Configuration and Hardening Assessment
This domain tests whether you can compare a system against a secure baseline and distinguish misconfiguration from missing patches.
Benchmarks and baselines
Common references are CIS Benchmarks, DISA STIGs, and NIST SP 800-53 configuration management controls. Benchmarks have levels (for example, CIS Level 1 and Level 2) and scored versus not-scored recommendations. Level 2 is not automatically appropriate for every production role; document deviations and compensating controls. Check operating systems, network devices, databases, web servers, and cloud control planes.
Verification
Automated scanners report registry keys, file permissions, and service states, but verify high-impact findings manually. Examples: SMB signing, TLS protocol and cipher suites, SSH root login, audit policy, and default credentials. Separate configuration drift from patch gaps and from design weaknesses.
Worked example
A CIS check reports SMB signing is not required. The reasoning: the scanner may read a local policy while the effective setting comes from Group Policy. Verify with Get-SmbServerConfiguration and check the GPO source. If signing is required by policy but disabled on one host, report drift and the responsible OU; if the benchmark version does not match the OS build, note the mismatch.
Traps
Applying Level 2 hardening blindly and breaking production. Confusing a missing patch with a configuration error. Ignoring cloud identity and storage settings. Using an outdated benchmark version. Reporting a finding without the effective configuration evidence.