Sample questions
Ds Iac Policy As CodeDifficulty 1
What is the main purpose of running a static IaC scanner (e.g. Checkov, tfsec) against Terraform files as part of a pipeline?
- aTo detect misconfigurations in the infrastructure definition before it is ever provisioned.✓
- bTo automatically format the Terraform code according to the team's style guide.
- cTo reduce the cloud bill by predicting the monthly cost of the planned resources.
- dTo replace the need for a code reviewer to look at the pull request at all, since an automated scanner is assumed to catch every issue a human reviewer normally would.
Explanation:Static IaC scanners parse the Terraform/CloudFormation source and check it against a set of security and compliance rules, so problems like an unencrypted bucket or an open security group are caught while the change is still just text, before any real resource is created.
Ds Iac Policy As CodeDifficulty 1
In the policy-as-code ecosystem, what is Open Policy Agent (OPA) best described as?
- aA secrets manager that issues short-lived credentials to CI/CD runners, positioned as an alternative to storing long-lived static credentials in pipeline configuration.
- bA Terraform provider that creates cloud resources directly from Rego files.
- cA vulnerability scanner that inspects container images for known CVEs.
- dA general-purpose policy engine that evaluates structured input against rules and returns an allow/deny decision.✓
Explanation:OPA is a general-purpose policy engine: you feed it structured input (JSON) plus policies written in Rego, and it evaluates the input against those policies to produce a decision, independent of what kind of system is asking the question.
Ds Iac Policy As CodeDifficulty 2
What is Rego, in the context of OPA?
- aA binary format used to compress Terraform state files before upload to remote backends.
- bA declarative query language used to write the policy rules that OPA evaluates.✓
- cA CLI flag that forces terraform apply to skip the plan confirmation step.
- dA CloudFormation intrinsic function used to reference stack parameters.
Explanation:Rego is OPA's declarative policy language: rules are written as queries over the input document, and OPA evaluates them to decide whether a given input satisfies the policy.
Ds Iac Policy As CodeDifficulty 2
What does Conftest primarily do in a pipeline that checks Terraform or Kubernetes manifests?
- aIt runs OPA/Rego policies against structured configuration files and reports pass/fail results.✓
- bIt signs the manifest files with a GPG key so their origin and integrity can be verified later by anyone consuming the artifact downstream.
- cIt automatically rewrites non-compliant fields in the manifest to compliant values.
- dIt provisions a temporary staging environment to test the manifests before merge.
Explanation:Conftest is a thin wrapper around OPA aimed at structured config files: it loads Rego policies and runs them against inputs such as a terraform plan JSON export or Kubernetes YAML, reporting which policies passed or failed.
Ds Iac Policy As CodeDifficulty 2
A team wants every pull request that adds an S3 bucket to be blocked automatically unless the bucket definition includes a server-side encryption block. Which approach fits this requirement?
- aAsk reviewers to manually search each diff for the word "encryption" before approving.
- bAdd a policy-as-code rule that checks for the encryption block and fail the pipeline stage when it is missing.✓
- cEnable encryption on the bucket after deployment through the cloud console.
- dDocument the encryption requirement in the team wiki and trust developers to remember and follow it consistently across every future change.
Explanation:A policy-as-code rule evaluated in the pipeline turns the requirement into an automated, repeatable gate: any PR whose Terraform diff is missing the encryption block fails the check, instead of relying on manual review or after-the-fact fixes.
Ds Iac Policy As CodeDifficulty 1
Which statement best defines "policy as code" in a DevSecOps pipeline?
- aA manual checklist that a security reviewer fills in by hand for every release, based on their personal experience and judgment at that time.
- bEvery security policy is stored as a PDF attached to the ticket that introduced it.
- cDevelopers write their own ad-hoc security checks inside application business logic.
- dSecurity and compliance rules are expressed as version-controlled, machine-evaluable code rather than as prose documents.✓
Explanation:Policy as code means the rule itself (e.g. "encryption must be enabled") is written in a language a tool can parse and evaluate automatically, and that rule lives in version control alongside the infrastructure it governs, rather than in a document a human has to remember to check.