Examkin

Question

Difficulty: HardCapabilities of Configuration Management Mechanisms (Puppet, Chef, Ansible)

A network security policy requires that all configuration management operations across remote branch routers strictly prevent inbound session initiation from central management servers to remote devices. Outbound HTTPS traffic on TCP port 443 initiated by target devices toward the central server is permitted. Which configuration management tool natively meets these architectural constraints while utilizing Ruby-based files to define system state?

  1. Chef, because it uses an agent-based pull architecture operating over TCP port 443 and defines configurations using Ruby DSL recipes.Answer
  2. B
    Ansible, because it uses an agentless pull architecture operating over TCP port 443 and defines configurations using Ruby playbooks.
  3. C
    Puppet, because it relies on an agentless push mechanism using TCP port 443 to send Ruby manifests to remote endpoints.
  4. D
    Ansible, because it establishes outbound SSH tunnels over TCP port 443 from remote endpoints to pull YAML manifests.

Answer

Chef natively operates using an agent-based pull architecture over TCP port 443 (HTTPS) and relies on Ruby-based recipes contained within cookbooks to define device configuration states.
Chef employs an agent installed on managed devices that initiates outbound communication to the central Chef Server over TCP port 443 (HTTPS) to pull its configuration state. Configurations in Chef are authored using a Ruby-based Domain-Specific Language (DSL) organized into recipes and cookbooks, perfectly matching both the port and architectural requirements.

Step-by-Step Solution

1
Analyze the operational direction constraint (inbound vs. outbound).
Since security policies prohibit inbound sessions initiated by the central server, the configuration management system must use a pull-based architecture where the managed node initiates outbound connections.
Chef and Puppet both natively use agent-based pull models, while Ansible primarily uses a push model (where the control node initiates SSH/NETCONF inbound to managed nodes).
2
Evaluate the required transport port and configuration definition language.
Chef client agents initiate outbound HTTPS requests to the Chef server over standard TCP port 443 and parse configuration definitions written in Ruby DSL (recipes/cookbooks). Puppet typically uses TCP port 8140 for agent-master pull communications.
Identifying both the network protocol/port and the underlying formatting language isolates Chef as the correct tool.

Key Concept

Configuration Management Tools Architecture and Capabilities (Ansible vs. Puppet vs. Chef)
Rate this question

Topics

Capabilities of Configuration Management Mechanisms (Puppet, Chef, Ansible)

More questions from this topic