Secure baselines: establish, deploy, maintain
A secure baseline is the documented, agreed-upon security configuration for a class of systems — which services run, which ports are open, what password policy applies, which patches are installed. Without a baseline, every server is a unique snowflake and you have no way to say whether a machine is misconfigured, because there is nothing to compare it against.
The exam breaks baseline work into three verbs. You establish the baseline by starting from a trusted reference — vendor hardening guides or CIS Benchmarks — and tailoring it to your environment. You deploy it consistently using automation such as Group Policy, Ansible, or golden images, never by hand-configuring each box. You maintain it by continuously measuring live systems against the baseline, remediating drift, and updating the baseline itself as threats and business needs change.
Configuration drift — The gradual divergence of a live system from its approved baseline as administrators make one-off changes. Maintenance means detecting drift (with scanning tools) and pulling systems back into compliance.
Exam tip: On the exam, a question describing 'a standard set of security configurations applied to all new servers' is pointing at a secure baseline. If the question asks how to apply it to hundreds of machines at once, the answer is centralized automation, not manual configuration.
- OS and patch level — the approved version and minimum patch state.
- Services and ports — exactly which daemons may run and which ports may listen.
- Account policy — password length, lockout thresholds, and which default accounts are disabled or renamed.
- Logging and auditing — which events must be recorded and where they are shipped.
- Approved software — what may be installed, and by extension what counts as unauthorized.
In a real shop, compliance is measured continuously rather than argued about. A configuration assessment tool loads the baseline as machine-readable content (often SCAP-formatted), scans every host, and reports a per-system score — '94% compliant, failing the password-history and audit-policy checks.' Those failures become remediation tickets, and the same scan next week proves whether they were fixed. This is also how auditors are satisfied: the baseline is the standard, and the scan output is the evidence.
Don't confuse: A baseline is a living document, and changing it is a change like any other. Pushing an updated baseline to production untested can break applications at scale — the same automation that hardens a thousand machines at once can also take a thousand machines down at once. Baseline updates go through change management and a test group first.
An administrator discovers that several production servers now accept Telnet connections, even though the approved configuration disables it. Which term BEST describes what has happened?
A team is building the secure configuration standard for a new fleet of Linux web servers. What is the BEST starting point?