Operations staff make undocumented changes to servers during troubleshooting, and over time many servers no longer match the approved security baseline. Which automation approach BEST keeps servers aligned with the baseline continuously?
Select an answer to reveal the explanation.
Short Explanation
Desired state management is a thermostat for configuration: you set the target, and it keeps nudging the server back whenever someone fiddles with it. A golden image gets you a good starting point, but it can't stop the drift that happens next week. That's the trap.
Full Explanation
Desired state management, sometimes called configuration-as-code or state enforcement, defines the approved configuration declaratively and runs an agent or controller that regularly compares each server's actual state with that definition. When a setting drifts, such as a service enabled, a permission loosened, or an audit policy changed, the tool reports the deviation and can automatically return the system to the approved state. This enforces the baseline continuously rather than at audit time and makes intentional changes go through the definition, which supports change management. Quarterly manual audits detect drift long after it occurs, consume staff time, and do not correct anything by themselves. A weekly vulnerability scan focuses on missing patches and known vulnerabilities; many baseline settings, such as logging configuration or local policy, are outside its scope, and it does not remediate. Golden images ensure servers start in a compliant state, but they have no effect on changes made after deployment, which is exactly where this drift originates. Exam caveat: automatic reversion must be coordinated with change processes so that legitimate emergency fixes are captured in the definition rather than silently undone. Operational check: deliberately change a baseline setting on a test server and confirm the tool reports and reverts it within its expected cycle.