CS0-003 Vulnerability Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A planned change to a system's configuration

  Why it's wrong here

  A planned change to a system's configuration is an intentional, approved modification that follows the organization's change-management process. Such changes are documented, tested, and scheduled, and they move the system to a new, agreed-upon state. Because it is deliberate and controlled, it is the opposite of configuration drift, which is unplanned and often undocumented.

• ✗

  The process of reverting a system to its baseline configuration

  Why it's wrong here

  Reverting a system to its baseline configuration is a corrective action, often called remediation or rollback, that returns a system to a known-good state after an issue has been identified. While this can be a response to configuration drift, it is not drift itself; it is the process of undoing drift. Drift describes the uncontrolled movement away from the baseline, not the act of restoring the baseline.

• ✓

  The gradual deviation of a system's configuration from the intended baseline

  Why this is correct

  Configuration drift is the gradual and often unnoticed deviation of a system's current configuration from its intended, documented baseline. It results from incremental changes such as manual edits, emergency fixes, unpatchable workarounds, or inconsistent patch deployments that accumulate over time without change-control approval. This divergence can lead to security weaknesses, compliance violations, and unpredictable behavior, making it a central concern for configuration management.

• ✗

  A vulnerability that is patched and then reappears

  Why it's wrong here

  A vulnerability that is patched and then reappears is more accurately described as a regression or an incomplete fix, not configuration drift. Drift is a broad, system-level divergence from baseline settings, whereas a returning vulnerability typically indicates a flawed patch, a re-exposure through a different vector, or a failure to apply the fix in all relevant environments. It is a specific security issue rather than the general concept of configuration drift.

Go deeper

Related to this question