200-201 Question 322
Single answerAs a cybersecurity analyst, you are investigating a security incident in which unauthorized changes were made to a critical network device's configuration. Which configuration management practice would have most likely prevented this incident?
- A
Implementing role-based access control (RBAC) to restrict changes to authorized personnel
- B
Enabling port security on all network switches
- C
Using a centralized configuration management system to track and approve changes
- D
Performing regular vulnerability scans of the network devices
Show answer and explanation
Correct answer: A
Explanation
Role-based access control (RBAC) is a core practice in configuration management to ensure only authorized users can make changes to critical systems. In this scenario, unauthorized changes were made, and RBAC would have been the most effective measure to prevent such incidents by restricting access based on user roles.
- A. Correct.
Role-based access control (RBAC) limits who can make changes to configurations, ensuring that only authorized personnel can modify critical settings. This directly addresses the issue of unauthorized changes.
- B. Incorrect.
Enabling port security is a network hardening measure to prevent unauthorized devices from connecting to the network but does not address configuration management or unauthorized changes.
- C. Incorrect.
While a centralized configuration management system is essential for tracking and approving changes, it alone does not prevent unauthorized changes without access controls in place.
- D. Incorrect.
Regular vulnerability scans help identify weaknesses in the network but do not prevent unauthorized configuration changes on their own.