CompTIA Cloud Essentials+ (CLO-002)Management and Technical OperationsMedium
A cloud security engineer is designing a new cloud environment and needs to implement a policy that automatically enforces specific security configurations across all newly provisioned virtual machines (VMs). This policy must ensure that certain ports are closed by default and a specific antivirus agent is installed. Which of the following approaches BEST meets this requirement?
- AManual VM configuration after provisioning
- BUsing a Golden Image (AMI/VM Image)
- CImplementing a Security Information and Event Management (SIEM) system
- DRelying on network firewalls for port closure
Show answer & explanationAnswer & explanation
Correct answer: B. Using a Golden Image (AMI/VM Image)
A Golden Image, also known as an AMI (Amazon Machine Image) or VM Image, is a pre-configured template that includes the operating system, applications, and desired security configurations (like closed ports and installed agents). Using it ensures consistency and automation for newly provisioned VMs.
Why the other options are wrong
- A. Manual configuration is prone to errors, not scalable, and does not provide automatic enforcement.
- C. A SIEM system is for collecting and analyzing security logs, not for automatically configuring VMs upon provisioning.
- D. Network firewalls control traffic at the network boundary, but don't ensure an antivirus agent is installed or manage internal VM port configurations at the provisioning stage automatically.
Golden Image
A pre-configured, hardened virtual machine image (template) that includes the operating system, required applications, and security configurations, used to provision new instances consistently.
- Ensures consistency and compliance for new deployments.
- Reduces manual configuration and potential for human error.
- Often includes security baselines, agents, and closed ports.
Memory trick: A Golden Image is like a master cookie cutter for VMs, ensuring every new one is perfectly shaped and secured.