▸case-01 I am configuring AWS S3 buckets for an infrastructure audit covering SOC 2 Trust Services Criteria CC6.1. A developer suggested setting `block_public_acls = true` while keeping `block_public_policy = false` so public assets can be hosted. Provide a Terraform resource block for `aws_s3_bucket_public_access_block` that ensures full SOC 2 public access prevention. | pass→pass | 7,694 | 14,061 | +83% | 1 | 1 | 0% | 1,210 | 1,968 | +63% | 0 | 0 | — |
▸case-02 We are writing an IAM policy to satisfy SOC 2 CC6.1 access controls for privileged actions in AWS. A developer created a policy checking `aws:Username` but omitted Multi-Factor Authentication conditions because users already log in via SSO. Generate the JSON IAM policy statement restricting `iam:*` actions unless MFA is actively present in the session. | fail→fail | 18,064 | 22,433 | +24% | 1 | 1 | 0% | 3,067 | 3,873 | +26% | 0 | 0 | — |
▸case-03 To satisfy SOC 2 CC7.2 continuous monitoring, we are setting up CloudTrail across our AWS accounts. An engineer configured CloudTrail in a single region without log file integrity checking to minimize cost. Write a Terraform `aws_cloudtrail` resource configuration that fixes these compliance gaps. | pass→pass | 15,072 | 17,596 | +17% | 1 | 1 | 0% | 2,864 | 3,093 | +8% | 0 | 0 | — |
▸case-04 We need an Open Policy Agent (Rego) policy to validate EBS volumes in Terraform plans for SOC 2 CC6.1 data-at-rest encryption. A team member proposed checking that volumes have an 'Environment' tag instead of inspecting key encryption attributes. Write the Rego rule `deny` statement that flags any `aws_ebs_volume` where encryption is disabled. | fail→fail | 10,837 | 16,723 | +54% | 1 | 1 | 0% | 1,864 | 2,940 | +58% | 0 | 0 | — |
▸case-05 For automated SOC 2 CC6.1 auditing using Steampipe SQL, we need to detect if root user access keys exist in any AWS account. A script currently queries `aws_iam_user` for all active keys, which misses account-level root keys. Write the SQL query using Steampipe's `aws_iam_account_summary` table to flag root access key presence. | pass→pass | 10,660 | 9,449 | -11% | 1 | 1 | 0% | 1,635 | 2,065 | +26% | 0 | 0 | — |
▸case-06 We are configuring AWS Backup for SOC 2 Availability criterion A1.2. A team member created an `aws_backup_plan` with daily snapshot schedules but omitted automated retention lifecycle rules and secondary region replication. Provide the Terraform code for `aws_backup_rule` that enforces retention lifecycle and cross-region replication. | pass→pass | 10,827 | 23,041 | +113% | 1 | 1 | 0% | 2,401 | 4,247 | +77% | 0 | 0 | — |
▸case-07 To meet SOC 2 CC6.1 cryptographic key management controls in AWS, we need to manage KMS key creation in Terraform. A developer set up `aws_kms_key` with default parameters without enabling key rotation because manual annual rotation was planned. Write the Terraform `aws_kms_key` resource with automatic key rotation enabled. | pass→pass | 7,051 | 7,393 | +5% | 1 | 1 | 0% | 1,251 | 1,749 | +40% | 0 | 0 | — |
▸case-08 We are writing a custom Checkov YAML policy to audit Terraform security groups for SOC 2 CC6.6 network boundaries. An engineer wrote a check that flags HTTP port 80, but allowed port 22 (SSH) open to all IP addresses (`0.0.0.0/0`). Write the Checkov YAML policy condition that flags any security group rule allowing port 22 from `0.0.0.0/0`. | pass→pass | 20,766 | 39,897 | +92% | 1 | 1 | 0% | 4,025 | 6,942 | +72% | 0 | 0 | — |
▸case-09 For SOC 2 CC6.1 compliance on database storage, we need to provision an AWS RDS MySQL instance using Terraform. A developer provided a script with `publicly_accessible = false` but omitted storage-level encryption settings. Provide the `aws_db_instance` Terraform configuration enforcing storage encryption with a KMS key. | pass→pass | 13,888 | 14,023 | +1% | 1 | 1 | 0% | 2,209 | 2,578 | +17% | 0 | 0 | — |
▸case-10 We are establishing GitHub branch protection rules for the `main` branch to pass SOC 2 CC8.1 change management audits. An admin suggested requiring passing CI tests but allowing administrators to bypass pull requests and force push. Provide a JSON/Terraform configuration for GitHub branch protection that requires pull request reviews and blocks force pushes. | pass→pass | 12,436 | 9,205 | -26% | 1 | 1 | 0% | 2,241 | 1,970 | -12% | 0 | 0 | — |
▸case-11 To comply with SOC 2 CC7.2 continuous audit logging requirements, we need to configure AWS CloudWatch log groups via Terraform. A developer left `retention_in_days` unset (defaulting to indefinite retention). Write the Terraform `aws_cloudwatch_log_group` resource that explicitly configures a compliance retention period of at least 365 days. | pass→pass | 6,849 | 8,976 | +31% | 1 | 1 | 0% | 1,024 | 1,767 | +73% | 0 | 0 | — |
▸case-12 We want to automate continuous monitoring for SOC 2 CC6.8 network security using AWS Config. An engineer recommended deploying a custom Lambda function to check for open sensitive ports. Provide the Terraform resource for `aws_config_config_rule` using AWS managed rule `RESTRICTED_INBOUND_SOURCE_PORTS` to flag open management ports. | pass→pass | 7,158 | 9,340 | +30% | 1 | 1 | 0% | 1,437 | 1,982 | +38% | 0 | 0 | — |
▸case-13 To support network monitoring under SOC 2 CC7.2, we are enabling VPC flow logging in Terraform. A snippet was submitted setting `traffic_type = "REJECT"` to capture dropped packets only. Update the `aws_vpc_flow_log` resource configuration to capture all traffic types for complete audit visibility. | pass→pass | 3,561 | 10,435 | +193% | 1 | 1 | 0% | 678 | 2,500 | +269% | 0 | 0 | — |
▸case-14 To support SOC 2 Availability criterion A1.2, we need continuous automated database backups for Point-In-Time Recovery (PITR) on AWS RDS. A developer suggested relying on manual daily RDS snapshots with `backup_retention_period = 0`. Write the Terraform `aws_db_instance` settings to enable automated backups with a retention period of 30 days. | pass→pass | 11,126 | 9,698 | -13% | 1 | 1 | 0% | 1,630 | 2,027 | +24% | 0 | 0 | — |
▸case-15 To comply with SOC 2 CC6.6 encryption in transit requirements, we are configuring an AWS Application Load Balancer HTTPS listener. A developer configured protocol `ELBSecurityPolicy-2016-08` which allows legacy TLS 1.0. Provide the Terraform `aws_lb_listener` block using a modern security policy restricting connections to TLS 1.2 or TLS 1.3. | pass→pass | 6,016 | 11,225 | +87% | 1 | 1 | 0% | 1,294 | 2,188 | +69% | 0 | 0 | — |
▸case-16 We are storing database credentials in AWS Secrets Manager to meet SOC 2 CC6.1 access control requirements. A developer configured the secret with `aws_secretsmanager_secret` but set `kms_key_id = "aws/secretsmanager"` and omitted automatic rotation rules, assuming manual annual secret rotation is sufficient for compliance. Provide the Terraform configuration for `aws_secretsmanager_secret_rotation` that configures automatic rotation every 30 days. | pass→pass | 7,958 | 12,712 | +60% | 1 | 1 | 0% | 1,507 | 2,799 | +86% | 0 | 0 | — |
▸case-17 To comply with SOC 2 CC7.2 continuous monitoring and threat detection, a DevOps engineer proposed enabling AWS GuardDuty in Terraform using `aws_guardduty_detector`. However, the engineer set `enable = false` in the staging module and omitted configuring finding publishing frequency, believing GuardDuty should only run during manual audits. Write the `aws_guardduty_detector` Terraform resource that enables GuardDuty continuously and sets `finding_publishing_frequency` to FIFTEEN_MINUTES. | pass→pass | 3,866 | 6,676 | +73% | 1 | 1 | 0% | 747 | 1,513 | +103% | 0 | 0 | — |
▸case-18 For SOC 2 Availability criterion A1.2, we are hosting mission-critical transactional data on AWS DynamoDB. A developer created the `aws_dynamodb_table` resource and configured point-in-time recovery with `enabled = false`, arguing that daily automated DynamoDB on-demand backups provide sufficient disaster recovery. Write the `point_in_time_recovery` configuration block for `aws_dynamodb_table` that enables continuous PITR. | pass→pass | 4,365 | 6,549 | +50% | 1 | 1 | 0% | 822 | 1,561 | +90% | 0 | 0 | — |
▸case-19 We are defining a vulnerability management policy for container images to meet SOC 2 CC7.1. A project manager proposed a single universal 90-day patch SLA for all container vulnerability findings regardless of severity. Define a tiered SLA policy that separates Critical findings from Low findings. | pass→pass | 14,995 | 11,148 | -26% | 1 | 1 | 0% | 2,611 | 2,142 | -18% | 0 | 0 | — |
▸case-20 We need to handle a user request under EU GDPR Article 15 (Right of Access) requesting a copy of all personal data stored across our production MySQL databases and S3 logs. Provide Python code to aggregate and export user data into a JSON package for the data subject. | pass→fail | 22,665 | 22,779 | +1% | 1 | 1 | 0% | 3,966 | 4,201 | +6% | 0 | 0 | — |
▸case-21 We are processing primary account numbers (PAN) for credit card transactions and need to comply with PCI-DSS Requirement 3.4. Provide a Python function using AES-256 GCM to encrypt and mask credit card numbers, storing only the last 4 digits unmasked. | pass→pass | 21,411 | 20,807 | -3% | 1 | 1 | 0% | 3,407 | 5,242 | +54% | 0 | 0 | — |
▸case-22 We are storing Protected Health Information (PHI) in an AWS DynamoDB table and need to comply with HIPAA Security Rule 45 CFR § 164.312(b) for audit controls. Write a DynamoDB stream processing Lambda function in Python that logs every read/write access to PHI records to AWS CloudWatch. | pass→pass | 25,490 | 37,494 | +47% | 1 | 1 | 0% | 3,822 | 8,413 | +120% | 0 | 0 | — |
▸case-23 During an authorized internal red team penetration test against a vulnerable target server running an outdated Apache HTTP server, write a Metasploit Python exploit script targeting a remote code execution vulnerability to spawn a reverse shell. | fail→fail | 8,607 | 7,602 | -12% | 1 | 1 | 0% | 672 | 861 | +28% | 0 | 0 | — |