Continuous Compliance Vocabulary
Practice continuous compliance vocabulary: compliance-as-code, automated evidence collection, drift reports, and real-time policy adherence dashboards.
0 / 37 completed
1 / 37
Your security team says 'Compliance-as-code automates evidence collection.' What does compliance-as-code mean?
Compliance-as-code treats compliance controls as code — using tools like Open Policy Agent, Chef InSpec, or AWS Config rules to automatically enforce controls and generate machine-readable evidence. This replaces manual quarterly checks with continuous automated validation.
2 / 37
A platform engineer says 'The control is tested on every deployment.' What does this mean for the audit cycle?
When compliance controls are integrated into the CI/CD pipeline, every deployment tests and documents control status. This creates a continuous stream of evidence and catches drift immediately — a major improvement over point-in-time annual audits.
3 / 37
A compliance dashboard shows 'The drift report shows 3 resources out of compliance.' What is configuration drift?
Configuration drift occurs when actual infrastructure state diverges from the declared desired state. In compliance contexts, drift means resources no longer meet policy requirements — often caused by manual changes bypassing the approved change management process.
4 / 37
Your compliance report shows '94% policy adherence.' What does this metric indicate?
Policy adherence percentage measures what fraction of compliance checks are currently passing. 94% means 6% of resources or controls have drifted from required policy — those items need investigation and remediation. Continuous compliance dashboards show this in real time.
5 / 37
A team uses 'automated evidence collection' via a compliance platform. What is the key advantage over manual evidence collection?
Manual evidence collection (screenshots, exports, spreadsheets) is labor-intensive, error-prone, and only captures a moment in time. Automated evidence collection continuously captures structured data — who approved what, when controls ran, what the state was — making audits faster and more reliable.
6 / 37
PR Description
Subject: Update Deployment Script - Added Compliance Checks
This PR includes automated checks for data residency and encryption compliance during deployment. We've integrated with the Compliance as Code platform to enforce these policies at every stage. Please review and approve.
The correct answer highlights the core benefit of Compliance as Code: automated enforcement and verifiable evidence. The PR description emphasizes that the platform is actively monitoring compliance during deployment, providing tangible proof rather than simply stating adherence. Options A, C, and D represent standard code review practices or broader security considerations – they don't directly address the specific value proposition of using Compliance-as-Code to automate policy verification.
7 / 37
Sarah (a Senior Developer) posted this in Slack: 'Just ran the automated policy checks – it flagged a misconfigured S3 bucket. Looks like we're not properly encrypting all our data at rest anymore!' What does 'encrypting all our data at rest' specifically refer to in the context of compliance? 'Encrypting all our data at rest' relates directly to data security and compliance requirements. It means applying cryptographic protection to data while it's stored – this is crucial for protecting sensitive information from unauthorized access if a system were compromised. Options B, C, and D address different aspects of security but don't specifically describe the process of using encryption when data is stored, which is what the Slack message highlights.
8 / 37
Review this PR description:
"This deployment script utilizes Compliance as Code to continuously monitor and enforce data residency regulations. The system automatically verifies that all sensitive data is stored within the EU region, based on our GDPR compliance requirements. Any deviations trigger immediate alerts and remediation steps."
What does 'data residency' mean in this context?This question tests understanding of a core concept. 'Data residency' specifically refers to *where* data is physically stored – in this case, requiring all sensitive data to be located within the European Union to comply with GDPR regulations. The other options misinterpret the term; encryption relates to security measures, Compliance as Code is the platform, and deployment location isn't synonymous with data residency.
9 / 37
PR Description
Subject: Update Deployment Script - Added Compliance Checks
This PR includes automated checks for data residency and encryption compliance during deployment. We've integrated with the Compliance as Code platform to enforce these policies at every stage. Please review and approve.
The correct answer highlights the core benefit of Compliance as Code: automated enforcement and verifiable evidence. The PR description emphasizes that the platform is actively monitoring compliance during deployment, providing tangible proof rather than simply stating adherence. Options A, C, and D represent standard code review practices or broader security considerations – they don't directly address the specific value proposition of using Compliance-as-Code to automate policy verification.
10 / 37
Sarah (a Senior Developer) posted this in Slack: 'Just ran the automated policy checks – it flagged a misconfigured S3 bucket. Looks like we're not properly encrypting all our data at rest anymore!' What does 'encrypting all our data at rest' specifically refer to in the context of compliance? 'Encrypting all our data at rest' relates directly to data security and compliance requirements. It means applying cryptographic protection to data while it's stored – this is crucial for protecting sensitive information from unauthorized access if a system were compromised. Options B, C, and D address different aspects of security but don't specifically describe the process of using encryption when data is stored, which is what the Slack message highlights.
11 / 37
Review this PR description:
"This deployment script utilizes Compliance as Code to continuously monitor and enforce data residency regulations. The system automatically verifies that all sensitive data is stored within the EU region, based on our GDPR compliance requirements. Any deviations trigger immediate alerts and remediation steps."
What does 'data residency' mean in this context?This question tests understanding of a core concept. 'Data residency' specifically refers to *where* data is physically stored – in this case, requiring all sensitive data to be located within the European Union to comply with GDPR regulations. The other options misinterpret the term; encryption relates to security measures, Compliance as Code is the platform, and deployment location isn't synonymous with data residency.
12 / 37
PR Description
Subject: Update Deployment Script - Added Compliance Checks
This PR includes automated checks for data residency and encryption compliance during deployment. We've integrated with the Compliance as Code platform to enforce these policies at every stage. Please review and approve.
The correct answer highlights the core benefit of Compliance as Code: automated enforcement and verifiable evidence. The PR description emphasizes that the platform is actively monitoring compliance during deployment, providing tangible proof rather than simply stating adherence. Options A, C, and D represent standard code review practices or broader security considerations – they don't directly address the specific value proposition of using Compliance-as-Code to automate policy verification.
13 / 37
Sarah (a Senior Developer) posted this in Slack: 'Just ran the automated policy checks – it flagged a misconfigured S3 bucket. Looks like we're not properly encrypting all our data at rest anymore!' What does 'encrypting all our data at rest' specifically refer to in the context of compliance? 'Encrypting all our data at rest' relates directly to data security and compliance requirements. It means applying cryptographic protection to data while it's stored – this is crucial for protecting sensitive information from unauthorized access if a system were compromised. Options B, C, and D address different aspects of security but don't specifically describe the process of using encryption when data is stored, which is what the Slack message highlights.
14 / 37
Review this PR description:
"This deployment script utilizes Compliance as Code to continuously monitor and enforce data residency regulations. The system automatically verifies that all sensitive data is stored within the EU region, based on our GDPR compliance requirements. Any deviations trigger immediate alerts and remediation steps."
What does 'data residency' mean in this context?This question tests understanding of a core concept. 'Data residency' specifically refers to *where* data is physically stored – in this case, requiring all sensitive data to be located within the European Union to comply with GDPR regulations. The other options misinterpret the term; encryption relates to security measures, Compliance as Code is the platform, and deployment location isn't synonymous with data residency.
15 / 37
PR Description
Subject: Update Deployment Script - Added Compliance Checks
This PR includes automated checks for data residency and encryption compliance during deployment. We've integrated with the Compliance as Code platform to enforce these policies at every stage. Please review and approve.
The correct answer highlights the core benefit of Compliance as Code: automated enforcement and verifiable evidence. The PR description emphasizes that the platform is actively monitoring compliance during deployment, providing tangible proof rather than simply stating adherence. Options A, C, and D represent standard code review practices or broader security considerations – they don't directly address the specific value proposition of using Compliance-as-Code to automate policy verification.
16 / 37
Sarah (a Senior Developer) posted this in Slack: 'Just ran the automated policy checks – it flagged a misconfigured S3 bucket. Looks like we're not properly encrypting all our data at rest anymore!' What does 'encrypting all our data at rest' specifically refer to in the context of compliance? 'Encrypting all our data at rest' relates directly to data security and compliance requirements. It means applying cryptographic protection to data while it's stored – this is crucial for protecting sensitive information from unauthorized access if a system were compromised. Options B, C, and D address different aspects of security but don't specifically describe the process of using encryption when data is stored, which is what the Slack message highlights.
17 / 37
Review this PR description:
"This deployment script utilizes Compliance as Code to continuously monitor and enforce data residency regulations. The system automatically verifies that all sensitive data is stored within the EU region, based on our GDPR compliance requirements. Any deviations trigger immediate alerts and remediation steps."
What does 'data residency' mean in this context?This question tests understanding of a core concept. 'Data residency' specifically refers to *where* data is physically stored – in this case, requiring all sensitive data to be located within the European Union to comply with GDPR regulations. The other options misinterpret the term; encryption relates to security measures, Compliance as Code is the platform, and deployment location isn't synonymous with data residency.
18 / 37
Review this code review comment:
`@john.doe Just noticed a potential issue with the new compliance checks. The script doesn't currently validate that all data is tagged with the correct sensitivity level before applying encryption rules. This could lead to unencrypted sensitive data being inadvertently protected, which isn't compliant."
This comment correctly identifies a crucial gap: the script lacks explicit verification that data *before* encryption meets compliance requirements. The potential for unencrypted sensitive data represents a significant risk of non-compliance. The other options misinterpret the purpose of sensitivity tagging or incorrectly suggest automatic encryption without validation.
19 / 37
Mark (a DevOps Engineer) posted this in Slack: 'The automated policy scan returned a high-severity warning about inconsistent IAM role permissions across our production environments. It appears we're missing the principle of least privilege for several services.' What does 'principle of least privilege' refer to in compliance contexts?
The principle of least privilege dictates that every user and system should have only the minimum level of access required to perform their specific tasks. This significantly reduces the potential damage from compromised accounts or systems, which is central to compliance efforts around data protection and security. Granting excessive permissions increases risk.
20 / 37
PR Description:
Subject: Automated Policy Enforcement - Initial Rollout
The goal of this PR is to integrate a new policy engine that continuously monitors our infrastructure for compliance violations. It leverages API calls to the Compliance Platform to check configurations against predefined rules, generating alerts when discrepancies are detected. The platform provides detailed reporting on impacted resources and recommended remediation steps.
This PR description clearly articulates the key components of continuous compliance: real-time monitoring via API calls to a centralized policy engine. The system identifies discrepancies and provides actionable insights – this is a core element of proactive compliance management. The other options misrepresent the approach.
21 / 37
During the daily stand-up, Emily (a Security Engineer) said: 'I'm working on implementing automated evidence collection to support our audit requirements. We're using a tool that captures logs and configuration snapshots regularly, which will significantly reduce the time it takes to generate compliance reports.' What is the primary benefit of 'automated evidence collection' in this context?
Automated evidence collection streamlines the audit process by eliminating manual log gathering and configuration snapshot creation. This not only reduces the time required but also minimizes the risk of human error or omissions, leading to more reliable and timely compliance reports. The other options misrepresent its function.
22 / 37
{
"status": "success",
"resource": "S3 Bucket",
"compliance_level": "Warning",
"details": [
"Encryption is not enabled for all objects in the bucket.",
"Bucket policy does not restrict access to sensitive data."
]
}
What does the 'compliance_level' field indicate in this API response?The 'compliance_level' field indicates the degree to which a resource is out of alignment with defined compliance rules. In this case, 'Warning' suggests that while non-compliance exists, it doesn't necessarily represent an immediate critical risk – but requires attention and remediation. The other options misinterpret its meaning.
23 / 37
Review this code review comment:
`@john.doe Just noticed a potential issue with the new compliance checks. The script doesn't currently validate that all data is tagged with the correct sensitivity level before applying encryption rules. This could lead to unencrypted sensitive data being inadvertently protected, which isn't compliant."
This comment correctly identifies a crucial gap: the script lacks explicit verification that data *before* encryption meets compliance requirements. The potential for unencrypted sensitive data represents a significant risk of non-compliance. The other options misinterpret the purpose of sensitivity tagging or incorrectly suggest automatic encryption without validation.
24 / 37
Mark (a DevOps Engineer) posted this in Slack: 'The automated policy scan returned a high-severity warning about inconsistent IAM role permissions across our production environments. It appears we're missing the principle of least privilege for several services.' What does 'principle of least privilege' refer to in compliance contexts?
The principle of least privilege dictates that every user and system should have only the minimum level of access required to perform their specific tasks. This significantly reduces the potential damage from compromised accounts or systems, which is central to compliance efforts around data protection and security. Granting excessive permissions increases risk.
25 / 37
PR Description:
Subject: Automated Policy Enforcement - Initial Rollout
The goal of this PR is to integrate a new policy engine that continuously monitors our infrastructure for compliance violations. It leverages API calls to the Compliance Platform to check configurations against predefined rules, generating alerts when discrepancies are detected. The platform provides detailed reporting on impacted resources and recommended remediation steps.
This PR description clearly articulates the key components of continuous compliance: real-time monitoring via API calls to a centralized policy engine. The system identifies discrepancies and provides actionable insights – this is a core element of proactive compliance management. The other options misrepresent the approach.
26 / 37
During the daily stand-up, Emily (a Security Engineer) said: 'I'm working on implementing automated evidence collection to support our audit requirements. We're using a tool that captures logs and configuration snapshots regularly, which will significantly reduce the time it takes to generate compliance reports.' What is the primary benefit of 'automated evidence collection' in this context?
Automated evidence collection streamlines the audit process by eliminating manual log gathering and configuration snapshot creation. This not only reduces the time required but also minimizes the risk of human error or omissions, leading to more reliable and timely compliance reports. The other options misrepresent its function.
27 / 37
{
"status": "success",
"resource": "S3 Bucket",
"compliance_level": "Warning",
"details": [
"Encryption is not enabled for all objects in the bucket.",
"Bucket policy does not restrict access to sensitive data."
]
}
What does the 'compliance_level' field indicate in this API response?The 'compliance_level' field indicates the degree to which a resource is out of alignment with defined compliance rules. In this case, 'Warning' suggests that while non-compliance exists, it doesn't necessarily represent an immediate critical risk – but requires attention and remediation. The other options misinterpret its meaning.
28 / 37
Review this code review comment:
`@john.doe Just noticed a potential issue with the new compliance checks. The script doesn't currently validate that all data is tagged with the correct sensitivity level before applying encryption rules. This could lead to unencrypted sensitive data being inadvertently protected, which isn't compliant."
This comment correctly identifies a crucial gap: the script lacks explicit verification that data *before* encryption meets compliance requirements. The potential for unencrypted sensitive data represents a significant risk of non-compliance. The other options misinterpret the purpose of sensitivity tagging or incorrectly suggest automatic encryption without validation.
29 / 37
Mark (a DevOps Engineer) posted this in Slack: 'The automated policy scan returned a high-severity warning about inconsistent IAM role permissions across our production environments. It appears we're missing the principle of least privilege for several services.' What does 'principle of least privilege' refer to in compliance contexts?
The principle of least privilege dictates that every user and system should have only the minimum level of access required to perform their specific tasks. This significantly reduces the potential damage from compromised accounts or systems, which is central to compliance efforts around data protection and security. Granting excessive permissions increases risk.
30 / 37
PR Description:
Subject: Automated Policy Enforcement - Initial Rollout
The goal of this PR is to integrate a new policy engine that continuously monitors our infrastructure for compliance violations. It leverages API calls to the Compliance Platform to check configurations against predefined rules, generating alerts when discrepancies are detected. The platform provides detailed reporting on impacted resources and recommended remediation steps.
This PR description clearly articulates the key components of continuous compliance: real-time monitoring via API calls to a centralized policy engine. The system identifies discrepancies and provides actionable insights – this is a core element of proactive compliance management. The other options misrepresent the approach.
31 / 37
During the daily stand-up, Emily (a Security Engineer) said: 'I'm working on implementing automated evidence collection to support our audit requirements. We're using a tool that captures logs and configuration snapshots regularly, which will significantly reduce the time it takes to generate compliance reports.' What is the primary benefit of 'automated evidence collection' in this context?
Automated evidence collection streamlines the audit process by eliminating manual log gathering and configuration snapshot creation. This not only reduces the time required but also minimizes the risk of human error or omissions, leading to more reliable and timely compliance reports. The other options misrepresent its function.
32 / 37
{
"status": "success",
"resource": "S3 Bucket",
"compliance_level": "Warning",
"details": [
"Encryption is not enabled for all objects in the bucket.",
"Bucket policy does not restrict access to sensitive data."
]
}
What does the 'compliance_level' field indicate in this API response?The 'compliance_level' field indicates the degree to which a resource is out of alignment with defined compliance rules. In this case, 'Warning' suggests that while non-compliance exists, it doesn't necessarily represent an immediate critical risk – but requires attention and remediation. The other options misinterpret its meaning.
33 / 37
Review this code review comment:
`@john.doe Just noticed a potential issue with the new compliance checks. The script doesn't currently validate that all data is tagged with the correct sensitivity level before applying encryption rules. This could lead to unencrypted sensitive data being inadvertently protected, which isn't compliant."
This comment correctly identifies a crucial gap: the script lacks explicit verification that data *before* encryption meets compliance requirements. The potential for unencrypted sensitive data represents a significant risk of non-compliance. The other options misinterpret the purpose of sensitivity tagging or incorrectly suggest automatic encryption without validation.
34 / 37
Mark (a DevOps Engineer) posted this in Slack: 'The automated policy scan returned a high-severity warning about inconsistent IAM role permissions across our production environments. It appears we're missing the principle of least privilege for several services.' What does 'principle of least privilege' refer to in compliance contexts?
The principle of least privilege dictates that every user and system should have only the minimum level of access required to perform their specific tasks. This significantly reduces the potential damage from compromised accounts or systems, which is central to compliance efforts around data protection and security. Granting excessive permissions increases risk.
35 / 37
PR Description:
Subject: Automated Policy Enforcement - Initial Rollout
The goal of this PR is to integrate a new policy engine that continuously monitors our infrastructure for compliance violations. It leverages API calls to the Compliance Platform to check configurations against predefined rules, generating alerts when discrepancies are detected. The platform provides detailed reporting on impacted resources and recommended remediation steps.
This PR description clearly articulates the key components of continuous compliance: real-time monitoring via API calls to a centralized policy engine. The system identifies discrepancies and provides actionable insights – this is a core element of proactive compliance management. The other options misrepresent the approach.
36 / 37
During the daily stand-up, Emily (a Security Engineer) said: 'I'm working on implementing automated evidence collection to support our audit requirements. We're using a tool that captures logs and configuration snapshots regularly, which will significantly reduce the time it takes to generate compliance reports.' What is the primary benefit of 'automated evidence collection' in this context?
Automated evidence collection streamlines the audit process by eliminating manual log gathering and configuration snapshot creation. This not only reduces the time required but also minimizes the risk of human error or omissions, leading to more reliable and timely compliance reports. The other options misrepresent its function.
37 / 37
{
"status": "success",
"resource": "S3 Bucket",
"compliance_level": "Warning",
"details": [
"Encryption is not enabled for all objects in the bucket.",
"Bucket policy does not restrict access to sensitive data."
]
}
What does the 'compliance_level' field indicate in this API response?The 'compliance_level' field indicates the degree to which a resource is out of alignment with defined compliance rules. In this case, 'Warning' suggests that while non-compliance exists, it doesn't necessarily represent an immediate critical risk – but requires attention and remediation. The other options misinterpret its meaning.
Frequently Asked Questions
What does the "Continuous Compliance Vocabulary" exercise practise?
Practice continuous compliance vocabulary: compliance-as-code, automated evidence collection, drift reports, and real-time policy adherence dashboards.
How many questions are in this exercise?
This exercise has 37 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Compliance Security category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "Continuous Compliance Vocabulary" part of a larger series?
Yes — it's one exercise in the Compliance Security category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Compliance Security category page for related exercises, or browse the main Exercises hub for other IT English topics.