A platform engineer explains the technology stack: "We use OPA as our policy engine across the board — not just Kubernetes. The same engine evaluates policies for our CI pipeline, our Terraform runs, and our microservices authorisation layer. Policies are written in Rego and the engine answers a simple question: given this input document and this data document, does the policy allow or deny?"
What is the role of the input document in an OPA evaluation?
Input document: the JSON-structured data representing the request or resource being evaluated. In Kubernetes, it is the admission review object — e.g., a pod spec sent to OPA before it is created. In an API gateway context, it might be the HTTP request (method, path, headers, JWT claims).
Contrast with the data document: static or semi-static reference data loaded into OPA (e.g., approved registries, employee roles). Rego policies can reference both. The policy returns a decision — typically allow = true or a set of deny messages.
2 / 15
Complete the sentence with the correct term.
A senior DevSecOps engineer says: "When a new pod is submitted to the Kubernetes API, it passes through two types of webhooks. A ___________ webhook can alter the resource — for example, injecting a sidecar or setting default security contexts — before it is stored. A validating webhook can only accept or reject it."
Mutating webhook: an admission webhook that can modify (mutate) a resource object before it is persisted. Common uses: injecting Istio sidecar containers, adding default resource limits, or appending labels. Mutations are applied first in the admission chain.
Validating webhook: runs after mutating webhooks and can only approve or reject — it cannot change the resource. Gatekeeper's policy enforcement is implemented as a validating webhook. If a resource violates a constraint, the webhook returns a denial with a human-readable violation message.
3 / 15
Match the definition.
Which option best defines Gatekeeper in a Kubernetes context?
Gatekeeper: a CNCF project that integrates OPA with Kubernetes as a validating admission controller. Policies are defined in two layers:
ConstraintTemplate — a CRD that contains the Rego logic and defines a new custom resource kind (e.g., K8sRequiredLabels). Constraint — an instance of that custom resource that scopes and parameterises the policy (e.g., "require label owner on all pods in namespace prod").
Violations are stored as Kubernetes events and can be queried with kubectl get constraints. Gatekeeper supports audit mode (report violations without blocking) and enforcement mode (deny non-compliant resources).
4 / 15
A compliance engineer describes the team's workflow: "We use Sentinel in our Terraform Enterprise pipelines. Before any infrastructure plan is applied, Sentinel evaluates our governance policies — things like 'all S3 buckets must have versioning enabled' or 'EC2 instances must not be publicly accessible'. If a policy fails, the plan is blocked. We have a small number of approved exceptions with documented waivers for legacy resources."
What is the difference between an exception and a waiver in policy-as-code governance?
Exception: a deliberate, managed exclusion of a specific resource, namespace, or team from a policy rule — encoded in the policy itself (e.g., a list of approved exceptions in the OPA data document). Exceptions should be version-controlled and reviewed like code.
Waiver: a formal, time-bound approval acknowledging a known policy violation. Waivers are common in compliance frameworks (e.g., SOC 2, FedRAMP) where immediate remediation is not feasible. A waiver documents: the violation, the risk owner, the expiry date, and the remediation plan.
Good policy-as-code practice: keep both exceptions and waivers in code, reviewed via pull request, with expiry dates enforced automatically.
5 / 15
Complete the sentence with the correct term.
A staff engineer explains the CI/CD pipeline to a new joiner: "Every pull request that touches infrastructure goes through a ___________ — a mandatory policy check that must pass before the change can be merged or applied. It's part of our compliance-as-code approach: the controls are automated and auditable, not just documented in a wiki."
Policy gate: a mandatory automated check in a CI/CD pipeline that evaluates policy rules before a change proceeds. If the gate fails, the pipeline is blocked. Policy gates are a key mechanism in compliance-as-code — encoding regulatory or organisational controls directly into the delivery pipeline rather than relying on manual reviews.
In conversation: "We have a policy gate in our GitHub Actions workflow that runs conftest against every Terraform plan — if any resource violates our tagging or encryption policy, the PR cannot be merged."
6 / 15
Reviewer: 'This PR adds a new policy to our OPA engine. It's designed to prevent deployments with overly permissive IAM roles. The input document is a JSON representation of the deployment configuration, and OPA evaluates it against our role-based access control policies. Can you clarify how this input document format ensures we capture all necessary security context?'
The correct answer highlights that the *input document* is crucial. OPA's policy engine takes this structured data and uses it to make decisions. The other options misunderstand OPA's core function – evaluating a configuration against defined rules based on an input document; OPA doesn't inherently *know* what constitutes a 'permissive IAM role' without that specific information.
7 / 15
DevSecOps Lead (Sarah): 'Hey team, we're seeing some issues with Terraform deployments failing due to policy violations. It looks like the kubectl apply -f my-terraform.tfplan command isn't automatically triggering a policy evaluation. We need a way to ensure all infrastructure changes are vetted before they go live. What should I tell the team to do?'
The correct answer focuses on automating the policy evaluation. Using a pre-deployment hook that triggers a policy engine (like OPA or Sentinel) is the standard practice for compliance-as-code. The other options represent less efficient or incorrect solutions – manual reviews are impractical at scale, and adding checks within Terraform scripts can lead to inconsistencies.
8 / 15
OPA API Response (JSON): {
"status": "denied",
"policy": "restrict-public-access",
"message": "The deployment configuration violates policy restrict-public-access. EC2 instances must not be publicly accessible.",
"details": [
{
"resource": "EC2Instance",
"property": "securityGroup",
"value": "0.0.0.0/0"
}
]
}
The correct answer emphasizes the detail provided in the API response. A good policy engine's response should not just say 'denied'; it needs to pinpoint *which* policy was triggered and *what* specific configuration element caused the violation (in this case, a public EC2 security group). This allows developers to quickly understand and rectify the issue.
9 / 15
A security engineer is investigating a recent deployment failure. The logs show an OPA evaluation failing with the message: 'Policy `deny-unencrypted-traffic` violated.' Which tool was likely used to enforce this policy?
kubectl apply -f my-deployment.yaml
OPA is the core engine used to evaluate policies in this scenario. While other tools can contribute to security, OPA is specifically responsible for dynamically assessing configuration against defined policies during deployments. The error message directly indicates a policy violation handled by OPA.
10 / 15
During a Slack discussion about infrastructure changes, a developer says, 'We need to ensure that all new deployments automatically run through Sentinel before they're applied. It's crucial for maintaining our governance policies.' What is Sentinel primarily responsible for?
Automated policy enforcement
Sentinel is a policy engine that focuses on evaluating and *enforcing* infrastructure governance policies – in this case, specifically for Terraform deployments. It's not simply generating plans or monitoring metrics; it actively checks configurations against predefined rules before allowing changes to proceed.
11 / 15
A DevOps engineer is explaining the use of Gatekeeper to a new team member. 'We're using Gatekeeper to enforce policies on our Kubernetes clusters – specifically, ensuring that all deployments adhere to strict security guidelines. It's like having a central rulebook that automatically checks every change before it's applied.' Which of the following best describes Gatekeeper's primary function?
Gatekeeper is a Kubernetes admission controller that enforces policies. It intercepts requests to the API server and validates them against predefined rules. Options B, C, and D describe other functionalities, but Gatekeeper's core role is policy enforcement.
12 / 15
A senior developer is writing a comment in a code review for a PR that introduces an OPA policy. 'This policy prevents deployments with overly permissive IAM roles, ensuring our infrastructure remains secure.' Which of the following best captures the essence of this statement?
This comment highlights the use of OPA's capabilities to control access permissions – a key function when managing IAM roles. Options A, C, and D describe different optimization or rate-limiting strategies, not the core purpose of this specific policy.
13 / 15
"We're using Sentinel to validate our Terraform configurations before they're applied. It ensures that every change aligns with our governance policies – things like limiting the number of EC2 instances and restricting access to specific AWS services." Which tool is most directly responsible for this validation process?
Sentinel is a policy engine integrated within Terraform Enterprise. It's specifically designed to evaluate and enforce governance policies during the Terraform planning phase. Options A, C, and D represent alternative infrastructure-as-code tools or components.
14 / 15
"The CI/CD pipeline mandates a policy check – using OPA – before any pull request touching infrastructure is merged. This ensures that all deployments adhere to our security standards and prevent unintended consequences." What is the primary purpose of this 'policy check' in the context of the CI/CD pipeline?
This 'policy check' represents an admission control mechanism, ensuring that infrastructure changes meet pre-defined governance requirements. This is a common practice in secure CI/CD pipelines to prevent misconfigurations and vulnerabilities.
15 / 15
"During our standup meeting, I mentioned that we're using OPA to evaluate policy violations in our deployments. When a deployment fails due to a policy breach – like an EC2 instance being publicly accessible – OPA automatically rejects the deployment and alerts us."
This describes OPA's role as an admission controller – it actively rejects deployments that violate configured policies. Options A, B, and C describe different uses of OPA, but this scenario focuses on its core function: policy enforcement during the deployment process.
What does the "Policy-as-Code Vocabulary" vocabulary exercise cover?
This exercise tests real IT vocabulary related to policy-as-code vocabulary through 15 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 15 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — this module shares real-world context with 9 other vocabulary modules. See "Related vocabulary" below to keep building a connected skill set.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.