Cloud Compliance as Code GCSA Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is an audit trail in the context of cloud compliance?

   • AA backup of all cloud data.
   • BA chronological record of events and changes related to compliance checks and resource configurations.
   • CA list of all security vulnerabilities found in the cloud environment.
   • DA set of rules that define what is compliant.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is a common policy-as-code framework specifically designed for cloud environments?

   • AOpen Policy Agent (OPA)
   • BTerraform Cloud
   • CMicrosoft Word
   • DJenkins
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security engineer is implementing a policy that requires all AWS S3 buckets to have versioning enabled and encryption configured. The team uses Terraform to manage infrastructure and GitHub for version control. They want to prevent non-compliant infrastructure from being deployed while allowing developers to iterate quickly. What is the most effective approach?

   • AConfigure AWS Config rules to detect non-compliant S3 buckets and automatically remediate them after deployment.
   • BCreate a Terraform module that includes the required settings and require all developers to use it.
   • CAdd a pre-commit hook that runs a custom Python script to parse Terraform files and check for the required settings.
   • DUse a policy-as-code tool like Checkov or OPA in a CI/CD pipeline stage to scan Terraform plans and fail the build on violations.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is an example of an automated remediation action for a non-compliant cloud resource?

   • ALogging the violation in a compliance report.
   • BCreating a ticket in a helpdesk system.
   • CSending an email alert to the security team.
   • DAutomatically applying a security patch to a virtual machine.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company uses GitLab CI to deploy AWS CloudFormation stacks. They want to run automated compliance tests that validate the resulting stack against internal security rules and fail the pipeline if any rule is violated. Which tool should they integrate into the pipeline?

   • AAWS Config with a custom rule that triggers on stack creation and sends the evaluation to the pipeline.
   • Bc7n-org (Cloud Custodian) to run policy tests against the live stack after deployment.
   • CTaskcat to run CloudFormation integration tests that include custom assertions on the deployed stack.
   • DRegula to evaluate the CloudFormation template against Rego policies before deployment.
   Reveal Solution Discussion Select an answer first