4.1 - Secure baselines and protocols
Security+ SY0-701 objective 4.1 covers applying secure baselines and protocols across the enterprise. Secure protocols replace cleartext ones: SSH gives an encrypted CLI to manage a switch instead of Telnet, and SRTP (Secure RTP) protects real-time VoIP call media from eavesdropping. A CIS Benchmark provides a vetted, industry-standard hardening configuration you can apply to systems like Linux servers. On Windows, Group Policy Objects (GPOs) enforce a consistent, centrally managed security configuration across many servers and workstations. Hardening also covers disabling unused ports and services, changing default credentials, and applying baselines to mobile and cloud. Expect scenario questions that describe a management or hardening need and ask which secure protocol, benchmark or enforcement tool - SSH, SRTP, CIS Benchmark or GPO - is the right choice.
Encrypted CLI (not Telnet) = SSH. Protect VoIP call media = SRTP. Vetted hardening config = CIS Benchmark. Central Windows enforcement = Group Policy (GPO).
Practice questions
1. Disabling unused services and applying a secure baseline to a server is called:
- Load balancing
- Hardening (correct answer)
- Tunneling
- Provisioning
Hardening reduces the attack surface: remove/disable unused services, apply secure baselines/benchmarks (CIS), patch, and restrict accounts.
2. Before deploying a change to production, what should a formal change process require first?
- Applying it after hours quietly
- Approval, testing and a backout plan (correct answer)
- Skipping any documentation
- Notifying customers only afterward
Change management requires a request, impact/risk analysis, approval (change board), a maintenance window and a documented backout plan before implementing.
3. Which protocol and port provide encrypted directory queries (secure LDAP)?
- LDAP on port 389
- LDAPS on port 636 (correct answer)
- DNS on port 53
- SMTP on port 25
LDAPS wraps LDAP in TLS on TCP 636, encrypting directory lookups and binds. Plain LDAP (389) sends queries and credentials in cleartext.
4. Which pairing provides strong enterprise Wi-Fi authentication (WPA3-Enterprise)?
- WEP with a shared key
- 802.1X with a RADIUS server (correct answer)
- Open network with a portal
- MAC filtering by itself
WPA3/2-Enterprise uses 802.1X with a RADIUS server for per-user authentication (EAP), instead of a shared pre-shared key. WEP is broken; MAC filtering is easily spoofed.
5. Which version of SNMP adds authentication and encryption for secure device monitoring?
- SNMP version 1
- SNMP version 2c
- SNMP version 3 (correct answer)
- SNMP over Telnet
SNMPv3 adds authentication and encryption (confidentiality/integrity). v1 and v2c send community strings in cleartext and should be avoided for management.
6. A file server should use secure file transfer that runs entirely over an SSH channel. Choose:
- FTPS (FTP over TLS)
- SFTP (SSH File Transfer) (correct answer)
- Plain FTP on port 21
- TFTP for simplicity
SFTP runs file transfer over an SSH session (single encrypted channel). FTPS is FTP wrapped in TLS (separate control/data ports); plain FTP and TFTP are unencrypted.