mediumMultiple SelectObjective-mapped
CCSP Practice Question: Which TWO of the following are best practices for…
Which TWO of the following are best practices for implementing baseline configuration management in a cloud environment? (Choose two.)
⚠ Common exam trap
ISC2 often tests the misconception that manual flexibility or disabling detection features are acceptable trade-offs for operational convenience, when in fact they directly violate cloud security operations best practices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automate the deployment of baseline configurations using orchestration tools
Automating the deployment of baseline configurations using orchestration tools (e.g., AWS CloudFormation, Terraform, or Ansible) ensures consistency, reduces human error, and enforces security controls across cloud resources. This aligns with the principle of immutable infrastructure, where configurations are deployed programmatically rather than manually adjusted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow administrators to manually adjust configurations as needed to maintain flexibility
Why it's wrong here
Manual changes can introduce drift.
- ✗
Disable configuration drift detection to reduce alert fatigue
Why it's wrong here
Drift detection is important for security.
- ✓
Automate the deployment of baseline configurations using orchestration tools
Why this is correct
Ensures consistent and repeatable deployments.
- ✗
Grant all users read/write access to configuration repositories for efficiency
Why it's wrong here
Least privilege should be applied.
- ✓
Store and manage configuration templates in a version-controlled repository
Why this is correct
Enables change tracking and rollback.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.