Security Baselines

Question 1 of 6

A security baseline defines which of the following for an application environment?

The maximum acceptable number of users who can access the application simultaneously The minimum approved security configuration settings, patch levels, and requirements that every deployed instance must meet The encryption algorithm used to protect data in transit between application servers The backup schedule and retention period for application data

Question 2 of 6

An organization discovers that one of its 50 application servers was never brought into compliance with the approved security baseline at deployment. That server is subsequently compromised by an attacker exploiting a missing patch. What does this scenario best illustrate?

The security baseline itself was incorrect — the required patch was not included Baseline consistency is critical — a single non-compliant instance creates an exploitable gap even when all others are protected Patch management is separate from security baselines and should be handled independently Attackers always target the most recently deployed servers

Question 3 of 6

A security team is configuring new Windows 10 workstations and wants to start from Microsoft's recommended security settings rather than building a baseline from scratch. Which tool should they use?

Windows Defender Application Control Microsoft Security Compliance Toolkit (SCT) Active Directory Certificate Services Windows Update for Business

Question 4 of 6

A continuous integrity monitoring system alerts that a production server has three deviations from its approved baseline: a new local user account was created, RDP was enabled, and Windows Defender real-time protection was disabled. None of these changes appear in the change management system. What is the most important first response?

Update the baseline to include these new settings as approved configurations Disable the monitoring system temporarily to avoid false positive alerts Investigate the deviations as a potential security incident — the pattern matches attacker persistence techniques Restore the settings to baseline and close the alert without further investigation

Question 5 of 6

An organization's security baseline for Windows servers was last updated two years ago. A new critical vulnerability is announced affecting the Windows Remote Procedure Call service. The vulnerability can be mitigated by disabling an optional RPC feature that the organization does not use. What should the organization do?

Wait until the next scheduled annual baseline review to address the configuration change Update the baseline to require the vulnerable feature to be disabled, test the change, and deploy it to all affected servers Only update the baseline on servers that are externally accessible, not internal servers Defer the change until after the feature is used in an actual attack against the organization

Question 6 of 6

Which statement best describes configuration drift?

A deliberate policy decision to relax security settings for a specific application environment The planned migration of configuration settings from an old operating system to a new one The gradual divergence of a system's actual configuration from its approved baseline over time due to accumulated changes The process of updating baseline settings when a new vulnerability is discovered

Matching

Match each baseline management scenario to the phase or concept it best represents.

1. A security team downloads the Microsoft SCT, customizes 12 settings for their operational environment, documents the justifications, and gets formal approval for the resulting configuration standard.

2. Using Active Directory Group Policy and an MDM platform, the security team pushes the approved configuration settings to all 600 workstations and enrolled mobile devices, verifying 100% coverage within 24 hours.

3. When a new vulnerability bulletin requires disabling TLS 1.0, the team updates the baseline document, tests the change on a pilot group, confirms application compatibility, and then redeploys the updated setting organization-wide within 48 hours.

4. Every quarter, the compliance team runs a formal assessment comparing all server configurations against the approved baseline, produces a compliance report, and stores it as documented evidence for the upcoming PCI DSS assessment.

1. 2. 3. 4.

A. Establish

B. Deploy

C. Maintain

D. Audit

Security Baselines — Quiz

Matching