Learn vocabulary for policy-as-code in GitOps workflows, pull-request-based policy changes, policy drift, conftest, and policy library management.
0 / 10 completed
1 / 10
What is the core principle of GitOps applied to policy-as-code?
GitOps for policy-as-code: policy definitions live in Git (OPA Rego files, Kyverno YAML, Sentinel policies). Changes require a PR → review → merge workflow — providing peer review, audit history, and rollback via git revert. A GitOps operator (Argo CD, Flux) syncs policies from Git to the cluster. Key vocabulary: 'desired state in Git,' 'reconciliation loop,' 'declarative policy,' 'drift = cluster state != Git state.'
2 / 10
What is 'pull-request-based policy change' workflow vocabulary?
PR-based policy workflow: developer opens PR to change a Rego policy → CI runs conftest tests against the policy → security team member reviews the logic change → compliance approves if it affects compliance-critical rules → PR merges → GitOps operator applies the new policy to clusters. This gives a full audit trail ('who approved this policy change and when?') — essential for SOC 2, ISO 27001 change management controls.
3 / 10
What is 'policy drift' in GitOps vocabulary?
Policy drift in GitOps: someone directly edits a Kyverno ClusterPolicy via kubectl or the cloud console without going through Git. The cluster now enforces a different policy than what Git declares. GitOps operators detect this mismatch (drift) and either alert or auto-reconcile. Key vocabulary: 'out-of-band change,' 'reconciliation,' 'self-healing GitOps,' 'drift detection.' Preventing drift is the key reason to enforce all changes through Git.
4 / 10
What is conftest in the policy-as-code workflow vocabulary?
conftest (Open Policy Agent ecosystem): run conftest test terraform-plan.json to evaluate Terraform plan against Rego policies. Policies live in a policy/ directory. conftest pull fetches policies from OCI registries (policy libraries). Key vocabulary: 'policy bundle,' 'conftest verify' (test the tests), 'namespace' (Rego package), 'data' (policy input). Integrates into CI pipelines to block PRs that introduce non-compliant infrastructure changes.
5 / 10
What is a 'policy library' in policy-as-code vocabulary?
Policy libraries: instead of each team writing their own Rego rules for 'S3 buckets must be encrypted' or 'containers must not run as root,' a platform team maintains a policy library (OCI artifact, Git submodule, or Terraform module). Teams reference specific versions. Examples: Styra DAS policy library, Gatekeeper policy library (CNCF), AWS Security Hub controls. Key vocabulary: 'policy versioning,' 'policy inheritance,' 'policy registry,' 'breaking policy changes.'
6 / 10
Review Comment: 'I'm seeing a high number of policy-engine-v1 deployments failing due to the new rate limiting policy. Can you confirm the current conftest configurations are accurately reflecting the desired limits?' What does 'conftest' refer to in this context?
'Conftest' is a crucial element in GitOps policy-as-code. It represents a testing environment – specifically a set of configuration files – used to validate that your policy changes will function as expected before being applied to the production environment. The reviewer is asking if the conftest setup correctly mirrors the intended rate limits, preventing unexpected failures.
7 / 10
Slack Message: '@john.doe – Just ran a check on the staging environment and it's still triggering the denial of access for users exceeding 100 requests per minute. We need to ensure our policy-as-code is properly deployed and that pull-request-based policy change workflows are consistently followed.' What does 'pull-request-based policy change' signify?
'Pull-request-based policy change' describes the standard GitOps workflow: changes are made as code in a pull request, then reviewed and tested before being merged into the main branch and deployed. This ensures accountability, collaboration, and allows for rollback if necessary – key tenets of GitOps.
8 / 10
PR Description: 'Applying policy update #1234 to enforce stricter rate limiting on API calls. Using a new policy library that integrates with the existing deployment pipeline. This will reduce potential DDoS attacks.' What is a 'policy library' in this context?
The term 'policy library' refers to a centralized repository of pre-defined policy rules and templates. Using a library promotes consistency, reduces duplication of effort, and simplifies the process of applying policies across multiple services or environments within your GitOps workflow.
9 / 10
Standup Update: 'I've been working on integrating the new policy engine-v2 with our infrastructure as code. We're using a pull-request-based policy change workflow to manage updates, and I'm closely monitoring for any signs of policy drift.' What does 'policy drift' mean in this context?
'Policy drift' describes the critical risk in GitOps – when the actual state of your systems deviates from what is defined by your policy-as-code. This can occur due to manual changes, automation errors, or misconfigurations, leading to unintended consequences and security vulnerabilities. Monitoring for drift is therefore paramount.
10 / 10
API Response: { "status": "error", "message": "Policy enforcement failed: Rate limit exceeded (105 requests/minute). Verify conftest configuration and policy library definitions."} What action should be taken based on this API response?
This API response indicates a policy violation – specifically, exceeding the rate limit defined in your policy. The response directs you to investigate the conftest configuration and the policy library as these are the sources of truth for the policy definition; any discrepancies will lead to this type of error.
What will I practice in "GitOps Policy Workflow — Vocabulary"?
This is a Policy As Code exercise set. It walks through 10 scenario-based multiple-choice questions built around real usage of policy as code terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 10 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the policy as code vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Policy As Code exercises?
See the Policy As Code exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — policy as code vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.