Cloud Compliance as Code GCSA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a key advantage of using a policy-as-code framework over traditional manual compliance checks?

   • AIt automatically fixes all compliance violations without human intervention.
   • BIt guarantees that all cloud resources are 100% compliant at all times.
   • CIt allows policies to be tested, versioned, and reused across different environments.
   • DIt eliminates the need for security teams to review compliance requirements.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company uses Azure Policy to enforce tagging standards on all resources. They have a requirement that any resource created without the required 'CostCenter' tag must be automatically corrected within 15 minutes. The team wants to use a native Azure service to handle this without writing custom code. What should they configure?

   • AAn Azure Policy with a 'DeployIfNotExists' effect that assigns a remediation task to add the tag.
   • BAn Azure Logic App that listens to Azure Activity Logs and applies tags.
   • CAn Azure Automation runbook triggered by an Azure Monitor alert on resource creation.
   • DAn Azure Policy initiative with a 'Deny' effect for missing tags.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A compliance officer needs a monthly, exportable report that shows the compliance status of all AWS resources against the CIS AWS Foundations Benchmark. Which AWS service should be used to generate this report?

   • AAWS Audit Manager
   • BAWS Security Hub
   • CAWS Config
   • DAWS Trusted Advisor
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A development team uses GitHub Actions to deploy Kubernetes manifests to a cluster. They want to enforce that all container images come from an approved registry before the manifests are applied. Which step should they add to the workflow?

   • AConfigure a Kubernetes namespace quota to limit the number of images that can be pulled.
   • BAdd an admission controller in the cluster that rejects images from unapproved registries.
   • CRun a Conftest policy check using OPA on the manifest files in the workflow and fail the job if any image is not from the approved registry.
   • DUse kubectl apply with a dry-run flag to check if the manifests are valid.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security engineer needs to validate that a set of AWS resources meets the company's encryption standards. They want to run automated tests that produce a pass/fail result and store the results for audit. Which approach should they use?

   • AUse InSpec with an AWS resource pack to run compliance tests and output a report.
   • BWrite a custom script using the AWS SDK to check encryption settings and output a JSON report.
   • CUse Cloud Custodian policies to detect non-compliant resources and send the results to a log file.
   • DUse AWS Config rules and record the evaluation results in the AWS Config console.
   Reveal Solution Discussion Select an answer first