Examkin

Question

Difficulty: HardPatch and Configuration Management

A security analyst is investigating configuration compliance reports across an operational technology (OT) environment managed by an automated deployment framework. Although the centralized dashboard reports full compliance with the organization's hardened baseline template, manual vulnerability audits reveal that several controllers have unapproved network services active and customized settings configured locally. Further inspection indicates that local system administrators made manual adjustments directly on the devices, leading to configuration drift that was not detected or overridden by the centralized management tool. Which of the following actions should the security analyst perform FIRST to permanently address the configuration drift and restore baseline integrity?

  1. Configure continuous automated enforcement and drift remediation within the centralized configuration management framework to automatically detect and overwrite unapproved local changes.Answer
  2. B
    Deploy host-based firewall rules across the affected controllers to block traffic routed to the newly exposed service ports.
  3. C
    Reclassify the mandatory hardening benchmark as an optional administrative guideline for operational technology endpoints.
  4. D
    Issue an emergency out-of-band operating system patch deployment to update the firmware binaries on all OT controllers.

Answer

Configure continuous automated enforcement and drift remediation within the centralized configuration management framework to automatically detect and overwrite unapproved local changes.
Configuring continuous automated enforcement and drift remediation directly addresses the root cause of configuration drift. Centralized configuration management tools must actively audit state and automatically overwrite unapproved local modifications with the approved baseline, maintaining continuous compliance across infrastructure endpoints.

Step-by-Step Solution

1
Identify the root cause of the security failure.
The issue stems from unapproved local manual adjustments creating configuration drift that centralized auditing failed to enforce.
Understanding why the deviation occurred isolates configuration management logic from patch or network filtering issues.
2
Evaluate remediation controls against configuration drift governance principles.
Automated baseline enforcement guarantees that authoritative states are consistently synchronized across endpoints.
Centralized configuration management must actively enforce compliance and revert unauthorized local modifications.
3
Select the primary preventive and corrective action.
Enabling continuous automated enforcement remediates current drift and prevents future unapproved modifications.
This establishes continuous configuration compliance without relying on manual audits or secondary network blocks.

Key Concept

Configuration Baseline Enforcement and Drift Remediation
Rate this question

Topics

Patch and Configuration Management

More questions from this topic