4.7 Explain the importance of automation and orchestration related to secure operations
Objective 4.7 sits in Security Operations, which carries 28% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.
Objective title verbatim from the official objectives. CompTIA exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
Which practice tracks and manages changes to infrastructure as code scripts, allowing a team to revert a deployment that introduces an error?
The concept
Pipeline practices are distinguished by what each one preserves. Signing preserves the identity of a build output. Secret stores preserve confidentiality of credentials. Scanners preserve a quality bar at a point in time. Only one of them preserves history: an ordered record of every prior state of the definition, with who changed what and why, which is the precondition for putting the system back the way it was before a bad deployment.
Why this answer
Version control records every change to IaC scripts alongside the feature it supports, so a bad deployment can be reverted to a known-good state.
- Correct: this is the change-tracking mechanism described.
- BArtifact signing protects integrity of build outputs, not change history.
- CDynamic analysis evaluates running environments, not script history.
- DSecrets management protects credentials, not deployment history.
- EStatic analysis checks code for flaws, it does not track or revert changes.
Now you: objective 4.7 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A branch policy discounts the most recent pusher's approval vote even though that person has permission to approve pull requests. An engineer claims automated build validation already makes this redundant. What is the flaw in that claim?
Sample question 2 of 3
A pipeline uses immutable infrastructure and automated resource tagging, but its service account holds administrative rights across every cloud resource rather than scoped permissions per script. What security gap remains?
Sample question 3 of 3
A team certifies infrastructure as code scripts as secure using only static analysis integrated into its pipeline, skipping dynamic analysis and runtime monitoring entirely. Which risk does this approach fail to address?
That’s 3 of the full Security+ bank.
Keep going free: 10 questions per certification in bank practice, with no account.
Continue practicingRead the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.
More objectives in Security Operations
- 4.1 4.1 Given a scenario, apply common security techniques to computing resources
- 4.2 4.2 Explain the security implications of proper hardware, software, and data asset management
- 4.3 4.3 Explain various activities associated with vulnerability management
- 4.6 4.6 Given a scenario, implement and maintain identity and access management
- 4.8 4.8 Explain appropriate incident response activities
- 4.9 4.9 Given a scenario, use data sources to support an investigation