DevOps & IaC Certification Prep

1. (Terraform) You run terraform plan and observe the output shows a resource will be replaced (destroyed and recreated) rather than updated in-place. What is the MOST likely reason for this?

• A) The provider version was upgraded
• B) A change was made to an argument that is immutable after resource creation (e.g., changing an EC2 instance's AMI ID or an RDS instance's engine version)
• C) The Terraform state file was deleted
• D) The resource uses count instead of for_each

2. (Terraform) Your team is collaborating on Terraform code in a shared CI/CD pipeline. Two engineers run terraform apply simultaneously. What problem can occur and how does Terraform prevent it?

• A) Nothing — Terraform applies are idempotent so concurrent runs are safe
• B) State corruption — two concurrent applies both read the same state, compute different plans, and overwrite each other's state. Remote backends with state locking (e.g., S3 + DynamoDB, Terraform Cloud) prevent this by acquiring a lock before plan and releasing it after apply
• C) Duplicate resources will be created, but Terraform will detect and clean them up on the next apply
• D) The second apply will fail with a provider authentication error

3. (Docker) You need to build a Docker image for a Go application. The compiled binary is only 8 MB. You want the final production image to be as small as possible with no build tools. Which Dockerfile pattern achieves this?

• A) Use FROM golang:1.21 as the base image and copy the source code in
• B) Use a multi-stage build: FROM golang:1.21 AS builder to compile, then FROM scratch (or FROM alpine:3.19) and COPY --from=builder /app/binary /binary
• C) Use docker build --compress to reduce the image size automatically
• D) Use FROM ubuntu:latest and install Go via apt

4. (Docker) A container has been configured with --network host. What is the security implication?

• A) The container cannot make outbound network connections
• B) The container bypasses Docker's network namespace isolation — it shares the host's network stack directly, can bind to any host port, and can observe all host network traffic
• C) The container is isolated in its own private bridge network
• D) The container uses the host's DNS but has a separate IP address

5. (Splunk) A SOC analyst needs to find all failed SSH login attempts to Linux servers in the last 24 hours, display the top 10 source IP addresses by count, and alert if any single source IP exceeds 50 attempts. Which Splunk query finds the top source IPs?

• A) index=linux sourcetype=syslog "Failed password" | top limit=10 src_ip
• B) index=linux sourcetype=syslog "Failed password" | stats count by src_ip | sort -count | head 10
• C) index=linux "SSH" | count src_ip | limit 10
• D) Both A and B are correct

6. (eJPT / PNPT) During an internal network penetration test, you run Responder on the network and observe an NTLMv2 hash for user "jsmith@corp.local". You crack the hash and obtain the plaintext password "Winter2024!". The domain controller is at 10.10.1.1 and is running SMB on port 445. What is the MOST efficient next step to test for lateral movement?

• A) Use CrackMapExec to spray the credentials across the entire subnet: crackmapexec smb 10.10.1.0/24 -u jsmith -p 'Winter2024!'
• B) Log into the domain controller using RDP with jsmith's credentials
• C) Run Mimikatz on the domain controller to dump all hashes
• D) Submit the finding as medium severity and proceed to the next host

7. (Terraform) You want to create 5 identically configured EC2 instances with unique names (web-0 through web-4). Which Terraform configuration is CORRECT?

• A) Use count = 5 and reference count.index in the name tag: Name = "web-${count.index}"
• B) Copy-paste the resource block 5 times with unique resource names
• C) Use a for loop in the provider configuration
• D) Create a module and call it 5 times

8. (Docker / Container Security) Which of the following container configurations represents the WORST security practice?

• A) docker run --read-only --tmpfs /tmp myapp:1.0
• B) docker run --cap-drop ALL --cap-add NET_BIND_SERVICE myapp:1.0
• C) docker run --privileged myapp:1.0
• D) docker run --user 1000:1000 myapp:1.0

9. (PNPT / Active Directory) During an internal pentest, you discover the network uses LLMNR (Link-Local Multicast Name Resolution) and NBT-NS. Which attack does this enable and what does it achieve?

• A) DNS poisoning — you redirect all DNS traffic through your machine
• B) LLMNR/NBT-NS poisoning with Responder — when a machine fails to resolve a hostname via DNS, it broadcasts an LLMNR/NBT-NS query; you respond claiming to be the target host and capture the NTLMv2 authentication hash the victim's machine sends for authentication
• C) Kerberoasting — you request Kerberos service tickets for offline cracking
• D) Pass-the-Hash — you reuse captured NTLM hashes without cracking them

10. (Terraform) You need to pass a database password to a Terraform resource without hardcoding it in your configuration files. Which approach is MOST secure?

• A) Store the password in a terraform.tfvars file and commit it to Git with a .gitignore entry
• B) Hardcode it in the resource block — it is encrypted in the state file
• C) Use a secrets manager integration: retrieve the secret from AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault using a data source, and reference it in the resource without storing it in the config or state in plaintext
• D) Pass it as an environment variable: export TF_VAR_db_password="mypassword" and reference it as a variable