SY0-701 Question 32
Single answerVersion controlA security team maintains infrastructure-as-code templates and firewall configuration files in a shared repository. During a recent incident review, the team discovered an unauthorized rule change that temporarily exposed an internal management subnet to the internet. Management now wants a control that will let the team identify exactly who changed a configuration, compare the current file to prior versions, and quickly restore the last approved configuration if an unauthorized change occurs. Which solution best meets these requirements?
- A
Store the configuration files in a version control system with commit history, access controls, and rollback capability
- B
Archive a weekly copy of the configuration files to offline storage and manually compare them when issues occur
- C
Encrypt the configuration files at rest on the administrator workstation and protect them with a strong password
- D
Place the configuration files on a network share with read-only permissions for most users and enable full-disk encryption on the file server
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a version control system because the scenario specifically requires three capabilities: identifying who changed a configuration, comparing current files to prior versions, and restoring a previous approved state. Those are core functions of version control and align with secure change management practices. In real environments, tools such as Git-based repositories are commonly used to maintain auditability of code and configuration changes, especially for infrastructure-as-code, scripts, and policy files. This also supports Security+ objectives around integrity, change management, and non-repudiation through recorded commit history and controlled workflows. Best practices from secure software development and configuration management guidance, including principles reflected in NIST secure development and configuration control recommendations, emphasize maintaining version history, reviewing changes, and preserving the ability to revert unauthorized or unstable modifications.
- A. Correct.
Correct. A version control system is designed to track changes over time, record who made each change, preserve previous versions, and support comparison and rollback. In a security context, this improves accountability, change management, and recovery from unauthorized or erroneous modifications. With proper repository permissions and branch protection, the organization can also reduce the chance of unapproved changes being introduced.
- B. Incorrect.
Incorrect. Offline archives can help with recovery, but they do not provide the same level of granular change tracking, author attribution, or efficient diff and rollback capabilities as a version control system. Weekly copies also leave significant gaps between snapshots, making it harder to determine exactly when a risky change occurred.
- C. Incorrect.
Incorrect. Encryption at rest protects confidentiality if the workstation is lost or stolen, but it does not provide version history, change attribution, file comparison, or rollback. A candidate might choose this because encryption is a strong security control, but it addresses a different problem than change tracking and restoration.
- D. Incorrect.
Incorrect. A read-only network share can limit who edits files, and full-disk encryption protects stored data, but this does not inherently track detailed historical changes or provide easy restoration of an earlier approved version. This option improves access restriction and data protection, but not the core requirement for version-aware accountability and recovery.