Security, Access Control, and Compliance
What this domain tests
Security, Access Control, and Compliance tests the server security chain: firmware integrity, boot integrity, management access, role-based authorization, encryption, and audit evidence. Expect scenario questions about lockdown, certificates, and identity integration.
Platform security
- Silicon Root of Trust anchors firmware verification in hardware. Secure Boot verifies the boot loader and OS components; TPM 2.0 supports measured boot and key storage.
- iDRAC Lockdown Mode restricts management interfaces and is intended for production systems after configuration. System Lockdown restricts configuration changes from the host side.
- Secured Component Verification checks that components match the factory-signed inventory.
- Data at rest encryption can use self-encrypting drives managed by the PERC. Key management must be planned before enabling encryption.
Access control
- iDRAC roles include Administrator, Operator, Read Only, and No Access. Use least privilege and avoid shared accounts.
- Integrate with Active Directory or LDAP for centralized authentication, and test group and role mapping before locking down local accounts.
- Use TLS certificates signed by a trusted CA, keep NTP accurate, and rotate certificates before expiry.
- Enable SNMPv3 or Redfish with TLS; avoid SNMPv1 and unencrypted interfaces.
- Send audit logs to a central syslog server and restrict who can clear logs.
Worked example
A compliance team requires centralized login and evidence of management access. The engineer joins iDRAC to AD, maps a security group to the Read Only role, tests login with a test account, uploads a CA-signed certificate, enables NTP and syslog, and only then enables iDRAC Lockdown Mode. The reasoning is that lockdown after AD and certificate validation prevents lockout, while syslog preserves audit evidence.
Traps
- Enabling lockdown before testing AD or certificate changes.
- Leaving the default root password or shared administrator account.
- Ignoring certificate expiry and time drift.
- Assuming TPM alone encrypts data disks.
- Clearing logs before exporting them.