5.3 Explain the Configuration and Management of Repository Scanning (e.g., Infrastructure as Code [IaC], Secrets, SCA, IaC Drift Detection) CLOUD-SECURITY-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is evaluating a new repository scanning tool. They want to ensure that the tool can scan both IaC templates and application code for security issues. They also want to be able to view and manage the results from a single interface. Which capability is most important for the team to verify?

   • AThe tool can generate detailed reports in PDF format for compliance audits.
   • BThe tool can be deployed on-premises to meet data residency requirements.
   • CThe tool supports scanning for IaC misconfigurations, secrets, and software vulnerabilities in a single platform.
   • DThe tool can integrate with the team's existing CI/CD pipeline.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a common method for scheduling repository scans?

   • ARunning scans only during off-peak hours without any trigger
   • BIntegrating scans into the CI/CD pipeline to run on every commit or pull request
   • CRunning scans only when a security incident occurs
   • DRunning scans manually on an ad-hoc basis only
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A developer accidentally commits a valid AWS access key to a public GitHub repository. The security team wants to ensure that this secret is detected and that the developer is notified immediately. They also want to prevent similar incidents in the future. Which immediate action should the security team take?

   • AAdd the AWS access key to the secrets scanner's allowlist to prevent false positives.
   • BDelete the commit from the repository's history to remove the secret from public view.
   • CRotate the AWS access key and then configure secrets scanning on the repository to detect and alert on any future commits.
   • DChange the repository's visibility from public to private to hide the secret.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of Software Composition Analysis (SCA) scanning?

   • ATo detect misconfigurations in cloud infrastructure templates
   • BTo monitor the runtime performance of the application
   • CTo identify vulnerabilities and license risks in open-source dependencies
   • DTo scan for secrets in the application's source code
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of repository scanning in a cloud security program?

   • ATo enforce compliance by blocking all code commits that contain any security issue
   • BTo automatically remediate all security issues found in code before deployment
   • CTo replace the need for runtime security monitoring in production environments
   • DTo identify security issues in code and configuration files stored in version control systems
   Reveal Solution Discussion Select an answer first