Examkin

Question

Difficulty: HardSecurity Governance Structures and Policy Frameworks

An enterprise cloud security engineering team is updating its operational documentation following a compliance review. Executive leadership has already established an overarching Information Security Policy mandating baseline security hygiene and risk minimization across all enterprise workloads. To operationalize this directive for system deployments, the team needs to publish a document detailing the mandatory minimum security configuration parameters—such as specific SSH cipher suites, disabled unneeded services, and firewall rule defaults—that every Linux virtual machine must satisfy before launch. Which of the following governance document types should the team publish to establish these minimum configuration requirements?

  1. Security baselineAnswer
  2. B
    Security guideline
  3. C
    Security policy
  4. D
    Compensating security control

Answer

Security baseline
A security baseline specifies the mandatory minimum technical hardening settings required for a particular operating system, application, or network device. Because the engineering team is publishing exact OS parameters (such as SSH ciphers and disabled services) that all Linux virtual machines must meet before deployment, the document represents a technical security baseline.

Step-by-Step Solution

1
Analyze the scope and intent of the required security document described in the scenario.
The requirement specifies mandatory, technical, system-level minimum security parameters (e.g., SSH cipher suites, disabled services) for newly provisioned Linux virtual machines.
Governance documents are categorized by their level of abstraction, authority, and enforceability.
2
Evaluate the document types within the security governance hierarchy.
High-level policies govern organizational directives; standards establish mandatory rules; guidelines offer optional recommendations; baselines set minimum technical configuration standards for specific systems.
Identifying the specific level of technical detail distinguishes baselines from higher-level policy directives.
3
Select the governance document type that matches mandatory minimum OS configuration settings.
A security baseline is the correct designation for platform-specific minimum hardening requirements.
Baselines serve as the functional reference configuration for hardening operating systems before production use.

Key Concept

Security Governance Hierarchy (Policy vs. Standard vs. Baseline vs. Guideline)
Rate this question

Topics

Security Governance Structures and Policy Frameworks

More questions from this topic