Infrastructure as Code (IaC) Security ECDE Practice Questions (Page 11)

Questions 51–51

1. 51expert · hard

   A security architect is designing a deployment strategy for a high-security application. The team currently uses Ansible to configure EC2 instances in-place. The architect wants to move to immutable infrastructure to reduce the risk of configuration drift and persistent compromise. However, the application has a stateful component that stores data on the local instance disk. Which approach should the architect recommend?

   • AUse a database on the same instance and snapshot the entire instance before each deployment.
   • BKeep the stateful component on a separate persistent volume and launch new instances from a golden image, attaching the volume to the new instance.
   • CRun the stateful component on a separate EC2 instance that is never replaced, and only replace the stateless instances.
   • DContinue using Ansible to update the instance in-place, but add a security hardening playbook.
   Reveal Solution Discussion Select an answer first