An organization has too many variations of a single operating system and needs to standardize the arrangement prior to pushing the system image to…

A baseline configuration is a standardized level of security and performance for a

system, which serves as a starting point for all systems of that type. Before pushing a

system image, establishing a baseline configuration ensures that all deployed instances

of the operating system are consistent, secure, and meet organizational standards. This

directly addresses the need to "standardize the arrangement" of the operating system.

· A. Standard naming convention: While important for management and

organization, a naming convention does not standardize the operating system's actual

configuration or arrangement. It's an administrative task, not a technical configuration

step for the OS itself.

· B. Mashing: This term is not standard terminology for operating system

configuration or standardization. It's more commonly associated with web

development (mashups) or data integration, making it irrelevant in this context.

· C. Network diagrams: These visually represent the network infrastructure, detailing

how devices are connected. They are crucial for network management but do not

define or standardize the internal configuration of an operating system.

· National Institute of Standards and Technology (NIST):

o NIST Special Publication 800-128, "Guide for Security-Focused Configuration

Management of Information Systems."

Section 2.1 defines configuration baseline: "A defined and documented set of

specifications for an information system, or a component of an information system, that

serves as a basis for future builds, releases, and changes to the system."

URL: https://doi.org/10.6028/NIST.SP.800-128 (Specifically, PDF page 10)

o NIST Special Publication 800-70 Rev. 4, "National Checklist Program for IT

Products: Guidelines for Checklist Users and Developers."

Section 1.2 discusses security configuration baselines: "Security configuration baselines

(also called security configuration guidance, lockdown guides, hardening guides, or

security benchmarks) are documented, formally reviewed and agreed-upon sets of

configurations for a specific IT product or platform."

URL: https://doi.org/10.6028/NIST.SP.800-70r4 (Specifically, PDF page 2)

· Microsoft Documentation:

o "Security baselines" - While focused on security, the concept of a baseline is

fundamental to standardization.

Page: Security baselines in Microsoft Intune. Describes security baselines as pre-

configured groups of Windows settings that help apply known security recommendations.

This aligns with standardizing a configuration.

URL: https://learn.microsoft.com/en-us/mem/intune/protect/security-baselines

· CIS (Center for Internet Security) Benchmarks:

o CIS Benchmarks are consensus-based configuration guidelines for various operating

systems and technologies. They exemplify the creation and use of baseline

configurations.

o URL: https://www.cisecurity.org/cis-benchmarks/ (The entire concept of CIS

Benchmarks is about establishing secure baselines.)