Examkin

Question

Difficulty: Very hardPatch and Configuration Management

An enterprise organization operating an immutable containerized infrastructure discovers a critical zero-day vulnerability in its base operating system image across multiple microservices. What is the correct chronological sequence of steps the security operations team must perform to remediate this vulnerability while maintaining configuration integrity and change control compliance?

  1. 1Identify affected container repositories and service dependencies using Software Bill of Materials (SBOM) telemetry.
  2. 2Update the base image version directive in source code infrastructure-as-code manifests and commit changes to a development branch.
  3. 3Execute automated integration, functional, and security regression tests within an isolated staging environment.
  4. 4Submit a formal change request with empirical staging test metrics and a rollback plan for Change Advisory Board (CAB) authorization.
  5. 5Initiate a canary deployment to production clusters and continuously audit configuration baselines for unauthorized drift.

Answer

The correct sequence begins with identifying affected container repositories using SBOM telemetry, updating base image directives in source manifests, executing automated regression testing in a staging environment, obtaining formal Change Advisory Board authorization backed by test metrics and rollback plans, and concluding with a canary deployment to production accompanied by continuous configuration baseline auditing.
The sequence correctly reflects standard enterprise patch management for immutable environments: initial asset scoping using Software Bill of Materials (SBOM) data occurs first; updates are committed to Infrastructure-as-Code manifests; pre-deployment automated regression testing in staging provides the mandatory verification evidence needed for Change Advisory Board (CAB) approval; and production deployment proceeds via canary release paired with ongoing configuration drift auditing.

Step-by-Step Solution

1
Inventory and scope analysis
Identification of all vulnerable container image dependencies across microservices
Scoping via SBOM data ensures accurate mapping of all affected artifacts before initiating code alterations.
2
Infrastructure-as-Code (IaC) configuration update
Updated base image version committed to source repository development branch
Immutable infrastructure dictates that patches are declared in source code manifests rather than applied to active workloads.
3
Pre-deployment validation in staging
Empirical confirmation of patch stability and security control effectiveness
Staging verification prevents broken builds or incompatible patches from impacting live enterprise operations.
4
Change control governance
Formal approval granted by the Change Advisory Board (CAB)
Enterprise governance requires empirical test documentation and risk mitigation plans prior to production release.
5
Production rollout and baseline auditing
Controlled canary rollout and ongoing detection of configuration drift
Gradual rollout mitigates deployment blast radius, while ongoing auditing ensures production containers match the approved baseline.

Key Concept

Enterprise Patch and Configuration Management Lifecycle for Immutable Infrastructure
Rate this question

Topics

Patch and Configuration Management

More questions from this topic