Learn vocabulary for infrastructure compliance checks, drift detection, policy enforcement points, remediation automation, audit trails, and compliance gates in CI/CD.
0 / 10 completed
1 / 10
What is 'compliance as code' in infrastructure vocabulary?
Compliance as code (also called policy as code when focused on enforcement): encode SOC 2, PCI-DSS, CIS benchmarks, or custom security controls as code. Tools: AWS Config rules, HashiCorp Sentinel, Open Policy Agent (OPA), Chef InSpec, Ansible playbooks. Benefits: controls are version-controlled, testable, reproducible, and continuously evaluated rather than assessed once per audit cycle.
2 / 10
What is 'drift detection' in compliance as code vocabulary?
Drift detection: 'Your S3 bucket had public-access-block enabled at provisioning, but someone disabled it via the console 3 days ago — this is drift.' Tools: AWS Config (continuous evaluation), Terraform state drift (terraform plan detects drift), Chef InSpec (test infrastructure against compliance profile). Drift can indicate unauthorized changes, misconfigurations, or manual emergency fixes that were never reverted.
3 / 10
What is a 'policy enforcement point' in compliance as code vocabulary?
Policy enforcement points (PEPs) in a shift-left compliance strategy: (1) IDE/pre-commit: developer gets immediate feedback. (2) CI pipeline: policy check blocks the PR if violations found. (3) CD pipeline: compliance gate before deploying to production. (4) Runtime: admission controller (Kubernetes), service mesh authorization policy, or cloud config rule evaluates at deploy/request time. Multiple PEPs create defense in depth.
4 / 10
What is 'remediation automation' in compliance as code vocabulary?
Remediation automation levels: (1) Notify only — create ticket, send alert. (2) Guided remediation — provide instructions or a runbook link. (3) Automatic remediation — directly correct the violation (AWS Config auto-remediation SSM documents, Terraform apply to restore desired state). Auto-remediation is powerful but risky — validate it won't cause outages. Prefer notify-then-auto-remediate with a time window for human review.
5 / 10
What is a 'compliance gate' in a CI/CD pipeline vocabulary?
Compliance gate vocabulary: 'The pipeline failed at the compliance gate — conftest found 2 policy violations in the Terraform plan: S3 bucket logging is disabled and the RDS instance is not encrypted at rest. Fix these before the PR can merge.' Tools: conftest (OPA/Rego policies against Terraform plans), tfsec, checkov, Snyk IaC. Compliance gates shift compliance left — finding violations before they reach production.
6 / 10
Alice: 'Hey team, I'm seeing a lot of instances where our microservices are deploying with overly permissive network access rules. It's flagged by the security dashboard as a potential drift. What does 'drift detection' mean in this context regarding compliance as code?',
Drift detection refers to the automated process of identifying discrepancies between the current state of a system and its defined compliance policies. This often involves monitoring configuration files or infrastructure-as-code templates for changes – deviations from the expected rules are flagged as potential security risks or non-compliance issues. Option A is about software versions, while C describes manual review and D refers to CI/CD features.
7 / 10
During a Slack conversation with Ben (Security Engineer), you receive the following message: 'We've identified a policy violation in our Kubernetes cluster – pods are using outdated TLS certificates. The remediation automation system hasn't triggered yet. What is a 'policy enforcement point' within the context of this situation?'
A policy enforcement point is a critical element in compliance as code – it represents the place where a policy's rules are actively verified and enforced. In this scenario, the Kubernetes cluster itself acts as the enforcement point, with systems like configuration management tools or security agents monitoring for violations and triggering corrective actions (like updating TLS certificates). Options A describes a repository, B is remediation automation, and D is a broader audit process.
8 / 10
You're writing the PR description for a change that updates the security configuration of your AWS Lambda functions. The description includes the following: 'This update enforces stricter IAM roles and limits outbound network access to only trusted services.' What aspect of compliance as code is this primarily addressing?
This PR description is focused on access control – a core element of compliance as code. By explicitly stating the stricter IAM roles and limited outbound network access, you're implementing a policy to prevent unauthorized access and protect sensitive data. Options A are about OS versions, C concerns scaling, and D relates to performance monitoring.
9 / 10
Charlie (DevOps Lead) asks you: 'We're implementing a compliance gate in our CI/CD pipeline. What is the primary purpose of this gate?'
A compliance gate in a CI/CD pipeline acts as a critical checkpoint to ensure that every change meets pre-defined security and compliance policies before it's deployed. It doesn't just automate deployments; it actively *verifies* compliance, preventing potentially risky or non-compliant code from reaching production environments. Options A describes fully automated deployment, C is about release tracking, and D focuses on build optimization.
10 / 10
You are reviewing a code review comment from David (Security Analyst): 'The new API endpoint doesn't include any rate limiting or authentication checks. This exposes the service to potential abuse.' Considering compliance as code, what does David's comment highlight regarding remediation automation?
David's comment points to a critical gap in compliance – the absence of security controls like rate limiting and authentication. This directly indicates an area where remediation automation should be triggered. The system should automatically enforce these missing policies (e.g., adding API gateways with throttling or requiring proper authentication) rather than relying on manual intervention, as described in option B.
What will I practice in "Compliance as Code — Vocabulary"?
This is a Policy As Code exercise set. It walks through 10 scenario-based multiple-choice questions built around real usage of policy as code terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 10 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the policy as code vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Policy As Code exercises?
See the Policy As Code exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — policy as code vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.