Infrastructure as Code Security Questions

Security practices and threat mitigation specific to infrastructure defined as code. Topics include scanning templates and code for misconfigurations, policy as code for automated compliance gates, secrets and credential management patterns, secure handling of remote state backends, access control and least privilege for infrastructure tooling, and GitOps security considerations. Candidates should understand tools and techniques for static analysis, drift detection, supply chain and dependency risks, automated enforcement of security policies, and remediation workflows for insecure infrastructure definitions.