Examkin

Question

Difficulty: MediumPatch and Configuration Management

An organization manages a fleet of remote workstations that frequently drift from the established secure configuration baseline due to localized user modifications made while devices are offline. The security team requires a technical control that continuously audits system settings and automatically restores non-compliant configurations back to the approved baseline whenever devices re-establish network connectivity. Which of the following mechanisms best fulfills this requirement?

  1. Automated configuration management agents enforcing desired-state policiesAnswer
  2. B
    Host-based intrusion prevention system rules blocking file modification events
  3. C
    Periodic detective controls utilizing scheduled manual audit log reviews
  4. D
    Edge firewall access control list rules restricting inbound management traffic

Answer

Automated configuration management agents enforcing desired-state policies
Automated configuration management software utilizing desired-state enforcement continuously monitors endpoint operating systems and applications against established secure baseline templates. When a system drifts from its designated baseline standard due to local user edits or unapproved software changes, the agent automatically reapplies the baseline settings as soon as policy synchronization occurs.

Step-by-Step Solution

1
Analyze the operational requirements
The requirement calls for a system that actively detects configuration drift on remote endpoints and automatically reverts settings to match the baseline upon reconnecting.
Offline systems modified locally require persistent agent-driven policy enforcement that triggers remediation when connectivity allows.
2
Evaluate configuration management control capabilities
Automated configuration management frameworks (such as Desired State Configuration or policy enforcement agents) continuously verify endpoint settings against defined baseline standards and auto-apply corrective changes.
Desired-state configuration models directly address unauthorized baseline drift through automated restoration.

Key Concept

Configuration Baseline Enforcement and Drift Remediation
Estimated Time:1m 30s
Rate this question

Topics

Patch and Configuration Management

More questions from this topic