Practice the vocabulary of enforcing compliance rules as automatically evaluated code.
0 / 5 completed
1 / 5
At standup, a dev mentions expressing an organization's security and compliance rules as version-controlled code that's automatically evaluated against infrastructure changes, instead of a manually enforced written policy document. What is this practice called?
Policy as code expresses an organization's security and compliance rules as version-controlled code that's automatically evaluated against an infrastructure or configuration change, rather than relying on a manually enforced written policy document that a person has to remember and apply consistently. A manually enforced document depends entirely on human diligence and doesn't scale as the number of changes and reviewers grows. Policy as code applies the same rules consistently and automatically to every change, catching a violation a person might otherwise miss.
2 / 5
During a design review, the team wants a proposed infrastructure change to be automatically evaluated against the policy rules before it's allowed to merge or deploy. Which capability supports this?
A policy evaluation gate integrated into the CI/CD pipeline automatically checks a proposed infrastructure change against the defined policy rules before it's allowed to merge or deploy, catching a violation before it ever reaches production. Evaluating policy manually only after a change has already deployed means a violation is discovered after the fact, when it's already live and potentially causing harm. This pre-deployment gate is what makes policy as code a genuinely preventive control rather than just a retrospective audit tool.
3 / 5
In a code review, a dev notices a policy rule is written in a dedicated policy language, like Rego, and tested with its own unit tests before being applied to real infrastructure changes. What does this represent?
Testing a policy rule as code, written in a dedicated policy language and covered by its own unit tests, catches a bug in the policy rule itself, like an overly broad or incorrectly scoped condition, before that flawed rule starts blocking or allowing the wrong changes. Writing an untested, informal policy note risks the policy itself containing a subtle logic error nobody catches until it causes a real problem. Treating a policy rule with the same testing discipline as application code is a natural consequence of policy as code being genuinely code, not just documentation.
4 / 5
An incident report shows a policy rule intended to block a public storage bucket had an off-by-one logic error, silently allowing several public buckets to be created before anyone noticed the flaw. What practice would prevent this?
Writing automated tests for a policy rule itself, verifying it correctly blocks a known-bad case and allows a known-good one, catches a logic error in the rule before it's enforced against real infrastructure changes. Deploying a rule with no test coverage of its own logic risks exactly this kind of silent, undetected flaw letting a genuinely non-compliant change slip through. This test coverage of the policy rule's own correctness is just as important as testing any other piece of code the organization depends on.
5 / 5
During a PR review, a teammate asks why the team enforces security and compliance rules through policy as code instead of relying on a manually enforced written policy document reviewed by a person. What is the reasoning?
A manually enforced written policy document depends on a person consistently remembering and correctly applying every rule to every single change, which realistically varies with reviewer diligence, workload, and familiarity with the rules. Policy as code applies the same rules automatically and consistently to every change through an evaluation gate. The tradeoff is the upfront engineering investment of writing, testing, and maintaining the policy rules themselves as actual code rather than prose.
What does the "Policy as Code Vocabulary" vocabulary exercise cover?
This exercise tests real IT vocabulary related to policy as code vocabulary through 5 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 5 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — this module shares real-world context with 11 other vocabulary modules. See "Related vocabulary" below to keep building a connected skill set.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.