Examkin

Question

Difficulty: MediumPatch and Configuration Management

An organization's security operations center observes that newly provisioned virtual servers in a public cloud environment consistently lack mandatory security monitoring agents and feature non-standard firewall configurations. An investigation reveals that system administrators are manually launching instances from legacy local image templates instead of using approved central images. Which of the following operational practices should the organization implement to MOST effectively prevent future configuration drift?

  1. A
    Applying host-based firewall rules to restrict remote management access to the virtual servers
  2. Enforcing automated deployment pipelines that instantiate virtual machines exclusively from version-controlled Infrastructure as Code (IaC) baseline templatesAnswer
  3. C
    Scheduling monthly manual compliance reviews to identify and remediate baseline deviations across virtual instances
  4. D
    Isolating the cloud management console using dedicated virtual private network (VPN) tunnels

Answer

Enforcing automated deployment pipelines that instantiate virtual machines exclusively from version-controlled Infrastructure as Code (IaC) baseline templates
Automating virtual machine provisioning through version-controlled Infrastructure as Code (IaC) templates ensures that all new cloud instances adhere to predefined, tested security baselines and automatically include required monitoring agents upon deployment.

Step-by-Step Solution

1
Analyze the root cause of the configuration drift identified in the scenario.
The root cause is manual provisioning from unapproved, legacy templates.
Manual processes allow administrators to bypass baseline configurations and deploy non-compliant virtual machines.
2
Evaluate potential solutions against the goal of preventing future drift.
Automated provisioning using Infrastructure as Code (IaC) eliminates manual template selection and enforces baseline compliance across all builds.
IaC defines target state configurations as code, ensuring consistent, repeatable deployments containing all required agents and security settings.

Key Concept

Patch and Configuration Management
Rate this question

Topics

Patch and Configuration Management

More questions from this topic