Integrating Configuration Orchestration DSE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security team wants to implement configuration orchestration for a new environment, but they have a strict requirement that all secrets must be rotated every 30 days and that no secret should be stored in plain text anywhere. They also want to minimize the operational overhead of managing secrets. What is the best approach?

   • AUse a dynamic secrets engine (e.g., HashiCorp Vault) that generates short-lived credentials for each orchestration run and automatically rotates them.
   • BUse a single long-lived secret for all orchestration tools and rotate it annually.
   • CEmbed secrets in the orchestration tool's configuration files and rely on file permissions.
   • DStore secrets in encrypted files and manually rotate them every 30 days.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A team uses SaltStack for configuration orchestration. They want to automatically trigger a remediation playbook when monitoring detects that a service is not running or a config file has been modified. What is the most direct integration?

   • AConfigure the monitoring system to call a SaltStack API endpoint that runs the appropriate state or orchestration routine.
   • BHave SaltStack periodically check the monitoring system's database for alerts.
   • CUse a human operator to watch the monitoring dashboard and run Salt commands manually when issues appear.
   • DSet up SaltStack to run its states every hour and ignore monitoring alerts.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization uses Chef for configuration management and wants to integrate it with their existing monitoring system (Datadog) to get real-time feedback on configuration changes. Which integration approach is most appropriate?

   • AUse Chef handlers to send run events and resource changes to Datadog via its API, and create dashboards/alerts on those events.
   • BHave Datadog agents periodically SSH into nodes and run 'chef-client' to check for changes.
   • CDisable Chef reporting and rely on Datadog's infrastructure monitoring to detect configuration changes.
   • DUse a cron job to run 'chef-client' and write the output to a log file that Datadog ingests.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A team uses Puppet to manage server configurations. They notice that some servers have drifted from the desired state due to manual changes. They want to automatically correct this drift and also receive a notification when it happens. Which approach should they use?

   • AUse a separate script to compare the current state to the Puppet catalog and apply the differences.
   • BRun Puppet only when a monitoring alert indicates drift, using a webhook to trigger 'puppet agent --test'.
   • CSet Puppet to noop mode and rely on the report to alert the team to manually apply changes.
   • DEnable Puppet's enforcement mode (default) so that each agent run corrects drift, and configure a report processor to send an event to the monitoring system when a change is made.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A large enterprise is adopting DevSecOps and wants to integrate configuration orchestration with their monitoring to provide feedback on configuration changes. They have a mix of on-premises and cloud resources, and they require that any configuration change be automatically rolled back if it causes a drop in application availability. Which approach best meets these requirements?

   • AUse a centralized orchestration platform (e.g., Ansible Tower/AWX) that integrates with monitoring tools via webhooks, and configure playbooks to run health checks after applying changes; if a health check fails, the playbook automatically rolls back the change.
   • BUse a configuration management database (CMDB) to track changes and require manual approval before any change is applied.
   • CUse separate orchestration tools for on-premises and cloud, and have monitoring alert the operations team to manually roll back changes.
   • DUse a CI/CD pipeline that deploys configuration changes and relies on canary analysis to detect issues, but does not automatically roll back.
   Reveal Solution Discussion Select an answer first