5.3 Explain the Configuration and Management of Repository Scanning (e.g., Infrastructure as Code [IaC], Secrets, SCA, IaC Drift Detection) CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the main purpose of secrets scanning in repositories?

   • ATo detect exposed secrets such as API keys and passwords to prevent unauthorized access
   • BTo rotate secrets automatically when they are found
   • CTo remove secrets from the repository automatically
   • DTo encrypt all secrets stored in the repository
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security engineer is configuring secrets scanning for a large monorepo that contains multiple application codebases and configuration files. The engineer wants to minimize false positives while ensuring that all high-confidence secrets (e.g., API keys, passwords) are detected. Which configuration step is most important to achieve this?

   • AConfigure custom regex patterns for the specific secret formats used by the organization and add allowlists for known test fixtures.
   • BSet the scan to only run on a weekly basis to reduce the number of alerts generated.
   • CDisable scanning for files in the 'test' and 'examples' directories to reduce noise.
   • DEnable scanning for all default secret types and increase the scan frequency to run after every commit.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization uses Terraform to manage its Azure infrastructure. The infrastructure team has noticed that some resources are being modified outside of Terraform, causing configuration drift. They want to be alerted when drift is detected so they can investigate and remediate. Which configuration should they implement?

   • AConfigure SCA scanning to identify vulnerabilities in the Terraform provider plugins.
   • BEnable IaC drift detection on the repository and configure it to compare the Terraform state file with the actual deployed resources on a schedule.
   • CEnable secrets scanning on the repository to detect any hardcoded credentials that might be used to modify resources.
   • DSet up a manual process to run 'terraform plan' and compare the output with the current state of the cloud environment.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team is configuring repository scanning for a new project. They want to ensure that the scan results are reviewed and remediated in a timely manner. They also want to assign ownership for specific types of findings. Which feature should they use?

   • ADisable the scan after the initial setup to avoid overwhelming the team with alerts.
   • BSet up the scan to send all results to a single security team email address for review.
   • CConfigure the scan to automatically delete any files that contain secrets.
   • DUse the platform's ticketing integration to create issues for findings and assign them to the appropriate team members.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company uses a GitLab repository to store its Terraform configurations. The security team wants to scan the IaC for compliance violations against the company's internal security policies. They want the scan to run automatically whenever a merge request is created. Which configuration should they use?

   • AUse the cloud security platform's API to scan the repository after the merge request is merged.
   • BAsk developers to manually run a scan from their local machines before creating a merge request.
   • CSchedule a nightly scan of the repository using the cloud security platform's scheduler.
   • DConfigure a webhook in GitLab to trigger a scan in the cloud security platform when a merge request is created.
   Reveal Solution Discussion Select an answer first