Cloud Compliance as Code GCSA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A DevOps team is using GitLab CI to deploy a Kubernetes cluster with Helm charts. They need to validate that the Helm charts do not use privileged containers or mount the Docker socket before they are deployed to the cluster. What is the most efficient way to implement this check?

   • ARun `kube-score` or `kubeconform` as a CI job to validate the rendered Kubernetes manifests against a set of security policies.
   • BManually review the Helm chart templates in a pull request.
   • CUse `kubectl apply --dry-run=client` to check if the manifests are syntactically correct.
   • DDeploy the Helm charts to a test cluster and use a Kubernetes admission controller like OPA/Gatekeeper to block the deployment.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why is version control important for managing compliance policies as code?

   • AIt generates compliance reports from the policy code.
   • BIt automatically enforces compliance policies in the cloud.
   • CIt provides a history of changes, enabling traceability and rollback.
   • DIt encrypts compliance policies to prevent unauthorized access.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company wants to adopt compliance as code to manage their security policies. They have a mix of on-premises and cloud resources. They want to use a single set of policies that can be tested and versioned. Which approach best aligns with compliance as code principles?

   • AUse a spreadsheet to track compliance requirements and manually update it when changes occur.
   • BWrite policies in a declarative language like Rego and store them in a Git repository with a CI pipeline that tests them.
   • CUse a commercial GRC tool that requires manual data entry.
   • DCreate separate policies for each cloud provider and on-premises environment.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the purpose of scanning infrastructure as code (IaC) templates for compliance violations?

   • ATo identify misconfigurations before the infrastructure is deployed.
   • BTo automatically remediate any security issues found in the deployed infrastructure.
   • CTo generate a list of all cloud resources currently in use.
   • DTo replace the need for runtime security monitoring.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Why is it important to integrate compliance checks into CI/CD pipelines?

   • ATo speed up the deployment process by skipping manual reviews.
   • BTo reduce the number of developers needed on the team.
   • CTo eliminate the need for security testing.
   • DTo ensure that only compliant code and infrastructure are deployed.
   Reveal Solution Discussion Select an answer first