7.3 - Perform Configuration Management (CM) (e.g., Provisioning, Baselining, Automation) CISSP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization is required to demonstrate to auditors that its servers are configured according to a documented security baseline. The security team needs to provide evidence that the baseline is being maintained. Which of the following is the most effective way to provide this evidence?

   • AProvide the documented baseline and a report from a configuration management tool showing current compliance status.
   • BProvide a sample of server configurations that were manually reviewed by the security team.
   • CProvide a network diagram showing the placement of the servers in the network.
   • DProvide a list of all security patches that have been applied to the servers.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is implementing a configuration management process for its application servers. The process must ensure that changes are made in a controlled manner and that the configuration baseline is updated when approved changes are made. Which of the following is the most appropriate sequence of activities?

   • AIdentify the configuration items, then control changes, then perform status accounting, and finally audit the configuration.
   • BControl changes, then audit the configuration, then identify configuration items, and finally perform status accounting.
   • CPerform status accounting, then identify configuration items, then control changes, and finally audit the configuration.
   • DAudit the configuration, then identify configuration items, then control changes, and finally perform status accounting.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team wants to automate the provisioning of new user workstations. Each workstation must be configured with the organization's standard security settings, including disk encryption, antivirus, and firewall rules. Which of the following is the most effective way to achieve this?

   • AUse a desktop management tool that applies a standard image and configuration policies during deployment.
   • BDeploy workstations with default settings and then rely on users to enable disk encryption and antivirus.
   • CProvide a manual checklist to IT staff to configure each workstation after installation.
   • DUse a vulnerability scanner to identify missing security settings on each workstation after deployment.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is deploying a new application server and needs to ensure it is configured consistently with the organization's security policy. The security team has defined a standard configuration that includes specific registry settings, service configurations, and firewall rules. They want to automate the initial setup so that any new server is provisioned with this exact configuration. Which approach best meets this requirement?

   • ACopy the hard drive from an existing server that was manually configured and use it as a template for new deployments.
   • BDeploy the server with default settings and then rely on the security team to manually apply the standard configuration after installation.
   • CManually configure the server using a documented checklist and then take a snapshot of the system for future reference.
   • DUse a configuration management tool with a provisioning script that applies the standard configuration during initial deployment.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is responsible for ensuring that all web servers in an organization are configured according to a security baseline. The analyst wants to automate the process of checking for compliance and generating reports. Which of the following is the best approach?

   • AUse a configuration management tool to define the baseline and automatically remediate any non-compliant servers.
   • BManually review the configuration of each server on a monthly basis and document any deviations.
   • CRun a vulnerability scanner to identify servers that are missing patches and then manually apply the patches.
   • DCreate a script that checks the configuration and sends an email if any deviation is found, but does not remediate.
   Reveal Solution Discussion Select an answer first