An emergency-management agency rejects click-ops changes to IR buckets in favor of reviewed IaC pull requests. What change practice are they enforcing?
Select an answer to reveal the explanation.
Short Explanation
You'll want a reviewed IaC PR that actually replaces manual changes for your IR bucket policy, not PRs with local state tracking, after manual cloud changes, or alongside retained manual changes. When you've got the bucket itself in reviewed code, you get an audit trail before the policy goes live.
Full Explanation
Preferring reviewed Infrastructure as Code pull requests over manual cloud changes for civic IR assets such as buckets is the change practice emergency-management agencies should enforce. IR buckets often hold evidence and playbook artifacts; reviewed PRs create an audit trail, peer challenge, and reproducible policy definitions that console click-ops cannot match. Even under urgency, the preferred steady-state path is code-reviewed IaC so bucket policies do not silently widen.
Preferring reviewed Infrastructure as Code pull requests with local state tracking for civic IR assets such as buckets keeps reviewed code but breaks the shared source of truth: local state cannot be locked, shared, or audited reliably, so concurrent applies can corrupt or diverge from what reviewers approved. Preferring reviewed Infrastructure as Code pull requests after manual cloud changes for civic IR assets such as buckets puts review after the risk has already gone live: the manual change can widen the bucket policy without peer challenge or CI checks, and the later PR only documents drift instead of preventing it. Preferring reviewed Infrastructure as Code pull requests alongside retained manual changes for civic IR assets such as buckets leaves click-ops in place: retained manual paths let the live bucket policy diverge from reviewed code, so there is no single enforced source of truth or reliable audit trail.
Exam caveat: the exam is testing whether reviewed IaC replaces manual cloud changes as the enforced path — not whether a PR merely exists with local state or after or alongside manual changes, so do not pick a PR that still permits unreviewed live edits.
Operational check: attempt a bucket policy change via PR and confirm reviewers, CI, and apply logs capture it; confirm the diff covers the bucket policy with remote shared state with locking, not with local state tracking and not after or alongside retained manual changes.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.