A school district wants lab PCs locked to an approved security posture without visiting each classroom. Which configuration-management practice fits?
Select an answer to reveal the explanation.
Short Explanation
A declared baseline is the district's dress code for lab PCs—applied by the system, not by hope. Config management pushes that lockdown without a classroom tour. Paper checklists and student self-reports are not enforcement.
Full Explanation
A school district that wants lab PCs locked to an approved security posture without visiting each classroom should apply a declared security baseline through configuration management. The baseline encodes local admin rights, firewall posture, disk encryption expectations, approved software, and logging agents as desired state, then agents or imaging-plus-config workflows enforce it continuously across labs.
Asking students to self-report whether local admin rights were removed is not a control; it is an honor-system survey. Leaving labs unmanaged until the annual summer imaging party only allows months of drift, malware footholds, and exam-season surprises. Posting a paper checklist and hoping substitute teachers enforce it fails the scalability and consistency goals implied by “without visiting each classroom.”
Exam caveat: imaging and configuration management often work together—images provide a clean starting point; config management maintains posture between reimages. A baseline that is never assessed (compliance reports) can silently fail. Privileged student use cases may need tightly scoped exceptions managed as policy, not as uncontrolled local admin.
Operational check: deploy the baseline to a pilot lab, attempt to create a local admin or disable a required control, confirm converge remediates, review compliance dashboards for classroom coverage, and only then roll district-wide with change-window communications to instructors.