Examkin

Question

Difficulty: HardPatch and Configuration Management

During a routine vulnerability audit, a security analyst discovers that multiple cloud virtual machines provisioned via Infrastructure as Code (IaC) templates are running outdated OS software packages vulnerable to remote code execution. Manually logging into each running instance to apply software patches resolves the vulnerability temporarily, but subsequent automated orchestration runs overwrite the manual patches, reverting systems to the vulnerable state. Which of the following operational procedures should the analyst implement to permanently remediate the vulnerability without introducing configuration drift?

  1. Update the baseline golden image and IaC repository templates with the patched package versions, then redeploy the virtual machine instances through the CI/CD pipeline.Answer
  2. B
    Deploy network-level intrusion prevention system (IPS) rules to block traffic targeting the vulnerable package while leaving running host configurations untouched.
  3. C
    Disable automated configuration state reconciliation on the orchestration server for the affected instances after manually applying the patch.
  4. D
    Reclassify the vulnerability severity level in the centralized SIEM log management platform to exclude automated patch alerts.

Answer

Update the baseline golden image and Infrastructure as Code (IaC) repository templates, followed by redeploying the instances using the automated CI/CD pipeline.
In automated and Infrastructure as Code (IaC) environments, system configurations are driven by centralized baselines and golden images. Updating the underlying IaC code and base images ensures that patches are built into the source of truth, allowing automated CI/CD pipelines to deploy compliant, non-drifting instances.

Step-by-Step Solution

1
Identify the root cause of patch reversal
Recognize that automated configuration management and IaC templates enforce defined baselines, overwriting manual system changes.
Manual changes cause configuration drift when central baselines are not updated.
2
Update central configuration assets
Incorporate the updated software packages into the base golden image and IaC repository templates.
Ensures that the source of truth reflects the required patch level.
3
Redeploy affected infrastructure
Trigger automated pipeline deployment to replace vulnerable instances with updated baseline builds.
Permanently remediates the vulnerability while maintaining centralized configuration state integrity.

Key Concept

Configuration Drift and Immutable Infrastructure Patch Management
Estimated Time:2m 0s
Rate this question

Topics

Patch and Configuration Management

More questions from this topic