Question

A cloud security architect for a financial services firm is concerned that administrators are making undocumented manual changes to production virtual machines through the console, causing configuration drift away from the approved hardened baseline. The firm already uses infrastructure-as-code templates to provision resources. Which approach BEST prevents this drift and enforces that all changes flow through the approved change pipeline?

Accepted Answer

Adopt an immutable infrastructure model where instances are never modified in place but replaced by redeploying updated IaC templates, and remove interactive administrative access to running instances

Answer

Increase the frequency of vulnerability scans against production instances so drift is discovered faster after it occurs

Answer

Require administrators to document each manual console change in a ticketing system before applying it

Answer

Enable full-disk encryption on all production instances to protect the hardened baseline configuration