A team uses Puppet to manage configuration and has a compliance requirement that all servers must have a specific security patch installed. They want to automatically ensure this, but they also need to avoid disrupting critical services that cannot be restarted during business hours. What is the best strategy?

Use Puppet to enforce the patch installation, but schedule the Puppet run during a maintenance window when restarts are allowed.

Exclude critical servers from Puppet management to avoid disruption.

Use Puppet to only report on missing patches and have an engineer install them manually.

Use Puppet to install the patch immediately on all servers, regardless of the time.

An operations team uses Chef to manage server configurations. They notice that some servers have drifted from the desired state because of manual changes. They want to automatically correct this and also get a notification when drift is detected. What should they configure?

Use Chef's 'audit' mode to generate a report of drift and send it to the team for manual correction.

Set up Chef to run in 'enforce' mode on a schedule and integrate with a monitoring tool to send alerts on any changes it makes.

Disable Chef on servers that are known to be stable.

Increase the Chef client run interval to once a week to reduce the chance of drift.

A DevOps team uses Puppet for configuration management and wants to integrate it with their existing monitoring stack (Prometheus and Grafana) to visualize configuration drift across their fleet. What is the most effective way to achieve this?

Have Puppet send email alerts on every run, and rely on email to track drift.

Use Puppet's report processor to send run reports to a metrics exporter that feeds Prometheus, then create Grafana dashboards.

Use Prometheus to directly query Puppet's internal database for drift data.

Manually export Puppet reports to CSV and upload them to Grafana.

A platform team uses Ansible to provision and configure application servers. They want to automatically detect when an ad-hoc change is made directly on a server (e.g., an engineer manually edits a config file) and then restore the intended state. Which approach best achieves this?

Schedule a periodic Ansible playbook run that enforces the desired state and reports any changes to the monitoring dashboard.

Use a file integrity monitoring tool to alert on changes, then have an engineer manually revert the file.

Run an Ansible playbook once during initial provisioning and rely on it to prevent future changes.

Disable SSH access to all servers so no one can make manual changes.

How can compliance checks be integrated into configuration orchestration?

By disabling orchestration for systems that are not compliant

By running compliance validation as part of the orchestration process and reporting results

By using a separate compliance tool that is not connected to orchestration

By manually reviewing configurations after deployment

EC-CouncilDevSecOps Essentials

Domain 6Objective 2

Integrating Configuration Orchestration DSE Practice Questions (Page 7)

Part of the DevSecOps Monitoring and Feedback domain, which makes up ~15% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

5concepts

Questions 31–35

31expert · hard
A team uses Puppet to manage configuration and has a compliance requirement that all servers must have a specific security patch installed. They want to automatically ensure this, but they also need to avoid disrupting critical services that cannot be restarted during business hours. What is the best strategy?
Select an answer first
32application · medium
An operations team uses Chef to manage server configurations. They notice that some servers have drifted from the desired state because of manual changes. They want to automatically correct this and also get a notification when drift is detected. What should they configure?
Select an answer first
33application · medium
A DevOps team uses Puppet for configuration management and wants to integrate it with their existing monitoring stack (Prometheus and Grafana) to visualize configuration drift across their fleet. What is the most effective way to achieve this?
Select an answer first
34application · medium
A platform team uses Ansible to provision and configure application servers. They want to automatically detect when an ad-hoc change is made directly on a server (e.g., an engineer manually edits a config file) and then restore the intended state. Which approach best achieves this?
Select an answer first
35foundation · easy
How can compliance checks be integrated into configuration orchestration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.