Learn vocabulary for communicating policy violations: violation messages, exception requests, waiver vocabulary, and remediation.
0 / 10 completed
1 / 10
What is a 'policy violation message' and what should it include?
Good policy violation messages: WHAT was violated ('You attempted to create an S3 bucket without server-side encryption'), WHY the policy exists ('All storage must be encrypted per security policy SEC-003'), and HOW to fix it ('Add aws:kms or AES256 to the ServerSideEncryptionConfiguration') or request an exception ('Submit a waiver at [link]').
2 / 10
What is a 'policy exception' (or waiver) in policy enforcement vocabulary?
A policy exception (waiver): 'System X is exempt from Policy Y for 90 days because of [specific reason]. Approved by [Name/Role]. Owner: [Team]. Expires: [Date]. Review required at expiry.' Exceptions must be formal, time-limited, reviewed, and tracked — not permanent backdoors.
3 / 10
What is 'policy remediation' in policy-as-code vocabulary?
Policy remediation: fixing the non-compliant resource to satisfy the policy. For infrastructure: adding missing tags, enabling encryption, removing public access. Remediation can be manual (engineer fixes the config), semi-automated (the policy system generates the correct configuration), or fully automated (auto-remediation using Lambda/Azure Functions triggered by violation events).
4 / 10
What is 'auto-remediation' in policy enforcement vocabulary?
Auto-remediation: when a policy violation is detected, a function automatically corrects it. Examples: AWS Config Rules triggering Lambda to add required tags, Kubernetes admission controller mutating webhooks that inject required labels, or Terraform Sentinel applying automatic fixes. Reduces toil but requires careful design to avoid unintended side effects.
5 / 10
What is 'compliance drift reporting' in policy enforcement vocabulary?
Compliance drift reports: 'As of this week, 23 resources violate Policy SEC-003 (encryption required). 15 are new violations; 8 were reported last week and have not been remediated. Oldest unresolved violation: 45 days. Top violating team: [Team name].' Reports drive accountability and remediation prioritization.
6 / 10
Review Comment: 'This PR introduces a potential policy violation – excessive API calls to the external service. The current rate limit is being exceeded by approximately 30% during peak hours. Consider implementing caching or throttling.' What does 'throttling' likely refer to in this context?
'Throttling' in this scenario means limiting the rate at which requests are made to the external service. This is a common technique to prevent overwhelming the external API and causing performance issues or violating its usage policies. Option A is incorrect as throttling actively *limits* the rate, not increases it. Option C focuses on logging, while option D addresses resilience, not policy enforcement.
7 / 10
Slack Message: '@john.doe – Just flagged a potential policy violation in the new microservice deployment. The service is currently attempting to write directly to S3 without using our approved encryption key. Requesting immediate attention and confirmation of this configuration.' What does 'encryption key' relate to within the context of this message?
The message explicitly mentions 'encryption key,' indicating a concern about data security. Encryption keys are used to encrypt data before it's stored in S3, protecting it from unauthorized access. Option A is an authentication token; option C and D refer to different aspects of the microservice's operation, not directly related to the policy violation.
8 / 10
PR Description: 'This change introduces a new feature that allows users to upload large files directly to our cloud storage. To prevent potential policy violations related to data egress limits, we've implemented a size restriction of 10GB per file. Users exceeding this limit will be automatically blocked.' What does the phrase 'data egress limits' refer to?
'Data egress limits' specifically refers to the restrictions placed on the amount of data leaving an organization's network or cloud environment – this is a frequent trigger for policy violations related to bandwidth usage and potential costs. Option A describes 'data ingress', while options B and D relate to storage capacity and bandwidth allocation, respectively.
9 / 10
Standup Update: 'I've been working on implementing automated policy remediation for the recent database access violations. The system automatically blocks any new users attempting to connect directly to the database without proper authentication, preventing unauthorized access.' What is 'automated policy remediation' in this context?
'Automated policy remediation' describes a system that proactively enforces policies by taking actions automatically when a violation is detected – in this case, blocking connections. This contrasts with a manual review process (option A) or simply logging activity (option C). Option D relates to database backups.
10 / 10
API Response: The server returned the following error message: 'Policy Violation – Excessive Number of Failed Authentication Attempts. Account temporarily locked.' What does this API response indicate about the user's account?
This API response clearly states that the account was 'temporarily locked' after exceeding a threshold of failed authentication attempts – this is a standard policy enforcement mechanism used to prevent brute-force attacks. Option A suggests permanent disabling; options C and D address different aspects of login issues.
What will I practice in "Policy Violations — Communication and Vocabulary"?
This is a Policy As Code exercise set. It walks through 10 scenario-based multiple-choice questions built around real usage of policy as code terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 10 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the policy as code vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Policy As Code exercises?
See the Policy As Code exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — policy as code vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.