Cloud Compliance as Code GCSA Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company has a requirement to automatically remediate any security group that allows SSH access from 0.0.0.0/0. They are using AWS Config and have set up an automatic remediation action that uses a Systems Manager Automation document to remove the offending rule. However, they are concerned about the risk of a remediation action failing and leaving the resource non-compliant. What is the best way to ensure that the remediation is successful?

   • AUse AWS Config's built-in remediation action and rely on CloudTrail to monitor for failures.
   • BUse a custom Lambda function for remediation that includes error handling and retries.
   • CSet up a CloudWatch alarm that triggers a second remediation action if the first one fails.
   • DConfigure the AWS Config rule to re-evaluate the resource after the remediation action is complete.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company is using AWS Config to monitor their resources for compliance. They have a requirement to provide a daily compliance report to their management team. The report should show the number of compliant and non-compliant resources for each rule. What is the most efficient way to generate this report?

   • AUse the AWS Config console to manually view the compliance status and create a report.
   • BUse AWS Config conformance packs to generate a compliance report.
   • CUse the AWS Config API to query the compliance status and generate a report with a custom script.
   • DUse AWS Config to publish compliance snapshots to an S3 bucket and use Amazon QuickSight to visualize the data.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company is using a policy-as-code tool to scan their Terraform configurations. They have a requirement to ensure that all S3 buckets have versioning enabled. They are using OPA with Conftest. They have written a Rego policy that checks for the presence of the `versioning` block in the Terraform code. However, the policy is not catching all violations because some developers are using a Terraform module that creates S3 buckets, and the `versioning` block is inside the module. What is the best way to address this?

   • AUse `terraform plan` to generate a plan file and scan the plan file with Conftest.
   • BUse a different policy-as-code tool that can scan modules.
   • CRequire developers to use a specific module that has versioning enabled.
   • DModify the Rego policy to also scan the module source code.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is the primary purpose of compliance reporting and auditing in a cloud environment?

   • ATo increase cloud resource performance.
   • BTo demonstrate adherence to compliance requirements and support audits.
   • CTo replace the need for continuous monitoring.
   • DTo automatically remediate any non-compliant resources.
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the purpose of compliance testing and validation in a cloud automation context?

   • ATo verify that cloud configurations meet defined compliance rules.
   • BTo generate revenue by selling compliance reports.
   • CTo automatically fix any non-compliant configurations.
   • DTo replace the need for security audits.
   Reveal Solution Discussion Select an answer first