2.2 Describe the Use of Hardening Machine Images for Deployment 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization is deploying a new application to 200 virtual machines. The security policy requires that all VMs have the same security baseline, including specific registry settings and file permissions. Which deployment approach best ensures consistency?

   • ADeploy all VMs from a single hardened, pre-configured image that includes the required registry settings and file permissions.
   • BDeploy a standard OS image and then run a configuration management script after each VM boots.
   • CDeploy a standard OS image and manually configure each VM using a checklist.
   • DDeploy a standard OS image and rely on the application installer to set the required settings.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is deploying a new application that requires a specific version of a third-party library. The library has known vulnerabilities in older versions, but the application is not compatible with the patched version. The security team must decide how to handle this in the hardened image. Which approach is most appropriate?

   • ADeploy the image with the required library version and implement compensating controls, such as network segmentation and monitoring, to mitigate the risk.
   • BUse the patched library version and modify the application to be compatible.
   • CRefuse to deploy the application until the library is patched, even if it delays the project.
   • DDeploy the image without the library and rely on the application to download it at runtime.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is deploying a new application that requires a specific version of a library that has known vulnerabilities. The security team has mandated that the golden image must be hardened and free of known vulnerabilities. The application team says the vulnerable library is required and cannot be replaced. What is the best course of action?

   • ADeploy the application without the library and hope it works
   • BInclude the vulnerable library in the image and accept the risk
   • CWork with the application team to find a secure alternative or apply a compensating control
   • DRefuse to deploy the application until the library is replaced
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A system administrator is hardening a Linux image for a database server. The image will be used in a production environment that must comply with a security policy requiring minimal installed packages. Which technique is most appropriate to achieve this?

   • AStart from a minimal base image and install only the packages required for the database server.
   • BApply all available security patches to the full distribution.
   • CUse a configuration management tool to enforce a package whitelist after deployment.
   • DInstall the full distribution and then remove packages that are not needed.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is moving to a DevOps model and wants to ensure that all development, test, and production environments use the same security baseline. Which approach best leverages hardened images to achieve this?

   • ACreate a single hardened image and use it for all environments, with environment-specific configuration applied at deployment time.
   • BCreate separate hardened images for development, test, and production to allow for different security levels.
   • CUse a hardened image for all environments but allow developers to modify it as needed.
   • DUse a hardened image only for production and use standard images for development and test.
   Reveal Solution Discussion Select an answer first