County server admins must prove that hardened build settings still match an approved security baseline after each patch cycle. Which monitoring approach best automates that configuration-compliance check?
Select an answer to reveal the explanation.
Short Explanation
Think of SCAP benchmarks as a checklist the scanner can grade automatically—did each county server keep the approved locks on? Verbal meetings and hoping people read a PDF do not prove the boxes still match the baseline.
Full Explanation
SCAP-compatible benchmark scanning automates configuration-compliance checks against an approved hardened baseline after each patch cycle. The scanner evaluates county servers for deviations—unnecessary services, weak permissions, missing audit settings, and other controls that drift when admins apply emergency fixes. Findings drive remediation so builds do not silently diverge from the municipal standard. That continuous monitoring approach proves compliance with machine-readable evidence rather than hallway assurances, which is what auditors and CompTIA expect when the question asks how to verify hardened settings still match policy.
Verbal walkthroughs in standup meetings are anecdotal, incomplete, and do not produce repeatable, host-by-host results across a county fleet. Disabling configuration logging to hide findings from auditors reduces assurance and can conceal harmful drift. Publishing a baseline PDF on the intranet and assuming every host applies it provides policy documentation without verification—hope is not a control.
Exam caveat: SCAP and CIS-style benchmarks measure configuration posture, which complements but differs from CVE vulnerability scanning. Both belong in a mature program. Documented waivers need formal risk acceptance with owners and review dates, not silent exceptions.
Operational check: after each patch window, run the approved SCAP profile against the server inventory, open tickets for high-severity drifts tied to citizen-facing hosts, remediate under change control, rescan to validate, and archive signed reports for the next audit cycle.