Examkin

Question

Difficulty: MediumPatch and Configuration Management

During a routine security audit, a security analyst discovers that several Linux web servers hosted in an Infrastructure as a Service (IaaS) environment have diverged from the enterprise's hardened configuration baseline after manual hotfixes were applied by system administrators. Which of the following implementation strategies best provides automated drift detection and continuously enforces the designated configuration baseline across the server fleet?

  1. Deploying configuration management tools utilizing declarative state files operating in enforcement modeAnswer
  2. B
    Configuring a Host-based Intrusion Prevention System (HIPS) to monitor file system integrity and log file modification alerts
  3. C
    Implementing network firewall rules to block unauthorized administrative traffic to the web application nodes
  4. D
    Submitting a service tier update to the Cloud Service Provider (CSP) to manage operating system configuration integrity

Answer

Deploying configuration management tools utilizing declarative state files operating in enforcement mode
The correct response utilizes declarative configuration management (such as Ansible, Puppet, or Chef) operating in enforcement mode. These tools continuously audit the system's current state against an authoritative configuration baseline and automatically remediate any detected drift back to the defined security state.

Step-by-Step Solution

1
Analyze the problem requirements
Identified the need to remediate manual configuration drift on IaaS Linux web servers automatically and continuously.
Manual changes lead to unapproved deviations from established security baselines.
2
Evaluate the cloud shared responsibility model and control capabilities
Eliminated relying on the CSP for OS configuration as IaaS places OS management responsibilities on the customer. Eliminated network firewalls and HIPS as they do not provide automated state remediation.
Control selection must directly address host OS configuration enforcement.
3
Select the appropriate configuration management mechanism
Chosen configuration management software executing declarative policy files in enforcement mode.
Declarative tools regularly check system state against the baseline artifact and automatically overwrite unapproved manual edits back to the approved state.

Key Concept

Configuration Baseline Drift Remediation
Rate this question

Topics

Patch and Configuration Management

More questions from this topic