ISC2 Certified in Cybersecurity (CC)Security OperationsHard
A government agency is procuring new IT equipment. Before any new server or workstation is deployed into the production environment, it must undergo a rigorous process to ensure it meets specific security baselines, including operating system hardening, required software installations, and disabled unnecessary services. Which security operations activity is responsible for establishing and maintaining these standards?
- APatch management
- BConfiguration management
- CChange management
- DAsset management
Show answer & explanationAnswer & explanation
Correct answer: B. Configuration management
Configuration management is the process of establishing and maintaining consistency of a system's performance, functional, and physical attributes with its requirements, design, and operational information throughout its life. This includes hardening and baseline adherence.
Why the other options are wrong
- A. Patch management applies updates, which is a part of maintaining a secure configuration, but configuration management is the broader process of defining that secure baseline.
- C. Change management controls changes to a system, but configuration management defines the desired state to which changes are applied.
- D. Asset management inventories equipment, but does not define its secure configuration.
Configuration Management
The process of maintaining consistency of a system's performance, functional, and physical attributes with its requirements, design, and operational information.
- Establishes and maintains secure baselines.
- Ensures systems adhere to defined standards.
- Critical for security hardening and compliance.
Memory trick: Configure it right, keep it tight.