CV0-002 · Question #582
A cloud administrator notices one of the servers in the public cloud environment has a non- compliant firewall policy. In reviewing the logs, the administrator notices a couple technicians made…
The correct answer is A. Implement a configuration management solution that automatically applies the firewall policy. Implementing a configuration management solution is the best way to reduce configuration drift by automatically applying and enforcing compliant firewall policies across servers.
Question
A cloud administrator notices one of the servers in the public cloud environment has a non- compliant firewall policy. In reviewing the logs, the administrator notices a couple technicians made individual changes to the firewall policy for a new project. Which of the following is the BEST solution to reduce configuration drift for the firewall policy?
Options
- AImplement a configuration management solution that automatically applies the firewall policy.
- BImplement a standard operating procedure in which cloud administrators manually review the
- CReport the activity to the project lead and the technician's supervisor.
- DChange the firewall policies on the other servers to match the changes.
How the community answered
(19 responses)- A84% (16)
- B5% (1)
- D11% (2)
Why each option
Implementing a configuration management solution is the best way to reduce configuration drift by automatically applying and enforcing compliant firewall policies across servers.
A configuration management solution automates the enforcement of desired firewall policies across all servers. This prevents individual technicians from making unauthorized or non-compliant manual changes, ensuring consistency and drastically reducing configuration drift by continuously monitoring and reapplying the defined compliant state.
Manually reviewing configurations is a reactive approach, prone to human error, and does not proactively prevent configuration drift from occurring at scale.
Reporting the activity addresses the immediate human behavior but does not implement a technical control to prevent future configuration drift automatically.
Changing other servers to match a non-compliant policy simply propagates the non-compliance and does not remediate the root cause or establish a compliant baseline.
Concept tested: Configuration management for drift prevention
Source: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/manage/configuration-management
Topics
Community Discussion
No community discussion yet for this question.