Policy Enforcement GCSA Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which practice is a key characteristic of implementing policy as code?

   • AWriting policies in a markup language and applying them manually during each audit.
   • BCreating policies in a spreadsheet and emailing them to operations teams for implementation.
   • CDefining policies in a version-controlled repository and using them in automated pipelines.
   • DStoring policies in a shared network drive with read-only access for security auditors.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which approach is commonly used to detect policy drift in cloud environments?

   • AComparing the current state to the initial deployment state only once
   • BPeriodic manual audits of resource configurations
   • CContinuous monitoring of resource configurations against desired policies using automated tools
   • DReviewing audit logs only after a security incident
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team needs to demonstrate compliance with PCI-DSS for their cloud environment. They have written custom policies in their policy-as-code framework. What is the most effective way to map these policies to PCI-DSS requirements for automated auditing?

   • ACreate a separate policy for each PCI-DSS requirement and manually review the results quarterly.
   • BTag each policy with the relevant PCI-DSS control identifiers and generate compliance reports from the policy engine.
   • CUse a third-party scanner to check the environment against PCI-DSS and ignore the custom policies.
   • DStore the PCI-DSS requirements in a wiki and have auditors manually verify each policy.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security team needs to map their internal security policies to the PCI-DSS framework for an upcoming audit. They want to automate the evidence collection and reporting. Which approach should they take?

   • AUse AWS Inspector to scan for PCI-DSS compliance.
   • BUse AWS Config conformance packs with PCI-DSS controls and generate reports.
   • CUse AWS Trusted Advisor to check for PCI-DSS compliance.
   • DUse AWS CloudTrail to collect API logs for the audit.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company uses Google Cloud and wants to enforce that all Compute Engine instances have a specific label. They want to prevent creation of instances without the label. Which GCP mechanism should they use?

   • ACloud Audit Logs to detect instances without the label.
   • BCloud Functions to delete instances without the label.
   • COrganization Policy with a constraint that requires the label.
   • DCloud Deployment Manager templates that include the label.
   Reveal Solution Discussion Select an answer first