A CI/CD pipeline is used to deploy VMs to an laaS environment. Which of the following can be used to harden the operating system once the VM is running?

Ansible is an agentless automation and configuration management tool designed to manage systems and apply desired state configurations. In the context of a CI/CD pipeline deploying VMs, Ansible can be used as a post-deployment step to connect to the running VM (typically via SSH) and execute a "playbook." This playbook contains a set of tasks that define the hardened state of the operating system, such as disabling unused services, configuring firewall rules, applying security patches, and enforcing password policies. This directly addresses the need to harden the OS after the VM is operational.

A. Docker: Docker is a platform for building and running applications in isolated containers. It does not manage or harden the underlying host VM's operating system.
B. Kubernetes: Kubernetes is a container orchestration system for automating the deployment, scaling, and management of containerized applications. Its scope is the container, not the host OS configuration.
C. Git: Git is a distributed version control system used to track changes in source code and configuration files. It stores the configuration definitions but does not apply them to a running system.

1. Red Hat Ansible Documentation: "Ansible is an open source IT automation engine that automates provisioning

configuration management

application deployment

orchestration

and many other IT processes... You can use Ansible to install software

apply custom configurations

and provision your infrastructure."

Source: Red Hat

"What is Ansible?

" Ansible Documentation. Retrieved from https://docs.ansible.com/ansible/latest/userguide/introgettingstarted.html#what-is-ansible.

2. National Institute of Standards and Technology (NIST) Special Publication 800-123: This guide discusses server security and emphasizes the importance of automated configuration management. "Organizations should use automated tools to check for and enforce security configuration settings on an ongoing basis... Examples of configuration management tools include Puppet

Chef

and Ansible."

Source: Souppaya

M.

& Scarfone

K. (2013). Guide to General Server Security (NIST Special Publication 800-123). National Institute of Standards and Technology. Page 37

Section 5.2. (https://doi.org/10.6028/NIST.SP.800-123)

3. University Courseware: In materials discussing DevOps and Infrastructure as Code (IaC)

tools are categorized by function. Git is for source control

Docker for containerization

and Ansible/Puppet/Chef for configuration management.

Source: University of Washington

CSE 481D

Lecture 10: Configuration Management. This lecture explicitly categorizes Ansible as a configuration management tool used to "bring a system into a desired state" and contrasts it with tools for other purposes in the DevOps lifecycle.