A security engineer at a financial institution is establishing a patch and configuration management framework for dual-homed payment processing nodes. The environment requires continuous compliance enforcement against baseline images, strict change validation before production deployment, and protection against unauthorized system modifications. Which of the following strategies should the security engineer implement to maintain secure configuration baselines and control patch deployment risks? (Select TWO.)
- Utilize automated infrastructure-as-code configuration management tools to continuously audit system state and automatically remediate configuration drift back to approved baselines.Cevap
- Staging patch updates in an isolated test environment and verifying cryptographic signature hashes prior to deploying updates into production.Cevap
- CDeploying network perimeter firewall filtering rules as a permanent substitute for applying critical operating system security patches.
- DReclassifying host-based automated audit logging controls as preventive physical security mechanisms to satisfy compliance reporting mandates.
Cevap
The security engineer should utilize automated infrastructure-as-code tools to continuously audit and remediate configuration drift, and stage patch updates in an isolated environment while verifying cryptographic signature hashes before production deployment.
Automated infrastructure-as-code tools continuously validate system settings against established security baselines and automatically remediate configuration drift. Additionally, staging patches in an isolated environment combined with verifying cryptographic signatures prevents unstable or malicious update packages from compromising production systems.
Adım Adım Çözüm
Anahtar Kavram
Continuous baseline configuration enforcement and staged patch verification