5.3 Explain the Configuration and Management of Repository Scanning (e.g., Infrastructure as Code [IaC], Secrets, SCA, IaC Drift Detection) CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a typical step in the remediation workflow after a repository scan identifies a security issue?

   • AAssigning the finding to a developer for review and fix
   • BAutomatically deleting the repository
   • CIgnoring the finding if the scan was automated
   • DDisabling the scanner to prevent further findings
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of IaC drift detection?

   • ATo monitor the performance of the deployed infrastructure
   • BTo identify differences between deployed infrastructure and its defined IaC state
   • CTo automatically update the IaC templates to match the deployed infrastructure
   • DTo scan for secrets in the IaC templates
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary goal of scanning Infrastructure as Code (IaC) templates?

   • ATo automatically deploy the infrastructure defined in the templates
   • BTo detect misconfigurations and compliance violations in the infrastructure definitions
   • CTo monitor the runtime performance of the deployed infrastructure
   • DTo manage user access to the cloud provider's management console
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A DevOps team manages a Terraform repository that provisions Azure resources. They want to ensure that any new or modified Terraform files are scanned for misconfigurations before the code is merged into the main branch. The team uses GitHub and wants to enforce this check as a mandatory part of their pull request workflow. Which approach should they use?

   • AConfigure a scheduled daily scan of the repository using the cloud security platform's built-in scheduler.
   • BManually trigger a scan from the cloud security platform's web interface after each merge to review the results.
   • CEnable a repository scan that runs on pull request creation and requires a successful scan result before merging.
   • DUse a Git hook on the developer's local machine to run a scan before every commit.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company has a policy that all open-source dependencies must be approved by the security team before they can be used in production. The security team wants to automate this approval process as part of the repository scanning workflow. Which configuration should they implement?

   • ASet up the SCA scanner to create a ticket for each new dependency, which the security team can then approve or reject.
   • BConfigure the SCA scanner to block all new dependencies until the security team manually runs a scan.
   • CUse the SCA scanner's allowlist to pre-approve a list of known-safe dependencies.
   • DConfigure the SCA scanner to automatically approve all dependencies that do not have known vulnerabilities.
   Reveal Solution Discussion Select an answer first