• (A) Secure baseline configuration — the server was never deployed correctly.
• (B) Service and feature reduction — Windows Server runs too many services.
• (C) Endpoint protection — EDR would prevent exploitation regardless of patch state.
• (D) Patch and update management — the organization lacks a process to apply security updates on a defined cadence.

• (A) A CIS Benchmark — CIS publishes mandatory DoD baselines.
• (B) A vendor’s product-hardening guide — vendors set the DoD standard.
• (C) A DISA STIG — the prescriptive tone, CAT I/II/III severity ratings, and DoD mandate are all STIG fingerprints.
• (D) An internal corporate baseline — DoD accepts any baseline the contractor chooses.

CHANGE LOG - web-prod-03 - weekend incident response
(A) Disabled host-based firewall temporarily to rule out
    a rule conflict. Firewall is STILL OFF as of Monday AM.
(B) Rotated the service-account password ahead of schedule
    because of a suspected exposure.
(C) Applied emergency OS patches KB5031356 and KB5032190
    with the vendor’s approval.
(D) Added a test admin account for the on-call engineer;
    account is scheduled for deletion Tuesday.

• (A) Line (A) — the host-based firewall is still OFF on a production server as of Monday, directly exposing services that should be locally filtered. This is active configuration drift.
• (B) Line (B) — rotating a password is always wrong; credentials should never change.
• (C) Line (C) — applying emergency patches with vendor approval is a hardening regression.
• (D) Line (D) — creating any temporary admin account is always a hardening regression.

• I. Signature-based AV is still valuable because it handles known commodity malware with extremely low false-positive rates.
• II. EDR improves detection of fileless attacks because it watches process behavior, not just files on disk.
• III. XDR correlates signals across endpoints, identity, email, cloud, and network, making full attack-chain reconstruction possible.
• IV. Modern EDR and XDR tools eliminate the need for a host-based firewall or any patching program.

1. The gradual divergence of a device’s live configuration from its documented secure baseline is called configuration .

2. Deployment model in which the organization manages only specific corporate applications on an employee’s personal device is called Mobile .

3. A free, consensus-driven configuration guide for common platforms, published by a U.S. nonprofit, is called a .