Test yourself

Checkov & IaC scanning

Final exam · 12 questions · answers explained as you pick

Beginner

4 questions

01IaC scanning (Checkov et al.) primarily finds…

Aruntime intrusions

Incorrect — that is detection/EDR, not static IaC scanning.

Bmisconfigurations in infrastructure code (public buckets, open SGs, no encryption) before deploy

Correct — static analysis over Terraform/k8s/Docker etc.

CCPU usage

Incorrect — no.

Dcontainer escapes

Incorrect — that is runtime, not IaC scanning.

02A clean Checkov scan means…

Athe system is secure

Incorrect — no — only that the rules that ran found nothing.

Bno runtime risk

Incorrect — scanning does not see runtime.

Cno KNOWN misconfiguration in the rules it ran — one gate among many

Correct — defense in depth still needs policy, runtime, review.

Dnothing useful

Incorrect — it is useful, just not proof of security.

03Checkov exits non-zero when checks fail so that…

Ait can act as a CI gate that fails the job

Correct — the non-zero exit blocks the pipeline on violations.

Bit runs faster

Incorrect — unrelated.

Cit encrypts results

Incorrect — no.

Dit skips files

Incorrect — no.

04Checkov covers…

Aonly Terraform

Incorrect — it covers many frameworks.

BTerraform, CloudFormation, Kubernetes, Helm, Dockerfiles, and more from one tool

Correct — consistent coverage across the IaC stack.

Conly Kubernetes

Incorrect — no.

Druntime containers

Incorrect — that is image/runtime scanning.

Intermediate

4 questions

01The best way to handle a false-positive or accepted-risk finding is…

Adisable the scanner

Incorrect — that removes all protection.

Ba global --skip-check

Incorrect — too blunt — hides the check for genuinely-violating resources too.

Can inline, scoped skip comment naming the check with a documented reason

Correct — visible in review, travels with the resource, answers “why is this safe here?”

Dignore it silently

Incorrect — undocumented risk.

02Custom Checkov policies…

Acan be YAML (simple attribute checks) or Python (full logic), and are security code to test

Correct — a buggy custom check passes what it should fail — test against fixtures.

Bmust be written in Rego

Incorrect — that is Terrascan/OPA; Checkov uses YAML/Python.

Ccannot be added

Incorrect — they can, via --external-checks-dir.

Dnever need testing

Incorrect — they very much do.

03Scanning a Terraform PLAN instead of only the source catches…

Asyntax errors

Incorrect — that is not the added value.

Bissues from values resolved at plan time (variables, module outputs) a code scan cannot see

Correct — the plan JSON has fully-resolved values.

Cruntime bugs

Incorrect — still static; no runtime.

Dnothing extra

Incorrect — it catches resolved-value risk.

04A baseline in Checkov lets you…

Adisable all checks

Incorrect — no.

Bencrypt findings

Incorrect — no.

Cgate on NEW findings while tracking existing ones for gradual remediation

Correct — adopt scanning on a legacy repo without blocking day one — then burn it down.

Dskip the plan

Incorrect — unrelated.

Advanced

4 questions

01Regarding the scanner family (Checkov, Trivy/tfsec, Terrascan, KICS), you should…

Arun all of them for max coverage

Incorrect — heavy overlap → noise, quadrupled suppressions, disabled gates.

Bpick one primary scanner and add others only for a distinct gap

Correct — consistency beats coverage-by-accumulation; Trivy also does images/secrets.

Cnever scan

Incorrect — no.

Donly scan images

Incorrect — that misses IaC misconfig.

02Secrets scanning should ideally run…

Aas a pre-commit hook (prevent) plus CI as a backstop — not CI-only

Correct — CI-only catches the secret after it is in Git history and must be rotated.

Bonly in production

Incorrect — far too late.

Cnever

Incorrect — no.

Donly once a year

Incorrect — no.

03The biggest threat to an IaC scanning program is…

Ascans running too fast

Incorrect — not a problem.

Bhaving a baseline

Incorrect — baselines help adoption when managed.

Calert fatigue — so much noise the gate is ignored or disabled

Correct — tune severity, baseline, make findings actionable; a respected gate beats a strict muted one.

Dtoo few frameworks

Incorrect — not the core risk.

04Running scanning “as a program” means, beyond the tool…

Ajust adding more checks

Incorrect — more checks without governance = more noise.

Bcentral versioned policy, a time-boxed exception process, clear ownership, and posture metrics

Correct — governance is what turns caught misconfigs into fixed ones.

Cdisabling suppressions

Incorrect — suppressions are needed — just documented.

Dscanning only once

Incorrect — no.