A quarterly audit finds that many Linux and Windows servers in the organization's cloud environment no longer match the approved hardened build, because settings were changed by hand during troubleshooting. Which approach best prevents this from recurring?

Operating system hardening through baselines, monitoring and remediation is a continuous cycle. A baseline, often derived from CIS Benchmarks or vendor security guides and adapted to the organization's needs, defines the required settings for each OS. Configuration monitoring or compliance tooling compares every server against that baseline continuously or on a short schedule, and deviations are either remediated automatically, rebuilt from a hardened image, or routed through change control as approved exceptions. Rerunning a hardening script once a year leaves servers out of compliance for most of the year and treats the audit, rather than security, as the goal. Granting broader administrator rights increases the number of uncontrolled changes and contradicts least privilege; the problem is unmanaged change, not slow change. In IaaS the customer is responsible for the guest operating system under the shared responsibility model; the provider hardens its hypervisor and physical hosts, but guest configuration remains the customer's job. Exam caveat: immutable infrastructure, rebuilding rather than patching or editing servers in place, is a strong way to eliminate drift, but it still depends on a defined baseline in the image. Operational check: confirm that every server is enrolled in compliance scanning against the current baseline, that drift alerts reach the operations queue, and that manual changes without a change record are flagged.