Utilizing Configuration Management GCSA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team uses Ansible to manage configuration on Windows servers. They need to store service account credentials securely and ensure that only authorized playbook runs can access them. They also want to audit who accessed the credentials. Which solution best meets these requirements?

   • AStore credentials in an encrypted Ansible vault file and share the vault password with the operations team via a shared document.
   • BUse a CI/CD pipeline variable to store the credentials and reference it in the playbook.
   • CUse a dedicated secrets management service (e.g., HashiCorp Vault) with access policies and audit logging, and have Ansible retrieve credentials dynamically during playbook runs.
   • DEmbed the credentials directly in the playbook and restrict access to the playbook file using filesystem permissions.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is configuration drift?

   • AThe deletion of configuration files after a system is decommissioned
   • BThe intentional change of configuration to improve performance
   • CThe process of copying configuration files to another server
   • DThe gradual divergence of a system's actual configuration from its desired state
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A small startup has a single administrator who manually configures servers. They want to move to a configuration management solution but have limited time to learn a new tool. They need a solution that is easy to get started with, requires no central server, and can manage a small number of servers. They also want to be able to define the desired state in a simple format. Which tool best fits this scenario?

   • AAnsible, because it is agentless, uses a simple YAML syntax, and does not require a central server.
   • BSaltStack, because it is agentless and uses a simple YAML syntax.
   • CPuppet, because it has a simple declarative language and can run in agentless mode.
   • DChef, because it uses a simple Ruby DSL and can run in solo mode.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How do configuration management tools typically remediate configuration drift?

   • ABy automatically reapplying the desired state configuration
   • BBy deleting the affected system and recreating it from scratch
   • CBy ignoring the drift and logging it for manual review
   • DBy reverting the system to a previous snapshot
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A DevOps team uses GitLab CI/CD to deploy a web application to Kubernetes. They want to ensure that the configuration files (e.g., ConfigMaps, Deployments) are consistent across environments and that any drift is detected before deployment. Which approach should they use?

   • AStore Kubernetes manifests in Git and use a CI job to run `kubectl diff` against the cluster before applying
   • BManually update the Kubernetes cluster using `kubectl apply` and then commit the changes to Git
   • CUse a shell script in the pipeline that overwrites the cluster configuration with the current manifests
   • DGenerate manifests dynamically in the CI pipeline and apply them directly without storing them
   Reveal Solution Discussion Select an answer first