A security engineer is automating vulnerability remediation across 2,000 cloud instances. The engineer wants to apply patches using a declarative infrastructure-as-code approach that defines the desired end state. Which tool is MOST appropriate?

Question

Accepted Answer

B. Ansible playbooks that define the desired configuration state. Ansible uses a declarative, idempotent playbook model where the engineer defines the desired end state (e.g., "package X must be at version Y"), and Ansible converges the current state to match. This is the IaC declarative approach for patching at scale. The CAS-005 V5 objectives list Ansible and IaC patching under automation in Security Engineering.

A security engineer is automating vulnerability remediation across 2,000 cloud instances. The engineer wants to apply patches using a declarative infrastructure-as-code approach that defines the desired end state. Which tool is MOST appropriate?

Related Questions

Discussion