Study ISC2 CC hardening and configuration management: baselines, updates, patches, secure settings, documentation, approval, rollback, and verification.
Hardening reduces attack surface by removing unnecessary risk and keeping systems in a known safer state. CC questions usually test the process, not vendor-specific commands.
| Area | Safer habit |
|---|---|
| Accounts | disable unused accounts, enforce least privilege |
| Services | remove or disable unnecessary services |
| Configuration | use approved secure baseline |
| Updates | apply patches through change process |
| Defaults | change insecure default settings |
| Verification | scan, monitor, and document results |
Configuration management keeps systems consistent and reviewable. A baseline defines the expected secure state; changes should be documented, approved, tested, and reversible.
If a patch is available, do not blindly install it everywhere without considering testing and change control. If a patch is delayed, compensating controls such as segmentation, monitoring, or temporary restrictions may reduce risk.