Policy Enforcement GCSA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company uses Kubernetes and wants to enforce a policy that containers must run as non-root. They want to prevent non-compliant pods from being created. Which enforcement point should they configure?

   • ARun a scan on the container images to check if they run as root.
   • BConfigure a Kubernetes cron job to terminate pods that run as root.
   • CUse a Kubernetes admission controller, such as OPA Gatekeeper, to validate pod specifications before they are created.
   • DUse a Kubernetes network policy to block traffic from root containers.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In a cloud environment, which component is an example of a policy enforcement point?

   • AA virtual network's DNS settings
   • BAn identity and access management (IAM) policy attached to a role
   • CA cloud provider's resource manager that evaluates policies before creating a resource
   • DAn organization's security awareness training program
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A cloud security team manages infrastructure using Terraform. They need to enforce a policy that all S3 buckets must have versioning enabled. The team wants to catch violations before resources are deployed, and also wants to prevent developers from bypassing the check by running Terraform locally. Which approach should they use?

   • AUse a pre-commit hook that runs a script to check for versioning in the Terraform code.
   • BEnable S3 default versioning on the AWS account and rely on that to enforce the policy.
   • CAdd a Terraform validation rule using a policy-as-code tool and configure the CI pipeline to run it on every pull request.
   • DCreate an AWS Config rule that checks S3 buckets for versioning and triggers an automatic remediation action.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of mapping organizational policies to compliance frameworks like CIS or NIST?

   • ATo enable automated auditing by translating framework controls into enforceable policies
   • BTo ensure that all policies are publicly available
   • CTo simplify the number of policies an organization needs to manage
   • DTo replace organizational policies with framework requirements
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization uses AWS Organizations and wants to enforce a policy that prevents any IAM user from creating access keys in any account. They have a policy-as-code repository where all policies are version-controlled and reviewed. Which enforcement point should they configure to achieve this?

   • AAn SCP attached to the root organizational unit that denies the iam:CreateAccessKey action.
   • BA Service Control Policy that denies the iam:CreateUser action.
   • CAn IAM policy attached to each IAM user that denies iam:CreateAccessKey.
   • DA CloudTrail trail that triggers a Lambda function to delete any newly created access key.
   Reveal Solution Discussion Select an answer first