2.2 Describe the Use of Hardening Machine Images for Deployment 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company is deploying a hardened Windows image to a production environment. The security team requires that the image have no default accounts, but the application team needs a local account for service runs. What is the best way to satisfy both requirements?

   • ACreate a local account with administrative privileges to ensure the service can run
   • BDisable all local accounts and run the service under the SYSTEM account
   • CCreate a dedicated service account with a strong password and restrict its privileges to only what is needed
   • DUse the built-in Administrator account for the service
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security engineer is responsible for hardening a Linux image that will be used for both development and production environments. The development team requires compilers and debugging tools, while the production environment must have a minimal attack surface. The engineer must create a single image that can be used for both. Which approach best meets the conflicting requirements?

   • ACreate a base hardened image with only common runtime components, and then use separate layers or profiles to add development tools for the development environment.
   • BCreate two separate images: one for development and one for production.
   • CInclude the development tools in the image and rely on access controls to prevent their use in production.
   • DUse the production image for development and require developers to use remote debugging tools.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is reviewing a hardened Windows image and notices that the default Administrator account is enabled. What is the best action to take in the image?

   • AEnable the default Administrator account and add it to the Remote Desktop Users group
   • BRename the default Administrator account to a less obvious name
   • CDisable the default Administrator account and create a separate account for administrative tasks
   • DLeave the default Administrator account enabled but change the password to a strong one
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A cloud security team is responsible for creating VM images used to deploy bastion hosts. The bastion hosts will be used by administrators to access the management network. Which hardening practice is most important for these images?

   • ARestrict the image to include only the necessary administrative tools and enable just-in-time access for the bastion host.
   • BInstall a full suite of network monitoring tools to aid in troubleshooting.
   • CUse the same image as the internal application servers to maintain consistency.
   • DConfigure the bastion host to allow all inbound traffic from the internet for flexibility.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An organization is deploying a new application that requires a specific version of a third-party library. The library has known vulnerabilities in older versions, but the application is not compatible with the patched version. The security team must decide how to handle this in the hardened image. Which approach is most appropriate?

   • ADeploy the image without the library and rely on the application to download it at runtime.
   • BUse the patched library version and modify the application to be compatible.
   • CDeploy the image with the required library version and implement compensating controls, such as network segmentation and monitoring, to mitigate the risk.
   • DRefuse to deploy the application until the library is patched, even if it delays the project.
   Reveal Solution Discussion Select an answer first