Policy Enforcement GCSA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium · select all that apply

   A company uses Terraform to manage its AWS infrastructure. A developer manually changed the security group rules in the AWS console, causing the actual state to differ from the Terraform configuration. The team wants to automatically detect and correct this drift. Which approaches will achieve this? (Select all that apply.)

   • ARun terraform apply in a scheduled CI job to automatically revert any manual changes.
   • BUse AWS Config managed rule for security group changes to trigger a Lambda that reverts the changes.
   • CRun terraform plan in a scheduled CI job and alert if changes are detected.
   • DEnable Terraform Cloud's drift detection and set it to auto-apply the plan.
   Check answers Discussion Select an answer first
2. 17expert · medium

   A company uses a hybrid cloud environment with both AWS and on-premises resources. They want to enforce a consistent security policy across both environments. They use Terraform for AWS and Ansible for on-premises. What is the best way to achieve consistent policy enforcement?

   • AWrite separate policies for AWS and on-premises to account for differences.
   • BMove all on-premises workloads to AWS to simplify policy enforcement.
   • CUse a policy-as-code tool that supports both Terraform and Ansible, and integrate it into the CI/CD pipeline for both.
   • DUse AWS Config for AWS and a separate tool for on-premises, and manually compare results.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team wants to automate the validation of their AWS CloudFormation templates against the company's internal security policies, which are based on the CIS AWS Foundations Benchmark. They want to run this validation in their CI/CD pipeline. Which tool should they use?

   • Acfn-nag or Checkov
   • BAWS CloudFormation lint
   • CAWS Config with conformance packs.
   • DAWS Security Hub
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A security team uses a policy-as-code framework to enforce compliance with internal policies. They need to validate that the policies themselves are correct and do not contain errors before deploying them to production. What is the best way to automate this validation?

   • ADeploy the policy to production and monitor for any violations.
   • BRun policy tests in a CI pipeline that use sample data to verify the policy behaves as expected.
   • CManually review the policy code before deployment.
   • DUse a linter to check the policy syntax.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company uses a service mesh (e.g., Istio) in their Kubernetes cluster. They want to enforce a policy that only allows communication between specific microservices. They also want to ensure that the policy is version-controlled and automatically validated before deployment. Which approach should they take?

   • AUse a manual process to update the service mesh configuration.
   • BUse Istio's AuthorizationPolicy CRD and manage it as code in a Git repository with CI validation.
   • CUse Kubernetes NetworkPolicies and manage them as code.
   • DUse a firewall at the cloud provider level to restrict traffic.
   Reveal Solution Discussion Select an answer first