Examkin

Question

Difficulty: MediumPatch and Configuration Management

A security analyst reviewing automated audit logs discovers that several cloud-hosted web servers have diverged from the organization's hardened baseline. Investigation reveals that system administrators manually modified SSL/TLS configuration files to troubleshoot a legacy integration, inadvertently re-enabling weak cipher suites that violate security policy. The central Infrastructure-as-Code (IaC) repository still contains the approved, secure configuration state. Which of the following is the BEST initial action to remediate the vulnerability and prevent future configuration drift?

  1. Execute the automated configuration management orchestration playbook to enforce the repository's declarative baseline state across all servers.Answer
  2. B
    Deploy a web application firewall rule to inspect incoming TLS handshakes and block clients that attempt to negotiate weak cipher suites.
  3. C
    Re-apply the latest operating system security patches to overwrite legacy cryptographic libraries on the affected web servers.
  4. D
    Reclassify the manual server configuration adjustment as a temporary compensating control within the enterprise risk register.

Answer

Execute the automated configuration management orchestration playbook to enforce the repository's declarative baseline state across all servers.
Automated configuration management tools continuously evaluate server state against a centralized Infrastructure-as-Code repository. When configuration drift occurs due to manual modification, executing the deployment playbook ensures that the approved baseline is redeployed, removing weak ciphers and preventing recurring discrepancies.

Step-by-Step Solution

1
Identify the root cause of the non-compliance incident.
The non-compliance stems from configuration drift caused by manual intervention on the web servers.
Understanding whether a flaw is software-based or configuration-based determines the correct remediation path.
2
Evaluate automated baseline enforcement mechanisms.
Automated configuration management tools pull approved templates from the IaC repository and overwrite unapproved drift.
Automated enforcement restores baseline compliance rapidly without risk of human error or missed settings.
3
Select the primary operational control that addresses both immediate remediation and long-term compliance.
Executing the configuration management playbook enforces consistency and eliminates drift across the cluster.
Direct baseline enforcement fixes the host system while establishing automated alignment with security governance.

Key Concept

Configuration Drift and Automated Baseline Enforcement
Estimated Time:1m 30s
Rate this question

Topics

Patch and Configuration Management

More questions from this topic