An auditor asks how the network team proves its IOS XE routers and switches are hardened consistently against an industry-recognized standard rather than individual engineers' preferences. What should the team use?
Select an answer to reveal the explanation.
Short Explanation
A CIS benchmark is the building code for your device configs: written by a community of experts, and you inspect against it line by line. That beats each engineer's personal checklist every time. The traps are tools built for other jobs, like design, patching or threat intel.
Full Explanation
The Center for Internet Security publishes benchmarks, consensus-developed secure configuration guidelines for operating systems, network devices, cloud platforms and applications, including Cisco IOS XE. Each recommendation has a rationale, an audit procedure that shows how to verify the setting, and a remediation procedure. Because the baseline is developed and reviewed by a community of practitioners rather than by the team itself, auditing devices against it demonstrates hardening to a recognized standard and makes deviations measurable. The Cisco SAFE branch guidance describes capabilities and design for a place in the network; it does not define line-by-line configuration settings to audit. CVSS scores rate the severity of vulnerabilities and support patch prioritization; they say nothing about whether management protocols, logging or AAA are configured securely. STIX is a format for sharing threat intelligence such as indicators and campaigns, and threat feeds are not a configuration baseline. Exam caveat: benchmarks are guidance, and organizations select a profile level and document exceptions rather than applying every item blindly. Operational check: run an assessment of each device's configuration against the chosen benchmark profile, record the compliance score, and track failed items to remediation or a documented exception.