Examkin

Question

Difficulty: MediumSecurity Governance Structures and Policy Frameworks

An enterprise cloud engineering team at an online learning platform is standardizing infrastructure deployments across multiple cloud environments. To prevent configuration drift, the team publishes a mandatory document defining the mandatory minimum technical security configuration settings—such as turning off root SSH access, enforcing minimum encryption protocol versions, and disabling unused network daemons—that every Linux virtual machine must satisfy before deployment. Which of the following governance document types best describes this mandatory configuration document?

  1. Security BaselineAnswer
  2. B
    Security Guideline
  3. C
    Acceptable Use Policy
  4. D
    Compensating Control

Answer

Security Baseline
The correct answer is Security Baseline because a baseline specifies the mandatory minimum technical security configurations, settings, and hardening rules required for a specific system or platform before it enters production.

Step-by-Step Solution

1
Analyze the scenario requirements
The document specifies mandatory minimum technical configuration requirements (disabling root SSH, enforcing encryption levels, closing unused ports) for virtual machines.
Governance documents are categorized based on their level of technical specificity, mandatory nature, and target application.
2
Evaluate governance document definitions against the scenario
A baseline provides a consistent, mandatory minimum security threshold for system configurations.
High-level policies set management intent, standards set specific mandatory rules, guidelines offer optional advice, and baselines define mandatory technical configuration minimums.

Key Concept

Security Governance Documentation Hierarchy: Policy vs. Standard vs. Baseline vs. Guideline
Rate this question

Topics

Security Governance Structures and Policy Frameworks

More questions from this topic