Question

A security engineer is asked to reduce the effort of securing hundreds of newly provisioned virtual servers that developers spin up daily. Each new server currently requires manual application of the OS baseline, removal of unnecessary packages, and configuration of logging before it can be approved for production. What approach best addresses this need while ensuring consistency across all deployments?

Accepted Answer

Create a hardened golden machine image with the baseline, minimized packages, and logging pre-configured, and deploy all new servers from it

Answer

Deploy servers from the vendor default image and run a vulnerability scan on each host after provisioning to catch misconfigurations

Answer

Require developers to complete a manual hardening checklist and submit it for review before each server is approved

Answer

Place all newly provisioned servers in an isolated VLAN and rely on network segmentation to compensate for host-level weaknesses