SY0-701 - Security Operations (28% of the exam) - Section 4.1

Given a scenario, apply common security techniques to computing resources.

Apply secure baselines and hardening techniques across servers, endpoints, mobile solutions, and wireless networks, tailoring controls to each platform's specific attack surface. Select appropriate application security measures - such as input validation and secure configurations - and justify why a single baseline rarely translates unchanged across heterogeneous computing environments.

secure baselineshardening targetsmobile solutionswireless securityapplication security

Practice question for this objective

Free sampleSecurity Operationshard

A medical imaging provider is hardening a new fleet of internet-facing Linux application servers that all run an identical image. The security lead has adopted a published industry benchmark as the agreed configuration baseline and must ensure each host both starts in a known-good state and stays there over its operating life, because a recent audit found servers that had silently drifted from their intended configuration after months of ad hoc administrator changes. Which two measures most directly establish and maintain a secure baseline for these servers? Select TWO.

ABuild each server from a golden image whose settings are derived from the agreed benchmark, so every host begins life in the same documented hardened state. Correct
BIssue each engineer a personal administrator account and trust them to apply the benchmark settings by hand whenever they log in to a server.
CRun a configuration management tool on a schedule that checks each host against the benchmark and automatically remediates any setting that has drifted. Correct
DDeploy a network intrusion prevention sensor in front of the server subnet to drop malicious packets before they reach the application hosts.
ESchedule a quarterly full backup of each server to an off-site repository so that the systems and their stored data can be restored after a disaster.

A secure baseline is established by provisioning hosts from a benchmark-derived image and maintained by automated configuration management that detects and remediates drift. A secure baseline has two halves: define the hardened state once and apply it to every host from a common image, then continuously enforce it. Configuration management compares live settings against the benchmark and reverts drift automatically, so accidental or unauthorised changes do not erode the hardened state over the host's life.

Why A is correct: Provisioning every host from a benchmark-derived golden image is exactly how a secure baseline is established, giving each server an identical, documented hardened starting configuration.

Why B is wrong: Manual per-engineer hardening is tempting because it uses the same benchmark, but it is precisely the ad hoc, unrepeatable approach that caused the drift the audit found, so it neither reliably establishes nor maintains the baseline.

Why C is correct: Scheduled configuration management that detects and auto-remediates drift is how a baseline is maintained over time, returning hosts to the documented hardened state after unauthorised or accidental changes.

Why D is wrong: An intrusion prevention sensor is a useful perimeter control and feels relevant to internet-facing hosts, but it inspects traffic rather than setting or enforcing the on-host configuration, so it does not establish or maintain the baseline.

Why E is wrong: Off-site backups support recovery and resilience and sound prudent for production hosts, but restoring an old image does not define a hardened configuration or detect drift, so it is not a baseline establishment or maintenance measure.

See more SY0-701 practice questions, answers explained.

Exam traps in Security Operations

Answers that look right on this material and are not. Each one is a distractor from a different question in the SY0-701 bank for this domain.

Run a dynamic application security testing scan against the staging environment, place the API behind a web application firewall, enforce TLS 1.3, and require developers to commit only through pull requests.
Why it is wrong: DAST and a WAF provide useful runtime coverage, but they sit outside the code and do not directly address mass assignment in the binder, dependency vulnerabilities in transitive packages, or secrets present in source files.
Increase the local log retention on every host from thirty days to one year and rotate log files less aggressively so more history is available to investigators.
Why it is wrong: Holding more history on the host itself does nothing about an attacker with root who simply truncates or overwrites those local files, and longer retention has no effect on the timestamp disagreement between servers that broke correlation in the recent investigation.
Document the current build of a representative laptop as the baseline, capture a golden image from it, and rely on the help desk to spot drift during routine support tickets before re-imaging affected hosts.
Why it is wrong: Capturing whatever happens to be on a working laptop is tempting because it avoids re-engineering, but the existing build has not been measured against any external benchmark and help desk visibility is reactive rather than continuous, so drift is detected late and inconsistently.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.