712-50 Question 327
Single answerOS Hardening (5 questions)A newly acquired business unit is being integrated into the enterprise. During due diligence, the CISO learns that the unit runs a mix of Linux and Windows servers supporting customer-facing applications, and local administrators are allowed to install tools directly on production systems. Recent vulnerability scans show inconsistent patch levels, unnecessary services enabled, and weak local account controls. The board has asked for a risk-reduction plan that can be implemented quickly without disrupting critical operations. Which action should the CISO prioritize FIRST to improve OS hardening at scale while supporting operational stability?
- A
Establish and enforce standardized secure OS baseline configurations for Windows and Linux, integrated with configuration management and exception handling
- B
Require all system administrators to manually review every production server monthly and disable any services they do not recognize
- C
Deploy full-disk encryption on every server immediately, because encryption is the most effective control for reducing exposed attack surface
- D
Replace all local administrator accounts with a shared break-glass account so emergency changes can be made quickly during outages
Show answer and explanation
Correct answer: A
Explanation
For OS hardening, the most effective first step at the executive level is to define, approve, and enforce standard secure configuration baselines across supported operating systems. In practice, this means adopting benchmark-based configurations, tailoring them to business requirements, automating deployment and compliance checking, and managing justified exceptions. This creates consistency, reduces attack surface, and supports scalable governance. Industry best practices support this approach, including the CIS Benchmarks, NIST SP 800-123 (Guide to General Server Security), NIST SP 800-40 for patch management, and the Center for Internet Security Controls, especially around secure configuration management and controlled use of administrative privileges. Encryption, manual reviews, and emergency access procedures may all have a place in the broader program, but they are not the best first action to stabilize and harden a heterogeneous server environment at scale.
- A. Correct.
Correct. Standardized secure baselines are the foundation of OS hardening at scale. They reduce configuration drift, define approved services, enforce account and privilege settings, and can be applied consistently through Group Policy, configuration management tools, imaging standards, or infrastructure-as-code. Including an exception process is critical in production environments so business-critical deviations are documented, risk accepted, and reviewed rather than handled informally. This approach addresses the root causes in the scenario: inconsistent patching, unnecessary services, and weak account controls.
- B. Incorrect.
Incorrect. Manual monthly reviews are not scalable, are prone to human error, and can introduce operational risk if administrators disable services they do not understand. While periodic review is useful, it should not be the first priority over creating an approved hardened baseline and automating enforcement. This option reflects the common misconception that hardening is primarily an ad hoc administrative task rather than a governed, standardized process.
- C. Incorrect.
Incorrect. Full-disk encryption can protect data at rest, especially for laptops and some server use cases, but it does not directly address the key hardening problems described: unnecessary services, inconsistent configurations, local administrative sprawl, and patch inconsistency. It is an important control in some contexts, but not the first priority for reducing OS attack surface across mixed production environments.
- D. Incorrect.
Incorrect. Replacing individual local administrator accounts with a shared break-glass account would weaken accountability and auditability. Best practice is to minimize local admin rights, use named accounts, privileged access management, and tightly controlled emergency access with logging and approval. Shared credentials are generally discouraged because they make attribution difficult and increase insider and operational risk.