Firewall and server configurations for a city DMZ keep drifting from the approved build. What configuration-management approach best reduces that drift?
Select an answer to reveal the explanation.
Short Explanation
Drift is what happens when every admin freestyles the firewall. Lock a baseline, provision from it, and automate the enforcement so the DMZ matches the approved build. Undocumented daily surprises are the opposite of configuration management.
Full Explanation
Configuration management keeps municipal DMZ and other exposed infrastructure aligned to approved, documented baselines rather than individual admin preference. Approved golden images or infrastructure-as-code templates, controlled provisioning through change processes, and automation that detects and remediates drift enforce consistency for hardening settings, logging agents, TLS configurations, and allowed services. Consistency shrinks the attack surface, simplifies patching and incident response, and provides auditors evidence that production matches the intended secure build. Documentation and version control enable rollback when a change introduces regressions.
Allowing each admin to invent unique golden images without documentation guarantees drift, tribal knowledge, and unreviewable snowflake servers. Disabling version control so rollbacks remain impossible turns every bad change into a prolonged outage. Applying emergency undocumented changes daily as the primary change path normalizes bypass of review and makes root-cause analysis guesswork. Exam caveat: emergency changes may be allowed under policy but still require documentation and post-implementation review—they are not a substitute for baselines. Operationally, store baselines in a controlled repository, provision DMZ hosts only from approved pipelines, and run configuration compliance scans with tickets for deviations.