Examkin

Soru

Zorluk: OrtaPatch and Configuration Management

An enterprise application runs in a cloud environment using containerized microservices operating under an immutable infrastructure deployment model. A vulnerability scan detects a critical remote code execution vulnerability within a software library contained inside several active production containers. Which of the following patch and configuration management practices should the security team perform to resolve the vulnerability?

  1. A
    Execute automated package manager update scripts directly on live containers to install the updated library without stopping active instances.
  2. Update the base container image with the patched library, validate the build in a testing pipeline, and redeploy new container instances to replace the vulnerable ones.Cevap
  3. C
    Deploy network perimeter firewall blocks targeting the container host nodes until the cloud provider patches the hypervisor firmware.
  4. D
    Implement a mandatory security policy restricting developers from reviewing container log files until the vulnerability is addressed.

Cevap

Update the base container image with the patched library, validate the build in a testing pipeline, and redeploy new container instances to replace the vulnerable ones.
In an immutable infrastructure deployment model, running components (such as containers or virtual machine instances) are never patched or modified directly in production. When a security update or patch is required, the baseline source image (e.g., container image specification) is updated with the new library version, validated in a staging or CI/CD environment, and then used to deploy fresh instances while decommissioning the old, vulnerable ones. This eliminates configuration drift and ensures consistency across environments.

Adım Adım Çözüm

1
Identify the core deployment architecture model.
The infrastructure is designated as immutable, meaning running instances are never modified in place.
Configuration changes and updates in immutable environments must follow a build-test-deploy lifecycle via images.
2
Select the appropriate patch management workflow for containerized images.
Modify the base container image file (e.g., Dockerfile) to reference the patched dependency version.
This guarantees that all future deployments inherit the correct security posture consistently.
3
Test and swap running instances.
Pass the updated image through automated staging tests and terminate vulnerable production containers while deploying new instances.
Ensures zero configuration drift and remediates the vulnerability cleanly.

Anahtar Kavram

Immutable Infrastructure Patching
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Patch and Configuration Management

Bu konudan daha fazla soru