A transit authority remediates CIS baseline drift on jump hosts with Ansible playbooks. What automation approach is that?

Using configuration-management scripting such as Ansible playbooks for municipal host hardening is the automation approach when a transit authority remediates CIS baseline drift on jump hosts. Playbooks encode desired CIS settings as code, apply them repeatedly, and report drift, which is how civic teams keep privileged access hosts consistent without relying on memory or weekend heroics. Jump hosts are high-value; automated hardening reduces the window where misconfiguration invites lateral movement into transit systems. Applying infrastructure-as-code provisioning such as Ansible playbooks for municipal host hardening fails by concept: it misclassifies configuration-management enforcement as provisioning, because the playbooks re-apply the CIS baseline on existing jump hosts rather than provisioning new infrastructure. Performing immutable image construction using Ansible playbooks for municipal host hardening fails by concept: the playbooks enforce CIS settings on existing jump hosts in place rather than constructing immutable images for replacement. Executing event-driven automated remediation using Ansible playbooks for municipal host hardening fails by concept: the work is repeated configuration-management enforcement of a desired baseline, not remediation triggered by events. Exam caveat: Ansible success still depends on inventory accuracy and testing playbooks outside peak transit operations so a bad harden does not lock out operators. Operational check: run a check-mode Ansible CIS play against jump hosts, compare reported drift to the municipal baseline, then apply and re-check until the playbook reports compliant.