Examkin

Question

Difficulty: MediumMitigation Strategies and Enterprise Hardening Practices

During a security posture review of a enterprise cloud infrastructure, an audit reveals that newly provisioned virtual machine instances frequently drift from established secure configuration baselines over time due to manual administrator modifications and unapproved emergency changes. Which enterprise hardening practice provides the MOST effective mechanism to continuously prevent and remediate host baseline configuration drift across all deployed instances?

  1. A
    Deploying stateful network firewalls and perimeter intrusion prevention systems at the cloud tenant ingress boundary
  2. Implementing Infrastructure as Code with automated configuration management tooling to enforce continuous baseline complianceAnswer
  3. C
    Deploying deception decoys and high-interaction honeypots within host management subnets to capture unauthorized modifications
  4. D
    Reclassifying host baseline configuration guides from technical preventive controls to operational deterrent controls

Answer

Implementing Infrastructure as Code with automated configuration management tooling to enforce continuous baseline compliance is the most effective mitigation strategy.
The selection recommending Infrastructure as Code paired with automated configuration management is correct because declarative configuration tools continuously monitor system state against standardized security baselines and automatically revert unauthorized changes, effectively neutralizing configuration drift.

Step-by-Step Solution

1
Analyze the core security issue presented in the scenario
The issue is configuration drift on host instances resulting from manual modifications and unauthorized changes over time.
Enterprise hardening requires maintaining a consistent, secure baseline throughout the system lifecycle.
2
Evaluate technical mitigation controls designed specifically for host configuration enforcement
Automated configuration management frameworks continuously assess system state against defined baselines (IaC templates) and automatically remediate non-compliant settings.
Automated enforcement eliminates reliance on manual audits and prevents persistent configuration drift.
3
Distinguish host-level configuration enforcement from network-level perimeter or deception controls
Network firewalls and honeypots do not inspect internal OS settings or remediate localized host configuration drift.
Host security controls must directly interact with operating system parameters and configuration files.

Key Concept

Configuration Drift Remediation and Continuous Enforcement via Automated Configuration Management
Rate this question

Topics

Mitigation Strategies and Enterprise Hardening Practices

More questions from this topic