Examkin

Question

Difficulty: MediumPatch and Configuration Management

An enterprise security analyst discovers that routine software vendor patches regularly overwrite customized security hardening settings on production Linux servers, resetting critical system configurations to insecure defaults. Which of the following patch and configuration management solutions best prevents configuration drift while ensuring ongoing security baseline compliance after patch deployment?

  1. Deploying an automated configuration management tool with scheduled enforcement playbooksAnswer
  2. B
    Installing a network intrusion prevention system (NIPS) to detect unauthorized configuration changes in real time
  3. C
    Scheduling post-patch manual vulnerability assessments to review system configurations quarterly
  4. D
    Configuring file system access permissions to deny read-write access to the root service account

Answer

Deploying an automated configuration management tool with scheduled enforcement playbooks
Automated configuration management platforms utilize infrastructure code or playbooks to continuously audit system configurations and automatically re-enforce security baselines whenever a patch or administrator alters setting parameters.

Step-by-Step Solution

1
Analyze the technical problem
Vendor software patches overwrite local system hardening settings, creating security non-compliance and configuration drift.
Security hardening baselines must be maintained continuously without interrupting legitimate software updates.
2
Evaluate remediation strategies
Declarative automated configuration management continuously validates host configurations against defined security baselines.
Automated enforcement playbooks ensure system settings automatically revert to the baseline immediately following patch installations.

Key Concept

Configuration Baseline Enforcement and Drift Remediation
Estimated Time:1m 15s
Rate this question

Topics

Patch and Configuration Management

More questions from this topic