4.2 - Secure configuration and automation
Security+ SY0-701 objective 4.2 covers securing assets through automation and good configuration. Security orchestration, automation and response (SOAR) provides repeatable, human-readable runbooks that automatically enrich alerts and drive consistent responses. Infrastructure as code (IaC) defines servers by code that automatically reapplies the desired state, correcting drift when settings change. A mobile device management (MDM) platform enrols employee phones so IT can enforce encryption and remotely wipe lost devices. Open-source intelligence (OSINT) is threat information gathered from publicly available sources. Asset security also covers acquisition, secure disposal and sanitisation, and inventory tracking. Expect scenario questions that describe automating a response, enforcing configuration by code, managing mobile devices or sourcing intelligence, and ask which capability - SOAR, IaC, MDM or OSINT - fits the requirement.
Automated runbooks enriching alerts = SOAR. Code that reapplies desired state (fixes drift) = IaC. Enforce/wipe employee phones = MDM. Intel from public sources = OSINT.
Practice questions
1. Which threat-intelligence source is openly available information gathered from public data?
- Proprietary vendor feed
- Open-source intelligence (OSINT) (correct answer)
- Classified government intel
- Internal-only SIEM logs
OSINT is collected from publicly available sources (websites, social media, WHOIS, forums). It complements proprietary feeds and information-sharing (ISAC/ISAO).
2. A company wants employee phones enrolled so IT can enforce encryption and remotely wipe lost devices. Deploy:
- A network traffic load balancer
- A mobile device management platform (correct answer)
- A host-based endpoint firewall
- A cloud password vault service
MDM enrolls devices to enforce policy (encryption, passcode, app control) and remotely lock/wipe. Deployment models: BYOD, COPE, CYOD balance ownership and control.
3. New IoT cameras ship with a well-known default admin password. Before deployment the FIRST step is to:
- Expose them to the internet
- Change the default credentials (correct answer)
- Share the password widely
- Leave settings untouched
Default credentials are public and a top IoT risk, so change them first, then update firmware, disable unused services, and segment IoT onto its own isolated network/VLAN.
4. A company issues corporate phones and must enforce encryption and remotely wipe a device if it's lost. Deploy:
- A network traffic load balancer
- A mobile device management (MDM) platform (correct answer)
- A host-based firewall only
- A cloud password vault service only
MDM enrolls devices to enforce policy (encryption, passcode, app control) and remotely lock/wipe lost devices. For company-owned phones a full wipe is appropriate; for BYOD use a selective/container wipe.
5. A team wants repeatable, human-readable runbooks that automatically enrich alerts and open tickets to speed response. This capability is:
- A spam filter
- Security orchestration, automation and response (SOAR) (correct answer)
- A UPS battery
- A scheduled rotation of the physical backup storage media set
SOAR uses playbooks to automate and orchestrate response tasks (enrichment, ticketing, containment), reducing manual toil and mean time to respond. It complements the SIEM which detects and correlates.
6. A pipeline automatically tests, scans and deploys code on every commit with security checks built in. Adding security throughout is:
- Manual quarterly releases
- Security added only at the end
- DevSecOps (shift-left security) (correct answer)
- Skipping tests to ship faster
Integrating security testing/scanning throughout CI/CD (shift-left) is DevSecOps, catching issues early and continuously rather than bolting security on at the end. It reduces cost and risk of late-stage vulnerabilities.