ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
During an infrastructure-as-code deployment, Terraform plans are generated and automatically applied to production. Security wants assurance that only the hardened CIS baseline module is used and that no unapproved resources reach the cloud account. Which pipeline control best enforces deployment of the approved configuration?
Execute unit tests on each Terraform module during development to catch configuration errors early.
Permit maintainers to override module variables at runtime but record the overrides in an audit log.
Require designated code owners to manually review and approve every Terraform plan in a chat channel.
Insert a policy-as-code gate that validates the Terraform plan against the signed baseline before the apply stage.
A policy-as-code gate evaluates the Terraform plan against established rules before it is applied. Solutions such as HashiCorp Sentinel or Open Policy Agent can compare every resource and variable to the signed CIS baseline module and block the pipeline if drift or insecure settings are detected, guaranteeing that only the approved configuration is deployed. Manual reviews are useful but error-prone and do not scale. Allowing runtime overrides, even with logging, still permits non-compliant infrastructure to be created. Unit tests on individual modules check code quality in isolation but cannot ensure that the final plan applied to the cloud environment matches the hardened baseline.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is Terraform and how does it relate to infrastructure-as-code?
Open an interactive chat with Bash
What is a policy-as-code gate and how does it enforce security during deployment?
Open an interactive chat with Bash
What is a CIS baseline module, and why is it important for Terraform deployments?
Open an interactive chat with Bash
What is policy-as-code and how does it work?
Open an interactive chat with Bash
What is a hardened CIS baseline module?
Open an interactive chat with Bash
What is a Terraform plan and why is it important?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)