CompTIA Security+ (SY0-701)Security OperationsEasy
A security team runs a tool nightly that compares each server's current configuration settings against the organization's approved secure image and generates an alert whenever a setting no longer matches the standard. What is this process called?
- APenetration testing
- BVulnerability scanning
- CAttack surface mapping
- DConfiguration compliance scanning
Show answer & explanationAnswer & explanation
Correct answer: D. Configuration compliance scanning
Configuration compliance scanning checks systems against an established secure baseline and flags deviations, helping maintain consistent hardening over time. Vulnerability scanning looks for known weaknesses/CVEs, penetration testing simulates attacks, and attack surface mapping identifies exposed entry points—none of these specifically compare configs to a baseline.
Why the other options are wrong
- A. Involves active exploitation attempts, not baseline comparison.
- B. Focuses on known vulnerabilities, not config drift from a baseline.
- C. Identifies exposed services/interfaces, not config compliance.
Configuration Compliance Scanning
Automated comparison of a system's current settings against an approved secure baseline to detect unauthorized drift.
- Detects configuration drift over time
- Complements vulnerability scanning
- Often tied to hardening standards like CIS benchmarks
Memory trick: Picture a ruler measuring a server against a blueprint every night.