5.3 Explain the Configuration and Management of Repository Scanning (e.g., Infrastructure as Code [IaC], Secrets, SCA, IaC Drift Detection) CLOUD-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is a common method used by secrets scanners to identify secrets in code?

   • AExecuting the code to observe runtime behavior
   • BPattern matching for known secret formats and entropy analysis
   • CMonitoring network traffic to and from the repository
   • DQuerying the cloud provider's secret management service
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is a common action taken when IaC drift is detected?

   • AIgnoring the drift if the infrastructure is still functional
   • BGenerating an alert to notify administrators of the drift
   • CAutomatically deleting the drifted resources
   • DUpdating the IaC templates to match the drifted state
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security engineer is configuring secrets scanning for a repository that contains a mix of production code and documentation. The engineer wants to ensure that secrets in the documentation are also detected, but they are concerned about false positives from example code. Which configuration should they use?

   • AEnable secrets scanning for all files and add an allowlist for known example patterns.
   • BDisable secrets scanning for documentation files to avoid false positives.
   • CUse a custom regex pattern that only matches secrets in code files.
   • DEnable secrets scanning only for production code files.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is responsible for scanning multiple repositories across different cloud platforms (AWS, Azure, GCP). They want to centralize the management of these scans and ensure that the results are consistent. They also want to be able to apply the same security policies across all repositories. Which approach should they take?

   • AUse a single cloud security platform that supports scanning for multiple cloud platforms and centralizes policy management.
   • BConfigure a separate scanning tool for each cloud platform and manually review the results.
   • CConfigure the scans to run only on the cloud platform that has the most repositories.
   • DUse a custom script to scan all repositories and store the results in a central database.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is an example of an IaC template that would be scanned for misconfigurations?

   • AA Terraform configuration file defining cloud resources
   • BA JavaScript file containing application logic
   • CA CSV file containing user data
   • DA Dockerfile used to build a container image
   Reveal Solution Discussion Select an answer first