Drag and Drop Question You wish to create a custom policy with build and run subtypes. Match the query types for each example. (Select your answer from the pull-down list. Answers may be used more…

Question

Exhibit

Answer Area

Explanation

This question tests the ability to distinguish between build-time and run-time policy evaluation methods, based on query syntax and common policy language types.

Approach. The correct interaction is to drag 'Run' and 'Build' options to the appropriate targets based on whether the query or type represents a build-time or run-time policy evaluation.

1. 'config where cloud.type = 'aws'' represents a query against existing cloud configurations, typical of a run-time evaluation. This syntax is characteristic of a Resource Query Language (RQL) used to evaluate deployed resources. Thus, it maps to 'Run'.
2. '$.resource[*].aws_s3_bucket exists' uses JSONPath-like syntax to check for the existence of an S3 bucket within a resource definition (e.g., in a template or manifest), characteristic of build-time template validation before deployment. Thus, it maps to 'Build'.
3. 'RQL type' refers to Resource Query Language, which is specifically designed to query the configuration of deployed resources at run-time for continuous compliance and posture management. Thus, it maps to 'Run'.
4. 'JSON query type' typically refers to queries (like JSONPath) used to validate the structure and content of JSON configuration files or infrastructure-as-code templates, usually performed during the build or pre-deployment phase. Thus, it maps to 'Build'.

Common mistakes.

• common_mistake. A common mistake is to confuse build-time and run-time policy evaluations. For instance, incorrectly associating RQL (Resource Query Language) with build-time checks, when it is inherently designed for querying live, deployed resources. RQL queries configurations that are already in the cloud environment. Another mistake would be to map JSON query types, which are often used for static analysis of templates or definitions before deployment, to run-time evaluations. The syntax 'config where' clearly indicates querying existing configurations (run-time), while '$.resource[*]' with 'exists' within a JSON structure points to template validation (build-time). Reversing these mappings would lead to incorrect answers.

Concept tested. The core concept tested is the understanding of different policy evaluation stages - specifically build-time versus run-time - and the types of queries, languages, or mechanisms associated with each stage in the context of cloud governance, security, and compliance. It assesses knowledge of how policies are applied to static configurations (templates, IaC) versus dynamic, deployed cloud resources.

No community discussion yet for this question.