Examkin

Question

Difficulty: HardSecurity Governance Structures and Policy Frameworks

Following an enterprise acquisition, a security architecture team must unify server hardening requirements across newly merged cloud and legacy data center environments. The team needs to publish a mandatory document specifying exact, minimum technical configuration thresholds—such as disabled network daemons, specific kernel audit flags, and minimum cryptographic cipher suites—that every server image must meet prior to production provisioning. Which of the following document types best fulfills this operational requirement?

  1. Security baselineAnswer
  2. B
    Security guideline
  3. C
    Acceptable use policy
  4. D
    Authorization matrix

Answer

A security baseline specifies mandatory minimum security configuration settings and hardening thresholds that systems must maintain before deployment into production.
A security baseline defines mandatory minimum security settings and technical configuration thresholds that systems must conform to before being provisioned into production.

Step-by-Step Solution

1
Analyze the governance requirement detailed in the scenario
The scenario requires a mandatory document that defines exact minimum technical configuration settings (kernel parameters, disabled daemons, cipher suites) for system images before deployment.
Distinguishing between behavioral directives, technical standards, minimum thresholds, and discretionary suggestions is essential to selecting the correct governance document type.
2
Evaluate governance document definitions against the requirement
A security baseline establishes the mandatory minimum operational security threshold/bar for specific operating systems, hardware, or software platforms.
While a policy states executive intent and standards set general rules, a baseline dictates the specific, mandatory minimum configuration state required for deployment readiness.

Key Concept

Security Baseline vs. Policy Hierarchy Components
Estimated Time:1m 30s
Rate this question

Topics

Security Governance Structures and Policy Frameworks

More questions from this topic