Policy Review Language — Proposals, Approvals, and Exceptions
Practice the formal vocabulary used in policy governance: how to describe a policy proposal, how approval decisions are communicated, how to write an exception request, and what "risk accepted" means in a policy context.
0 / 10 completed
1 / 10
You are opening a policy review meeting. Which sentence correctly uses 'the policy proposal is'?
'The policy proposal is to [verb] [what] [scope] [conditions]' introduces the intent of the new or amended policy in governance vocabulary. It describes the change being considered, not the current violation state or the technical implementation. Other correct forms: 'The policy proposal is to restrict privileged containers in all namespaces except kube-system,' 'The policy proposal is to move the existing advisory gate to hard enforcement on 2026-09-01.'
2 / 10
A security review committee responds: 'Approved with conditions.' What does this mean in a policy governance context?
'Approved with conditions' is a formal governance outcome distinct from unconditional approval. Conditions might include: 'Pilot in staging for 30 days before production enforcement,' 'Exception process must be documented before enforcement begins,' 'The policy must include a warn mode for 14 days before switching to deny.' In meeting notes and policy documents, conditions must be written explicitly: 'Approved with conditions: (1) ..., (2) ...' so the policy owner can track fulfillment.
3 / 10
Fill in the blank to complete a correct policy exception request opening: 'We are submitting a policy exception request for _____, because our payment processing service requires outbound HTTPS to a third-party PCI-certified endpoint that is not on the approved egress allowlist.'
A policy exception request must identify: (1) the specific control or policy rule (NET-EGRESS-001), (2) the exact scope of the exception (the payments-service workload, in the production namespace — not a broader category). It must not request blanket relaxation. The structure is: 'exception request for [control ID] as applied to [specific resource/scope].' The business reason follows ('because...'). Vague exception requests ('make the policy less restrictive') are not acceptable in a compliance-grade governance process.
4 / 10
When is 'risk accepted' used correctly in policy governance vocabulary?
'Risk accepted' is formal governance language — not informal acknowledgement. Requirements for valid risk acceptance: (1) Authorized approver (CISO, VP Eng, or defined risk owner — not the engineer who wrote the code), (2) Documented risk statement (what risk is being accepted), (3) Rationale (why it cannot be immediately mitigated), (4) Expiry date (risk acceptance is time-bounded, not permanent), (5) Compensating controls if available. 'Risk accepted' appears in the audit trail as evidence that the organization made a conscious decision — not that a control was accidentally missed.
5 / 10
A policy document states: 'Scope of this policy: all Kubernetes workloads in production and staging namespaces, excluding kube-system and monitoring.' A developer asks if it applies to their CI runner Pods. What is the correct interpretation?
Policy scope vocabulary: the scope defines the boundaries of applicability — namespace, cluster, environment label, resource type, or team. Correct reasoning: check whether the CI runner Pods' namespace is within scope (production or staging) or excluded (kube-system, monitoring) or neither (a separate ci namespace not listed). If the namespace is not explicitly in scope, the policy does not apply. If ambiguous, the correct action is to ask the policy owner to clarify scope — not to self-exclude or disable enforcement. 'Is this in scope?' is a governance question, not a technical one.
6 / 10
Reviewer: 'This PR doesn't align with the data retention policy. The logs are being written to a local disk instead of the centralized logging server.'
Which of the following best describes the reviewer's concern regarding the proposed code change?
This question tests understanding of policy enforcement. The reviewer is not focused on security vulnerabilities or performance; they are specifically highlighting that the code deviates from the defined data retention policy – namely, improper logging practices. Selecting this option demonstrates an awareness of compliance requirements associated with data management policies.
7 / 10
Dev Team Lead (Sarah): 'Hey team, just a quick reminder – all new API endpoints must undergo a security review before deployment. Let's ensure we're following the 'Secure API Development' policy.'
Which of the following responses from a developer best demonstrates understanding of Sarah's message?
This tests understanding of proactive compliance. The correct response acknowledges the existence of the policy and seeks clarification, indicating a commitment to adhering to it. Options A and B show a lack of awareness; option C is premature – the scan doesn't guarantee full policy compliance, and D prioritizes speed over adherence, which is rarely acceptable when policies are in place.
8 / 10
PR Description: 'Implemented new feature X. This change utilizes the 'Enhanced User Authentication' API to improve user login security.'
Which of the following phrases *best* completes this PR description, reflecting a policy-aware approach?
This focuses on policy alignment in documentation. The correct answer explicitly references the 'Authentication Policy,' demonstrating that the developer understands the context and justification for the change. Options A is too broad, B focuses solely on technical aspects (performance), and D misrepresents the purpose of the change.
9 / 10
Team Lead (Mark): 'Okay, update – we're still evaluating whether to use the new 'Cloud Storage Access' policy for our CI/CD pipeline. We need to assess the potential impact on data egress costs.'
Which of the following statements would be *most* appropriate for a developer to add to Mark's update?
This assesses understanding of strategic alignment. The correct response shows proactive investigation and a focus on the policy's benefits (cost reduction) within the context of the team's goals. Options A is dismissive, B is premature without evidence, and D reflects a lack of engagement.
10 / 10
API Response (from Policy Engine): `{"status": "warning", "message": "The requested action violates policy: 'Data Access - Tier 2' – User access is restricted to read-only data within the Finance department. Attempting to write to the database is prohibited.", "details": {"policy_id": "DA-T2", "user_id": "john.doe", "resource": "finance_db"}}`
What does this API response *primarily* indicate?
This tests comprehension of policy violations. The response clearly states a violation of the 'Data Access - Tier 2' policy regarding write access to the database for a specific user and resource. This indicates that the system is actively enforcing access controls based on pre-defined rules, not a technical issue or security breach.
What will I practice in "Policy Review Language — Proposals, Approvals, and Exceptions"?
This is a Policy As Code exercise set. It walks through 10 scenario-based multiple-choice questions built around real usage of policy as code terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 10 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the policy as code vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Policy As Code exercises?
See the Policy As Code exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — policy as code vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.