ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
Your organization is defining an Infrastructure as Code (IaC) template to deploy Ubuntu application servers into production. To harden the environment and guarantee identical secure configurations across all instances, which action should you prioritize when creating the template?
Disable every network service after installation and instruct operators to re-enable only the ones they need by hand.
Import the relevant CIS Linux benchmark into the IaC script and enforce the settings during automated provisioning.
Keep the vendor's default installation and simply apply the latest security patches before going live.
Wait until staging tests finish, then clone that server's configuration into production instances.
Using a widely accepted security hardening guide such as the CIS (Center for Internet Security) benchmark provides a vetted set of secure configuration settings that significantly reduce the server's attack surface. Embedding those controls directly into an automated configuration management or IaC template ensures every provisioned server starts from the same secure baseline and remains consistent across development, staging, and production. Merely disabling services manually, relying on vendor defaults with patching, or copying settings from another environment risks omissions, configuration drift, and inconsistent security posture because they lack a formal, standards-based baseline and automation.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is Infrastructure as Code (IaC)?
Open an interactive chat with Bash
What are CIS Benchmarks, and why are they important?
Open an interactive chat with Bash
What is configuration drift, and how does IaC prevent it?
Open an interactive chat with Bash
What is Infrastructure as Code (IaC) and why is it important for security?
Open an interactive chat with Bash
What are CIS benchmarks, and how do they help harden systems?
Open an interactive chat with Bash
What is configuration drift, and how does embedding controls in IaC templates prevent it?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)