Configuration drift detection in PowerShell - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is configuration drift in IT systems?

Configuration drift happens when a system's settings change over time from the original or desired setup, often causing unexpected behavior.

beginner

Why is detecting configuration drift important?

Detecting drift helps keep systems secure, stable, and consistent by finding changes that might cause errors or vulnerabilities.

intermediate

Which PowerShell cmdlet can be used to compare current system settings to a baseline for drift detection?

You can use Compare-Object to compare current configuration data with a saved baseline to find differences.

intermediate

What is a simple way to store a baseline configuration in PowerShell?

You can export system settings to a file using Export-CliXml or Export-Csv to save the baseline for later comparison.

beginner

How can automation help with configuration drift detection?

Automation scripts can regularly check system settings against the baseline and alert you if changes are found, saving time and reducing errors.

What does configuration drift mean?

A System hardware is upgraded

B System settings have changed from the original setup

C New software is installed

D System is running faster than usual

Configuration drift means the system's settings differ from the original or desired configuration.

Which PowerShell cmdlet helps compare two sets of data for differences?

A Set-Item

B Get-Content

C Compare-Object

D New-Item

Compare-Object compares two collections and shows differences.

What is a good practice to detect configuration drift?

A Manually check settings once a year

B Only check after system crashes

C Ignore small changes

D Regularly compare current settings to a saved baseline

Regular comparisons to a baseline help catch drift early.

Which file format can be used to save baseline configurations in PowerShell?

A .csv

B .exe

C .mp3

D .jpg

CSV files can store configuration data in a readable format.

How does automation improve configuration drift detection?

A By automatically checking and alerting on changes

B By deleting old configurations

C By making manual checks slower

D By ignoring changes

Automation regularly checks configurations and alerts you to changes, improving reliability.

Explain what configuration drift is and why it matters in system management.

Think about how changes over time can affect a system's behavior.

Describe a simple PowerShell approach to detect configuration drift using baseline files.

Consider saving settings and comparing them later.

Practice

1. What is the main purpose of configuration drift detection in PowerShell?

easy

A. To delete temporary files from the system

B. To find unexpected changes in system settings

C. To create new user accounts on a system

D. To install new software updates automatically

Solution

1. Step 1: Understand configuration drift detection

   Configuration drift detection is about identifying changes that were not planned or expected in system settings.

2. Step 2: Match the purpose with options

   Among the options, only finding unexpected changes matches the purpose of configuration drift detection.

3. Final Answer:

   To find unexpected changes in system settings -> Option B

4. Quick Check:

   Configuration drift detection = find unexpected changes [OK]

Hint: Remember: drift means unexpected changes [OK]

Common Mistakes:

• Confusing drift detection with software installation
• Thinking it manages user accounts
• Assuming it cleans files automatically

2. Which PowerShell command is used to compare baseline and current configurations for drift detection?

easy

A. Compare-Object

B. Get-Content

C. Set-Item

D. New-Item

Solution

1. Step 1: Identify the command for comparing objects

   PowerShell's Compare-Object command compares two sets of data, perfect for detecting differences.

2. Step 2: Eliminate unrelated commands

   Get-Content reads files, Set-Item changes values, New-Item creates items. None compare data sets.

3. Final Answer:

   Compare-Object -> Option A

4. Quick Check:

   Compare-Object compares configurations [OK]

Hint: Use Compare-Object to spot differences fast [OK]

Common Mistakes:

• Using Get-Content instead of Compare-Object
• Confusing Set-Item with comparison
• Trying New-Item to detect drift

3. Given these two arrays in PowerShell:

$baseline = @('Setting1', 'Setting2', 'Setting3')
$current = @('Setting1', 'Setting2', 'Setting4')

What will be the output of Compare-Object $baseline $current?

medium

A. Setting1 and Setting2 are different

B. No differences found

C. Setting3 is in baseline only; Setting4 is in current only

D. Error: Cannot compare arrays

Solution

1. Step 1: Compare the two arrays

   Baseline has Setting3; current has Setting4 instead. Setting1 and Setting2 are common.

2. Step 2: Understand Compare-Object output

   It shows items only in one array with a side indicator. So Setting3 appears only in baseline, Setting4 only in current.

3. Final Answer:

   Setting3 is in baseline only; Setting4 is in current only -> Option C

4. Quick Check:

   Compare-Object shows differences = Setting3 is in baseline only; Setting4 is in current only [OK]

Hint: Look for items unique to each list [OK]

Common Mistakes:

• Assuming no differences when there are
• Thinking common items show as differences
• Expecting an error from Compare-Object

4. You run this PowerShell command to detect drift:

Compare-Object $baseline $current -Property Name

But you get an error saying property 'Name' does not exist. What is the likely cause?

medium

A. The objects in $baseline and $current do not have a 'Name' property

B. Compare-Object cannot compare properties

C. You must use -IncludeEqual to avoid errors

D. The arrays are empty

Solution

1. Step 1: Understand the -Property parameter

   -Property expects objects with that property to compare by it.

2. Step 2: Check the data type of arrays

   If arrays contain strings, they have no 'Name' property, causing the error.

3. Final Answer:

   The objects in $baseline and $current do not have a 'Name' property -> Option A

4. Quick Check:

   Property error means missing property in objects [OK]

Hint: Check object properties before using -Property [OK]

Common Mistakes:

• Thinking Compare-Object can't compare properties
• Believing -IncludeEqual fixes property errors
• Assuming empty arrays cause this error

5. You want to detect configuration drift by comparing two JSON files representing system settings. Which PowerShell approach correctly detects drift?

hard

A. Import both JSON files with Get-Content and compare strings directly

B. Use Get-Content with -Raw and compare with -eq operator

C. Manually open files and visually check for differences

D. Use ConvertFrom-Json on both files, then Compare-Object on resulting objects

Solution

1. Step 1: Understand JSON comparison needs

   Comparing JSON as strings can fail due to formatting differences; converting to objects is better.

2. Step 2: Use ConvertFrom-Json and Compare-Object

   ConvertFrom-Json parses JSON into objects; Compare-Object can then detect differences in properties.

3. Final Answer:

   Use ConvertFrom-Json on both files, then Compare-Object on resulting objects -> Option D

4. Quick Check:

   Convert JSON to objects before comparing [OK]

Hint: Parse JSON to objects before comparing [OK]

Common Mistakes:

• Comparing raw JSON strings directly
• Using -eq operator for complex objects
• Relying on manual visual checks