I85PREP
⌘ K
CS AO study materials
CS AO study resources

CS AO: Security, Hardening, and Compliance

CS AO · Work through your exam, one topic at a time.

All guide sections

Security, Hardening, and Compliance

Security, Hardening, and Compliance

This domain tests reducing attack surface and proving it with evidence.

Core rules

  • Patch on a cadence and track exceptions. Define a vulnerability remediation SLA (for example, critical within 7 days).
  • Baseline against a recognized standard: CIS Benchmarks for OS hardening, DISA STIGs, or vendor guides. Record deviations with justification.
  • Mandatory access control: SELinux (getenforce, semanage, restorecon) or AppArmor. Do not disable it to make an app work; write a policy.
  • Host firewall: firewalld, nftables, or ufw; default deny inbound, allow only required ports. On Windows, Windows Defender Firewall with Advanced Security.
  • SSH: disable root login, disable password auth, use keys with passphrases, restrict AllowUsers. Changing the port is defense in depth, not a control.
  • Audit: auditd rules for privileged commands and file access; ship logs off-host. Frameworks such as PCI DSS, HIPAA, and ISO 27001 require evidence, not intent.

Worked example

An auditor asks how you know only approved packages are installed. Reasoning: package managers keep a manifest. On RHEL, rpm -qa --qf '%{NAME}-%{VERSION}\n' | sort > manifest.txt; compare to the approved baseline with diff. A drift report plus a change ticket is evidence. If a package is unapproved, remove it, restart dependent services, and rescan with a vulnerability scanner. Document the finding and closure date.

Traps

  • setenforce 0 as a permanent fix - it hides the real mislabel.
  • Opening inbound any/any "temporarily".
  • Relying on antivirus alone; patching and least privilege matter more.
  • Claiming compliance without logs, scan output, or ticket references.