General Questions
What is configuration auditing?
Configuration auditing verifies that systems, applications, and cloud resources match approved baselines and security policies.
What is configuration drift?
Configuration drift occurs when actual configuration deviates from the approved baseline. Drift may be accidental, unauthorized, or malicious.
Why are baselines important?
Baselines define the approved configuration state and serve as the reference point for auditing, drift detection, and compliance.
What is evidence in configuration auditing?
Evidence includes configuration snapshots, drift history, change logs, compliance reports, and remediation records used during audits.
Compliance Questions
Which compliance frameworks require configuration auditing?
SOC 2, ISO 27001, PCI DSS, NIST 800‑53, and CIS Benchmarks all require or strongly recommend configuration auditing and drift detection.
How does configuration auditing support SOC 2?
SOC 2 controls (CC6, CC7, CC8) require secure configuration, change control, monitoring, and evidence collection — all supported by configuration auditing.
How does configuration auditing support ISO 27001?
ISO 27001 Annex A controls require secure configuration, access control, operations security, and evidence — configuration auditing verifies these controls.
How does configuration auditing support PCI DSS?
PCI DSS requires secure configuration, change control, logging, monitoring, and evidence — all provided by configuration auditing.
Cloud Questions
How does cloud configuration auditing work?
Cloud auditing uses native services like AWS Config, Azure Policy, and GCP Config Validator to evaluate resource configuration, detect drift, and enforce policies.
What is AWS Config?
AWS Config records resource configuration, evaluates rules, detects drift, and integrates with Security Hub for compliance reporting.
What is Azure Policy?
Azure Policy enforces configuration rules across subscriptions, resource groups, and management groups, and provides compliance reporting.
What is GCP Config Validator?
Config Validator evaluates Terraform and live GCP resources using policy‑as‑code written in Rego.
Kubernetes Questions
How does configuration auditing work in Kubernetes?
Kubernetes uses admission controllers, OPA Gatekeeper, Kyverno, audit logs, and policy engines to validate configuration and detect drift.
What is OPA Gatekeeper?
Gatekeeper is a Kubernetes admission controller that enforces OPA policies written in Rego.
What is Kyverno?
Kyverno is a Kubernetes‑native policy engine used for validation, mutation, and generation of configuration.
Evidence & Reporting Questions
What evidence is required for audits?
Evidence includes configuration snapshots, drift history, change logs, compliance reports, and remediation records.
How long should evidence be retained?
Evidence retention depends on organizational policy and compliance frameworks, typically 1–7 years.
How do I prepare for a configuration audit?
Use the audit preparation checklist to gather evidence, verify configuration, update documentation, review access, and confirm compliance readiness.