Practice English vocabulary for IaC policy enforcement: Sentinel policies, pre-apply evaluation, hard fails, soft fails, and OPA for cross-cloud policy.
0 / 15 completed
1 / 15
What does 'Sentinel policy prevents non-compliant infrastructure' mean?
Sentinel policies act as guardrails in the Terraform workflow. They check things like 'all EC2 instances must have required tags', 'no public S3 buckets', or 'only approved instance types may be used'. Violations can block or warn about the apply.
2 / 15
What does 'the policy evaluates before apply' mean?
Pre-apply policy evaluation is key to policy-as-code effectiveness. By evaluating the plan (not the running infrastructure), non-compliant changes are caught before any infrastructure is modified — preventing the need to roll back.
3 / 15
What is a 'hard fail' in IaC policy enforcement?
Sentinel and OPA policy results can be 'hard fail' (mandatory block), 'soft fail' (can be overridden with approval), or 'advisory' (warning only). Hard fails represent non-negotiable guardrails where the business risk of violation is too high to allow exceptions.
4 / 15
What is a 'soft fail' in IaC policy enforcement?
Soft fails enable policy enforcement with human judgment. A policy might soft-fail when a proposed resource doesn't follow naming conventions — the team lead can review and approve the exception. The override is logged for auditability.
5 / 15
What is 'OPA for cross-cloud policy'?
OPA is cloud-agnostic and tool-agnostic — the same Rego policies can evaluate Terraform plans, Kubernetes admission requests, and API authorization decisions. This makes it attractive for organizations using multiple clouds or infrastructure tools who want unified governance.
6 / 15
Code Review Comment: 'The Terraform output indicates a 'policy deny' for the instance type. It seems like we're blocking deployments of t3.medium instances. Should we allow this, or is there an underlying reason why it's not compliant?'
This scenario tests understanding of proactive policy engagement. The reviewer isn't simply confirming compliance but questioning the *reason* behind the denial, highlighting the importance of investigating and potentially adapting policies based on context. Option A is too permissive; option C ignores a potential problem; and option D misinterprets the purpose of IaC policies.
7 / 15
Slack Message from Alex (DevOps Engineer): 'Just ran a policy check on the new Kubernetes deployment. OPA flagged an insecure S3 bucket access rule – it's failing because we haven't configured IAM roles properly. Rolling back until we fix this.'
This tests understanding of OPA's role in detecting issues and the importance of rapid response. The message emphasizes proactive detection – a key benefit of IaC policy enforcement. Options A and D are completely inappropriate; option B misses the critical need for automation.
8 / 15
PR Description: 'Applying Terraform configuration with strict policy enforcement. The apply command is configured to perform a 'hard fail' if any policy checks return non-zero exit codes.'
This question focuses on understanding the consequence of 'hard fail' in policy enforcement. A 'hard fail' triggers immediate rollback – preventing potentially problematic infrastructure from being deployed. Options B and D are incorrect; option C is a misinterpretation of the term.
9 / 15
API Response (OPA): `{"status": "fail", "message": "Policy 'secure_s3_access' violated: S3 bucket my-bucket does not have a KMS key associated.", "resource": "kubernetes/deployment"}`
This tests interpreting a concrete OPA output. The response clearly shows that the policy is actively identifying a violation – a key function of IaC guardrails. Options A and D are incorrect; option C ignores the actionable information in the message.
10 / 15
Standup Update from Ben (Infrastructure Lead): 'We're using OPA to enforce our IaC policies across AWS and Azure. We've integrated it with our Terraform modules to ensure all deployments meet our security standards – including things like encryption at rest and least privilege access.'
This scenario assesses understanding of the broader benefits of cross-cloud IaC policy enforcement. The core value lies in maintaining consistent policies across different environments. Options A and D are irrelevant; option C underestimates OPA's capabilities.
11 / 15
Code Review Comment: 'The Terraform output indicates a 'policy deny' for the instance type. It seems like we're blocking deployments of t3.medium instances. Should we allow this, or is there an underlying reason why it's not compliant?'
This scenario tests understanding of proactive policy engagement. The reviewer isn't simply confirming compliance but questioning the *reason* behind the denial, highlighting the importance of investigating and potentially adapting policies based on context. Option A is too permissive; option C ignores a potential problem; and option D misinterprets the purpose of IaC policies.
12 / 15
Slack Message from Alex (DevOps Engineer): 'Just ran a policy check on the new Kubernetes deployment. OPA flagged an insecure S3 bucket access rule – it's failing because we haven't configured IAM roles properly. Rolling back until we fix this.'
This tests understanding of OPA's role in detecting issues and the importance of rapid response. The message emphasizes proactive detection – a key benefit of IaC policy enforcement. Options A and D are completely inappropriate; option B misses the critical need for automation.
13 / 15
PR Description: 'Applying Terraform configuration with strict policy enforcement. The apply command is configured to perform a 'hard fail' if any policy checks return non-zero exit codes.'
This question focuses on understanding the consequence of 'hard fail' in policy enforcement. A 'hard fail' triggers immediate rollback – preventing potentially problematic infrastructure from being deployed. Options B and D are incorrect; option C is a misinterpretation of the term.
14 / 15
API Response (OPA): `{"status": "fail", "message": "Policy 'secure_s3_access' violated: S3 bucket my-bucket does not have a KMS key associated.", "resource": "kubernetes/deployment"}`
This tests interpreting a concrete OPA output. The response clearly shows that the policy is actively identifying a violation – a key function of IaC guardrails. Options A and D are incorrect; option C ignores the actionable information in the message.
15 / 15
Standup Update from Ben (Infrastructure Lead): 'We're using OPA to enforce our IaC policies across AWS and Azure. We've integrated it with our Terraform modules to ensure all deployments meet our security standards – including things like encryption at rest and least privilege access.'
This scenario assesses understanding of the broader benefits of cross-cloud IaC policy enforcement. The core value lies in maintaining consistent policies across different environments. Options A and D are irrelevant; option C underestimates OPA's capabilities.
What will I practise in "IaC Policy and Guardrails Vocabulary"?
Practice English vocabulary for IaC policy enforcement: Sentinel policies, pre-apply evaluation, hard fails, soft fails, and OPA for cross-cloud policy.
How many exercises are in this module?
This module has 15 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Infrastructure as Code exercises?
Browse the full Infrastructure as Code hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.