Hardening and secure baselines
Domain 4: Security Operations · Not started
Main exam topics
Hardening; asset and vulnerability management; monitoring and alerting; identity and access management; automation; firewalls and endpoint protection; log interpretation; incident detection, containment, eradication and recovery; forensic evidence and chain of custody.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Baselines
A secure baseline is the approved configuration for a type of system. Organizations often start from CIS Benchmarks or vendor guides, then document exceptions. Systems are deployed from the baseline and checked for drift regularly. When a server no longer matches, the difference is either approved and recorded or fixed.
Hardening steps
Hardening reduces attack surface: remove unneeded software and services, close unused ports, change default credentials, enable host firewalls, apply patches, and enforce encryption. Endpoint detection and response (EDR) adds monitoring and response on each device. Mobile devices are managed through MDM, which enforces screen locks, encryption, and remote wipe.
Patching and special systems
Patch management identifies, tests, deploys, and verifies updates. Test patches on a small group before wide rollout. Embedded, industrial, and legacy systems may not be patchable; protect them with segmentation, monitoring, and compensating controls. Wireless networks should use WPA3 and 802.1X enterprise authentication where possible.
Exam approach
When a question asks for the first or best hardening step, choose the option that removes exposure, such as disabling an unused service, over one that only detects it.
Saved