IaC Security Scanning Vocabulary
Practice English vocabulary for IaC security scanning: Checkov, policy checks, CI integration, finding suppression, and tools like TFSEC, Terrascan, and KICS.
0 / 35 completed
1 / 35
What does 'Checkov scans the Terraform for security misconfigurations' mean?
Checkov (by Bridgecrew/Prisma Cloud) is one of the most widely used IaC security scanners. It evaluates Terraform, CloudFormation, ARM, Kubernetes, and other IaC formats against hundreds of security policies before deployment.
2 / 35
What is 'the policy check found an S3 bucket with public access'?
IaC security scanning catches misconfigurations at the code review stage, before deployment. Finding 'public access enabled on S3' in IaC allows the team to fix it in the code — preventing the vulnerable infrastructure from ever being created.
3 / 35
What does 'the scan is part of the CI pipeline' mean?
Shifting IaC security scanning left into CI means every proposed infrastructure change is scanned for security issues before it can be merged. This prevents misconfigurations from reaching the main branch or production.
4 / 35
What does 'the finding is suppressed with justification' mean?
When a security finding is a known false positive or a deliberate design decision, teams suppress it with justification (e.g., '#checkov:skip=CKV_AWS_21:Bucket intentionally public for static website'). Suppression with justification maintains auditability.
5 / 35
What are TFSEC, Terrascan, and KICS in the IaC security ecosystem?
Multiple IaC security scanners exist alongside Checkov: TFSEC (Aqua Security) focuses specifically on Terraform, Terrascan uses OPA policies for multi-cloud IaC, and KICS (Checkmarx) covers Terraform, CloudFormation, Ansible, Dockerfile and more.
6 / 35
Alex: "Hey team, Checkov just flagged our new deployment. It says 'Vulnerability: Exposed Secrets in Terraform State.' What does that specifically mean?"'Exposed Secrets' refers to sensitive data – passwords, API keys, etc. – unintentionally included in the Terraform state file. Checkov flags this because a compromised state file could allow attackers to gain control of resources. This isn't necessarily a code bug but rather a misconfiguration that needs correction; exposing secrets is a common and critical security vulnerability.
7 / 35
Sarah (in a Slack channel): "The CI pipeline failed. The scan report shows 'Policy Violation: Missing IAM Role for S3 Bucket.' I'm not sure what that means in the context of our infrastructure as code."A 'Policy Violation' in an IaC security scan like Terrascan or Checkov typically relates to access control issues. Specifically, 'Missing IAM Role for S3 Bucket' means the infrastructure resources (the S3 bucket) doesn't have the appropriate Identity and Access Management (IAM) permissions granted to it, which is a frequent cause of data exposure – this is a core security concern.
8 / 35
Ben (in a PR description): "Squashed the last few commits. The scan now reports 'Finding: Hardcoded Credentials in Deployment Script.' I've added environment variables to avoid this."The key takeaway here is that the CI pipeline (or a similar security tool) flagged the hardcoded credentials. Ben's action of using environment variables is *the correct* solution; this prevents the sensitive information from being directly embedded in the script and makes it more secure - this is standard best practice.
9 / 35
Chloe (during a standup): "We're seeing a lot of findings from the Terraform scanning tool. Some are being suppressed with justification – specifically regarding 'Potential Vulnerability: Insecure Network Configuration.' What does that suppression mean?"When an IaC scanning tool flags a finding and it's *suppressed with justification*, this means a security expert has reviewed the alert and determined that, based on specific context (the nature of the network configuration, its intended purpose, etc.), it doesn't represent a genuine risk. The 'justification' provides the reasoning for this determination – crucial to understanding why remediation isn't immediately required.
10 / 35
David: "I'm trying to understand how Terrascan and KICS relate to our IaC security. Can you explain the difference?"Terrascan is primarily a static analysis tool – it examines your Terraform code to identify potential security issues. KICS (Kubernetes Intrusion Countermeasures System) is a runtime security monitoring and control system for Kubernetes environments. They address different stages of the security lifecycle: Terrascan focuses on *prevention* by identifying vulnerabilities in configurations, while KICS focuses on *detection and response* once deployments are running.
11 / 35
Alex: "Hey team, Checkov just flagged our new deployment. It says 'Vulnerability: Exposed Secrets in Terraform State.' What does that specifically mean?"'Exposed Secrets' refers to sensitive data – passwords, API keys, etc. – unintentionally included in the Terraform state file. Checkov flags this because a compromised state file could allow attackers to gain control of resources. This isn't necessarily a code bug but rather a misconfiguration that needs correction; exposing secrets is a common and critical security vulnerability.
12 / 35
Sarah (in a Slack channel): "The CI pipeline failed. The scan report shows 'Policy Violation: Missing IAM Role for S3 Bucket.' I'm not sure what that means in the context of our infrastructure as code."A 'Policy Violation' in an IaC security scan like Terrascan or Checkov typically relates to access control issues. Specifically, 'Missing IAM Role for S3 Bucket' means the infrastructure resources (the S3 bucket) doesn't have the appropriate Identity and Access Management (IAM) permissions granted to it, which is a frequent cause of data exposure – this is a core security concern.
13 / 35
Ben (in a PR description): "Squashed the last few commits. The scan now reports 'Finding: Hardcoded Credentials in Deployment Script.' I've added environment variables to avoid this."The key takeaway here is that the CI pipeline (or a similar security tool) flagged the hardcoded credentials. Ben's action of using environment variables is *the correct* solution; this prevents the sensitive information from being directly embedded in the script and makes it more secure - this is standard best practice.
14 / 35
Chloe (during a standup): "We're seeing a lot of findings from the Terraform scanning tool. Some are being suppressed with justification – specifically regarding 'Potential Vulnerability: Insecure Network Configuration.' What does that suppression mean?"When an IaC scanning tool flags a finding and it's *suppressed with justification*, this means a security expert has reviewed the alert and determined that, based on specific context (the nature of the network configuration, its intended purpose, etc.), it doesn't represent a genuine risk. The 'justification' provides the reasoning for this determination – crucial to understanding why remediation isn't immediately required.
15 / 35
David: "I'm trying to understand how Terrascan and KICS relate to our IaC security. Can you explain the difference?"Terrascan is primarily a static analysis tool – it examines your Terraform code to identify potential security issues. KICS (Kubernetes Intrusion Countermeasures System) is a runtime security monitoring and control system for Kubernetes environments. They address different stages of the security lifecycle: Terrascan focuses on *prevention* by identifying vulnerabilities in configurations, while KICS focuses on *detection and response* once deployments are running.
16 / 35
Alex: "Hey team, Checkov just flagged our new deployment. It says 'Vulnerability: Exposed Secrets in Terraform State.' What does that specifically mean?"'Exposed Secrets' refers to sensitive data – passwords, API keys, etc. – unintentionally included in the Terraform state file. Checkov flags this because a compromised state file could allow attackers to gain control of resources. This isn't necessarily a code bug but rather a misconfiguration that needs correction; exposing secrets is a common and critical security vulnerability.
17 / 35
Sarah (in a Slack channel): "The CI pipeline failed. The scan report shows 'Policy Violation: Missing IAM Role for S3 Bucket.' I'm not sure what that means in the context of our infrastructure as code."A 'Policy Violation' in an IaC security scan like Terrascan or Checkov typically relates to access control issues. Specifically, 'Missing IAM Role for S3 Bucket' means the infrastructure resources (the S3 bucket) doesn't have the appropriate Identity and Access Management (IAM) permissions granted to it, which is a frequent cause of data exposure – this is a core security concern.
18 / 35
Ben (in a PR description): "Squashed the last few commits. The scan now reports 'Finding: Hardcoded Credentials in Deployment Script.' I've added environment variables to avoid this."The key takeaway here is that the CI pipeline (or a similar security tool) flagged the hardcoded credentials. Ben's action of using environment variables is *the correct* solution; this prevents the sensitive information from being directly embedded in the script and makes it more secure - this is standard best practice.
19 / 35
Chloe (during a standup): "We're seeing a lot of findings from the Terraform scanning tool. Some are being suppressed with justification – specifically regarding 'Potential Vulnerability: Insecure Network Configuration.' What does that suppression mean?"When an IaC scanning tool flags a finding and it's *suppressed with justification*, this means a security expert has reviewed the alert and determined that, based on specific context (the nature of the network configuration, its intended purpose, etc.), it doesn't represent a genuine risk. The 'justification' provides the reasoning for this determination – crucial to understanding why remediation isn't immediately required.
20 / 35
David: "I'm trying to understand how Terrascan and KICS relate to our IaC security. Can you explain the difference?"Terrascan is primarily a static analysis tool – it examines your Terraform code to identify potential security issues. KICS (Kubernetes Intrusion Countermeasures System) is a runtime security monitoring and control system for Kubernetes environments. They address different stages of the security lifecycle: Terrascan focuses on *prevention* by identifying vulnerabilities in configurations, while KICS focuses on *detection and response* once deployments are running.
21 / 35
Alex: "Hey team, Checkov just flagged our new deployment. It says 'Vulnerability: Exposed Secrets in Terraform State.' What does that specifically mean?"'Exposed Secrets' refers to sensitive data – passwords, API keys, etc. – unintentionally included in the Terraform state file. Checkov flags this because a compromised state file could allow attackers to gain control of resources. This isn't necessarily a code bug but rather a misconfiguration that needs correction; exposing secrets is a common and critical security vulnerability.
22 / 35
Sarah (in a Slack channel): "The CI pipeline failed. The scan report shows 'Policy Violation: Missing IAM Role for S3 Bucket.' I'm not sure what that means in the context of our infrastructure as code."A 'Policy Violation' in an IaC security scan like Terrascan or Checkov typically relates to access control issues. Specifically, 'Missing IAM Role for S3 Bucket' means the infrastructure resources (the S3 bucket) doesn't have the appropriate Identity and Access Management (IAM) permissions granted to it, which is a frequent cause of data exposure – this is a core security concern.
23 / 35
Ben (in a PR description): "Squashed the last few commits. The scan now reports 'Finding: Hardcoded Credentials in Deployment Script.' I've added environment variables to avoid this."The key takeaway here is that the CI pipeline (or a similar security tool) flagged the hardcoded credentials. Ben's action of using environment variables is *the correct* solution; this prevents the sensitive information from being directly embedded in the script and makes it more secure - this is standard best practice.
24 / 35
Chloe (during a standup): "We're seeing a lot of findings from the Terraform scanning tool. Some are being suppressed with justification – specifically regarding 'Potential Vulnerability: Insecure Network Configuration.' What does that suppression mean?"When an IaC scanning tool flags a finding and it's *suppressed with justification*, this means a security expert has reviewed the alert and determined that, based on specific context (the nature of the network configuration, its intended purpose, etc.), it doesn't represent a genuine risk. The 'justification' provides the reasoning for this determination – crucial to understanding why remediation isn't immediately required.
25 / 35
David: "I'm trying to understand how Terrascan and KICS relate to our IaC security. Can you explain the difference?"Terrascan is primarily a static analysis tool – it examines your Terraform code to identify potential security issues. KICS (Kubernetes Intrusion Countermeasures System) is a runtime security monitoring and control system for Kubernetes environments. They address different stages of the security lifecycle: Terrascan focuses on *prevention* by identifying vulnerabilities in configurations, while KICS focuses on *detection and response* once deployments are running.
26 / 35
Alex: "Hey team, Checkov just flagged our new deployment. It says 'Vulnerability: Exposed Secrets in Terraform State.' What does that specifically mean?"'Exposed Secrets' refers to sensitive data – passwords, API keys, etc. – unintentionally included in the Terraform state file. Checkov flags this because a compromised state file could allow attackers to gain control of resources. This isn't necessarily a code bug but rather a misconfiguration that needs correction; exposing secrets is a common and critical security vulnerability.
27 / 35
Sarah (in a Slack channel): "The CI pipeline failed. The scan report shows 'Policy Violation: Missing IAM Role for S3 Bucket.' I'm not sure what that means in the context of our infrastructure as code."A 'Policy Violation' in an IaC security scan like Terrascan or Checkov typically relates to access control issues. Specifically, 'Missing IAM Role for S3 Bucket' means the infrastructure resources (the S3 bucket) doesn't have the appropriate Identity and Access Management (IAM) permissions granted to it, which is a frequent cause of data exposure – this is a core security concern.
28 / 35
Ben (in a PR description): "Squashed the last few commits. The scan now reports 'Finding: Hardcoded Credentials in Deployment Script.' I've added environment variables to avoid this."The key takeaway here is that the CI pipeline (or a similar security tool) flagged the hardcoded credentials. Ben's action of using environment variables is *the correct* solution; this prevents the sensitive information from being directly embedded in the script and makes it more secure - this is standard best practice.
29 / 35
Chloe (during a standup): "We're seeing a lot of findings from the Terraform scanning tool. Some are being suppressed with justification – specifically regarding 'Potential Vulnerability: Insecure Network Configuration.' What does that suppression mean?"When an IaC scanning tool flags a finding and it's *suppressed with justification*, this means a security expert has reviewed the alert and determined that, based on specific context (the nature of the network configuration, its intended purpose, etc.), it doesn't represent a genuine risk. The 'justification' provides the reasoning for this determination – crucial to understanding why remediation isn't immediately required.
30 / 35
David: "I'm trying to understand how Terrascan and KICS relate to our IaC security. Can you explain the difference?"Terrascan is primarily a static analysis tool – it examines your Terraform code to identify potential security issues. KICS (Kubernetes Intrusion Countermeasures System) is a runtime security monitoring and control system for Kubernetes environments. They address different stages of the security lifecycle: Terrascan focuses on *prevention* by identifying vulnerabilities in configurations, while KICS focuses on *detection and response* once deployments are running.
31 / 35
Alex: "Hey team, Checkov just flagged our new deployment. It says 'Vulnerability: Exposed Secrets in Terraform State.' What does that specifically mean?"'Exposed Secrets' refers to sensitive data – passwords, API keys, etc. – unintentionally included in the Terraform state file. Checkov flags this because a compromised state file could allow attackers to gain control of resources. This isn't necessarily a code bug but rather a misconfiguration that needs correction; exposing secrets is a common and critical security vulnerability.
32 / 35
Sarah (in a Slack channel): "The CI pipeline failed. The scan report shows 'Policy Violation: Missing IAM Role for S3 Bucket.' I'm not sure what that means in the context of our infrastructure as code."A 'Policy Violation' in an IaC security scan like Terrascan or Checkov typically relates to access control issues. Specifically, 'Missing IAM Role for S3 Bucket' means the infrastructure resources (the S3 bucket) doesn't have the appropriate Identity and Access Management (IAM) permissions granted to it, which is a frequent cause of data exposure – this is a core security concern.
33 / 35
Ben (in a PR description): "Squashed the last few commits. The scan now reports 'Finding: Hardcoded Credentials in Deployment Script.' I've added environment variables to avoid this."The key takeaway here is that the CI pipeline (or a similar security tool) flagged the hardcoded credentials. Ben's action of using environment variables is *the correct* solution; this prevents the sensitive information from being directly embedded in the script and makes it more secure - this is standard best practice.
34 / 35
Chloe (during a standup): "We're seeing a lot of findings from the Terraform scanning tool. Some are being suppressed with justification – specifically regarding 'Potential Vulnerability: Insecure Network Configuration.' What does that suppression mean?"When an IaC scanning tool flags a finding and it's *suppressed with justification*, this means a security expert has reviewed the alert and determined that, based on specific context (the nature of the network configuration, its intended purpose, etc.), it doesn't represent a genuine risk. The 'justification' provides the reasoning for this determination – crucial to understanding why remediation isn't immediately required.
35 / 35
David: "I'm trying to understand how Terrascan and KICS relate to our IaC security. Can you explain the difference?"Terrascan is primarily a static analysis tool – it examines your Terraform code to identify potential security issues. KICS (Kubernetes Intrusion Countermeasures System) is a runtime security monitoring and control system for Kubernetes environments. They address different stages of the security lifecycle: Terrascan focuses on *prevention* by identifying vulnerabilities in configurations, while KICS focuses on *detection and response* once deployments are running.
Frequently Asked Questions
What will I practise in "IaC Security Scanning Vocabulary"?
Practice English vocabulary for IaC security scanning: Checkov, policy checks, CI integration, finding suppression, and tools like TFSEC, Terrascan, and KICS.
How many exercises are in this module?
This module has 35 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Infrastructure as Code (IaC) exercises?
Browse the full Infrastructure as Code (IaC) hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.