Cloud Compliance as Code GCSA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A DevOps team is adopting Terraform to manage AWS infrastructure. They want to prevent deployment of S3 buckets that allow public read access. Which approach should they implement to catch this violation before any resource is created?

   • AAdd a manual approval step in the CI pipeline for any change that touches an S3 bucket.
   • BEnable AWS Config managed rule for S3 public read and rely on its periodic evaluation to flag the bucket after creation.
   • CRun Checkov against the Terraform plan output in the CI pipeline and fail the build on a violation.
   • DUse AWS Service Catalog to enforce that all S3 buckets are created with a specific CloudFormation template.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   At which stage of a CI/CD pipeline can compliance checks be applied?

   • AOnly during the deployment stage.
   • BAt any stage, including build, test, and deployment.
   • COnly after the application is in production.
   • DOnly during the build stage.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   When a compliance test fails, what is the typical next step in an automated pipeline?

   • AThe cloud provider is notified to ignore the violation.
   • BThe pipeline is halted and the failure is reported to the team.
   • CThe pipeline continues to deployment to avoid delays.
   • DThe test is automatically skipped to save time.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is responsible for managing compliance policies as code in a Git repository. They need to ensure that all changes are traceable and that there is a clear audit trail. They are considering using Git tags to mark policy versions and a CI/CD pipeline to test policies. What is the most important practice to ensure traceability and a clear audit trail?

   • AUse Git tags to mark each policy version and ensure that the CI/CD pipeline only deploys tagged versions.
   • BUse a CI/CD pipeline that automatically deploys any change to the main branch.
   • CRequire all changes to be made through pull requests with a mandatory review by at least one other team member.
   • DMaintain a separate changelog file that documents all policy changes.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is migrating to Google Cloud and needs to continuously assess their resources against the CIS Google Cloud Computing Platform Benchmark. They want to use a native GCP service to automate this assessment and generate a compliance report. What should they use?

   • AGoogle Cloud Security Command Center with a built-in CIS benchmark scanner.
   • BGoogle Cloud Logging with log-based alerts for non-compliant resource creation.
   • CGoogle Cloud Deployment Manager with a config file that enforces all CIS controls.
   • DGoogle Cloud Asset Inventory with custom Cloud Functions to check for compliance.
   Reveal Solution Discussion Select an answer first