A medical imaging provider is hardening a new fleet of internet-facing Linux application servers that all run an identical image. The security lead has adopted a published industry benchmark as the agreed configuration baseline and must ensure each host both starts in a known-good state and stays there over its operating life, because a recent audit found servers that had silently drifted from their intended configuration after months of ad hoc administrator changes. Which two measures most directly establish and maintain a secure baseline for these servers? Select TWO.
- ABuild each server from a golden image whose settings are derived from the agreed benchmark, so every host begins life in the same documented hardened state. Correct
- BIssue each engineer a personal administrator account and trust them to apply the benchmark settings by hand whenever they log in to a server.
- CRun a configuration management tool on a schedule that checks each host against the benchmark and automatically remediates any setting that has drifted. Correct
- DDeploy a network intrusion prevention sensor in front of the server subnet to drop malicious packets before they reach the application hosts.
- ESchedule a quarterly full backup of each server to an off-site repository so that the systems and their stored data can be restored after a disaster.
Why A is correct: Provisioning every host from a benchmark-derived golden image is exactly how a secure baseline is established, giving each server an identical, documented hardened starting configuration.
Why B is wrong: Manual per-engineer hardening is tempting because it uses the same benchmark, but it is precisely the ad hoc, unrepeatable approach that caused the drift the audit found, so it neither reliably establishes nor maintains the baseline.
Why C is correct: Scheduled configuration management that detects and auto-remediates drift is how a baseline is maintained over time, returning hosts to the documented hardened state after unauthorised or accidental changes.
Why D is wrong: An intrusion prevention sensor is a useful perimeter control and feels relevant to internet-facing hosts, but it inspects traffic rather than setting or enforcing the on-host configuration, so it does not establish or maintain the baseline.
Why E is wrong: Off-site backups support recovery and resilience and sound prudent for production hosts, but restoring an old image does not define a hardened configuration or detect drift, so it is not a baseline establishment or maintenance measure.