Exam SY0-601 topic 1 question 196 discussion

CIS Benchmarking -> CIS Benchmarks from the Center of Internet Security (CIS) are a set of globally recognized and consensus-driven best practices to help security practitioners implement and manage their cybersecurity defenses.

It is A

In addition to frameworks, you can also use various guides to increase security. This includes benchmarks or secure configuration guides, platform- or vendor-specific guides, and general-purpose guides. On the surface, this is quite simple. When configuring Windows systems, use a Windows guide to identify secure settings. When configuring Linux systems, use a Linux guide.

Benchmarks are used to test your systems against, they can't be used either as update tools, nor as guidelines.

Why wouldn't it be C. Regional regulations? Everything else is best practices, recommendations, etc. but not required by law and thus wouldn't technically be a compliance issue.

The best option to use for updating and reconfiguring the OS-level security configurations in this scenario would be CIS (Center for Internet Security) benchmarks. CIS benchmarks are widely recognized as authoritative guidelines for secure configuration settings for various operating systems, software, and network devices. CIS benchmarks are developed through a consensus-based approach involving experts from various industries and government organizations. They provide detailed and specific guidance on secure configuration settings, including hardening standards, for different platforms. By following CIS benchmarks, organizations can improve their security posture by aligning their systems with industry-accepted best practices.

CIS Benchmarks for mobile devices cover security configurations for operating systems that run on mobile phones, tablets, and other hand-held devices. ISO/IEC 27001 is an Information security management standard that structures how businesses should manage risk associated with information security threats; The General Data Protection Regulation sets guidelines for the collection and processing of personal data of individuals within the European Union; its about how organizations should handle the personal data of individuals