SY0-701 Question 253
Single answerSecure baselines: Establish , Deploy , MaintainA security administrator is tasked with standardizing 600 newly deployed Windows laptops for a hybrid workforce. The company wants to reduce configuration drift, ensure consistent hardening, and make future audits easier. The administrator has already selected a secure configuration standard based on CIS Benchmarks and internal requirements. Which action is the BEST next step to establish, deploy, and maintain a secure baseline across the laptop fleet?
- A
Create a hardened gold image and enforce the approved settings through centralized configuration management, with periodic compliance checks against the baseline
- B
Allow each department to customize its own laptop build as long as full-disk encryption is enabled and antivirus is installed
- C
Document the desired settings in a spreadsheet and ask technicians to manually configure each laptop before issuing it to users
- D
Perform vulnerability scans after deployment and remediate findings individually without creating a standard baseline configuration
Show answer and explanation
Correct answer: A
Explanation
Secure baselines are intended to create consistent, hardened system configurations that reduce attack surface and simplify administration. The strongest approach is to first establish an approved baseline using recognized guidance such as CIS Benchmarks, NIST Secure Configuration guidance, vendor hardening recommendations, and internal business requirements. Then deploy that baseline through standardized images and centralized management tools such as Group Policy, Microsoft Intune, or other endpoint management platforms. Finally, maintain the baseline by continuously validating compliance and remediating drift through regular assessments, configuration monitoring, and change control. This aligns with common best practices described by NIST, including secure configuration management principles in NIST SP 800-128 and broader security control guidance in NIST SP 800-53.
- A. Correct.
This is the best answer because it covers all three parts of secure baseline management: establish, deploy, and maintain. Establishing the baseline means defining approved secure settings from sources such as CIS Benchmarks and internal policy. Deploying it through a hardened gold image and centralized tools such as Group Policy, MDM, or endpoint configuration management ensures consistency at scale. Maintaining it with periodic compliance checks helps detect and correct configuration drift over time. This is the operationally mature approach used in enterprise environments.
- B. Incorrect.
This is incorrect because allowing each department to create its own build undermines standardization and increases configuration drift. While full-disk encryption and antivirus are important controls, they do not constitute a complete secure baseline. A secure baseline should define a consistent, approved configuration across systems, not a loosely controlled set of minimum requirements.
- C. Incorrect.
This is incorrect because manual configuration is error-prone, difficult to validate, and not scalable for 600 laptops. A spreadsheet may help document settings, but by itself it does not provide reliable deployment or ongoing maintenance. This approach also makes audits and compliance verification much harder because there is no centralized enforcement or continuous monitoring.
- D. Incorrect.
This is incorrect because vulnerability scanning alone does not replace establishing a secure baseline. Scans can identify weaknesses after deployment, but they do not ensure systems were built from a secure standard in the first place. Remediating findings one by one without a defined baseline is reactive and inefficient, and it does not adequately address long-term consistency or drift management.