it with a different scope that includes an exemption for the legacy workload.
   • BSkip the policy check in the prod pipeline and rely on manual review.
   • CUse a parameter in the ARM template to conditionally allow public IPs for the legacy workload.
   • DCreate a separate policy definition for prod that does not include the deny effect.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A company runs a critical production workload on AWS. They use AWS Config to detect when security groups allow SSH from 0.0.0.0/0. They want automated remediation, but they are concerned about disrupting active connections. Which remediation strategy best balances automation with safety?

   • ACreate a new security group with the correct rules and update the instance to use it.
   • BAutomatically remove the offending rule using an AWS Config remediation action.
   • CUse a Lambda function to revoke the rule only if no active connections exist, otherwise alert.
   • DDo not automate; send an alert to the security team for manual review.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A security team needs to provide auditors with a monthly report showing the compliance status of all AWS resources against the CIS AWS Foundations Benchmark. The report must include a history of changes and be generated automatically. Which combination of AWS services should they use?

   • AAWS Config with AWS Audit Manager to create a custom framework and generate reports.
   • BAWS Trusted Advisor with AWS CloudTrail to export findings and logs.
   • CAWS Inspector with AWS Lambda to schedule and email a report.
   • DAWS Security Hub with Amazon QuickSight to visualize findings.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A company uses Azure and wants to automate compliance assessment for regulatory requirements like GDPR. They need to generate audit-ready reports and track remediation of non-compliant resources. Which Azure service should they use?

   • AAzure Compliance Manager
   • BAzure Security Center
   • CAzure Policy
   • DAzure Blueprints
   Reveal Solution Discussion Select an answer first