Understand baseline drift, patch lifecycle, risk prioritization and test the resulting controls with reproducible evidence.
45 min 180 XPSkills: Baseline drift, Patch lifecycle, Risk prioritization
Brief
Northwind Freight needs defensible evidence for hardening and patching, not a vocabulary quiz. Start with the system boundary and trace how a technical state changes the confidentiality, integrity or availability of the service. A passing document is not a passing running system.
You will examine baseline drift, patch lifecycle, risk prioritization, then make short incident decisions and author a testable specification. Keep desired state, observed state and evidence separate: an approved requirement tells you what should happen, while a dated observation tells you what actually happened.
Never convert missing evidence into a passing control result.
Baseline versus observed state
A hardening baseline declares approved configuration: enabled services, authentication policy, file permissions and network exposure. Benchmark-style recommendations are starting points, not automatic business requirements. Select a versioned profile for the role and record any deviation with a compensating control and expiry date.
Configuration drift is the difference between approved desired state and observed runtime state. A scan must identify the asset, collection time and baseline version; a single compliant snapshot cannot rule out temporary insecure changes between scans. Use change events as well as periodic comparison when short-lived exposure matters.
Secure-configuration controls need baseline approvals, drift reports and closure records. An auditor asks whether deviations are authorized and time-bounded rather than whether every checkbox was blindly applied.
Baseline versus observed state requires both a declared boundary and independently testable observations.
From discovery to verified remediation
A vulnerability lifecycle starts with asset and software discovery, then maps findings to affected versions and exposure. A CVE identifies a reported vulnerability; a CVSS score describes technical severity under a stated version and metric set. It is not an estimate of breach probability and does not include every business consequence.
Prioritize known exploitation, reachable attack paths, privilege gained and asset criticality alongside severity. A 9.8 issue on an isolated retired test host may be less urgent than a lower-scoring exploited flaw on an exposed identity service. Record the rationale and any temporary mitigation so decisions remain reviewable.
Vulnerability controls need a complete population and aging by service-level target. An auditor asks whether unreachable or unauthenticated scan failures were treated as unknown rather than clean.
From discovery to verified remediation requires both a declared boundary and independently testable observations.
Deploy safely and prove effectiveness
Test patches in a representative environment, confirm dependency compatibility and define a rollback path before rollout. Approvals should specify scope and maintenance timing. A package-install success is only a deployment event: a running process may still use the old library until restart, and the kernel may require reboot.
Validate both security and service behavior after deployment. Re-scan the affected asset or inspect the effective running version and confirm the exploit condition no longer applies. Keep an exception when immediate remediation is unsafe, with an owner, expiry and compensating restriction; closing the ticket alone does not remove exposure.
Change and vulnerability evidence should link finding, approval, deployment result and post-change validation. An auditor asks whether the original affected asset was tested after remediation, including failed deployments and reopened findings.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: Expected versus actual
Scenario sim+60 XP
Read the brief and answer both questions.
Incident brief
An approved configuration disables a remote service, but the current host enables it. The owner calls the host compliant because its document is approved.
Term bank, not all of these are right
baselinedriftinventoryexception
1.1What is the approved configuration reference called? (one word)
1.2What is the difference from approved state called? (one word)
Task 2: Identifier versus score
Scenario sim+60 XP
Read the brief and answer both questions.
Incident brief
A scanner reports a public vulnerability identifier and a separate technical-severity score. The manager calls the identifier a likelihood percentage.
Term bank, not all of these are right
CVECVSSRPORTO
2.1Which acronym names the vulnerability identifier scheme? (one acronym)
2.2Which acronym names the technical-severity scoring system? (one acronym)
Task 3: Closed on installation
Scenario sim+60 XP
Read the brief and answer both questions.
Incident brief
A package install succeeds but running code still uses an old library. The service needs a stop/start and a fresh security and health check, though the manager wants immediate closure.
Term bank, not all of these are right
restartvalidationwaiverdiscovery
3.1Which lifecycle action is still required? (one word)
3.2What general activity must support closure after that action? (one word)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
The control owner calls the current summary complete because every field has a label. Several labels confuse a technical mechanism with assurance, and missing observations have been treated as passing.
Use the fixture as the authoritative requirement. Replace the empty fields with typed, testable values and identify the evidence needed to substantiate the claim. Do not copy the owner's optimistic summary.
Approved requirement and measured facts
Critical findings must close within 7 days. Exceptions expire after 14 days. This service patch requires restart; closure needs a rescan and health test.
1
2
3
4
5
6
7
8
9
10
11
12
Checks
Critical due days meets the incident requirement
Exception expiry days meets the incident requirement
The owner says all six statements are acceptable because they use technical vocabulary. Judge the actual claim, not the confidence of its author.
Accept accurate limited mechanism statements; reject false equivalence, excessive privilege, absent evidence, or conclusions beyond the observation.
Verdicts are accept or reject. Every rejection needs one reason code from: wrong-mechanism | excess-privilege | missing-evidence | unsupported-claim.
Claims submitted for assurance
IT7-1 A hardening baseline declares approved configuration: enabled services, authentication policy, file permissions and network exposure.
IT7-2 Treat "drift" as interchangeable with "baseline"; no mechanism check is needed.
IT7-3 Let every employee modify the protected service configuration without approval or review.
IT7-4 A vulnerability lifecycle starts with asset and software discovery, then maps findings to affected versions and exposure. This statement describes the mechanism only, not a complete audit conclusion.
IT7-5 Report a pass when the required observation is missing; no dated source is retained.
IT7-6 Claim that a documented baseline drift policy proves every in-scope asset complied throughout the year.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · IT Fundamentals
Backup and Recovery
Understand rpo and rto, raid limits, restore assurance and test the resulting controls with reproducible evidence.
