What Is Security baseline? Security Definition

Imagine you are building a new house. Before you start decorating or adding fancy furniture, you need to make sure the foundation is solid, the walls are straight, and the roof does not leak. A security baseline is exactly that for computers and networks. It is the absolute minimum set of security measures that must be in place before a system can be considered safe to use.

Think of it as the rulebook for setting up a new computer. When a company buys a hundred new laptops, they cannot just hand them out to employees and hope everyone sets them up securely. Some employees might forget to turn on the firewall, others might leave the default password, and some might install risky software. A security baseline prevents this chaos by defining exactly how each laptop must be configured before it leaves the IT department.

For example, the baseline might say: all laptops must have the operating system updated, the antivirus software must be active, the screen must lock after 5 minutes of inactivity, and the hard drive must be encrypted. These rules are not optional. They are the foundation of security. If you think of your computer like a castle, the security baseline is the moat, the drawbridge, and the strong walls. Without them, anyone could just walk in.

In the IT world, organizations use security baselines to make sure that every device, server, and network device follows the same security rules. This is important because a single weak link, like one server with a default password, can compromise the entire network. The baseline is usually created by security experts based on industry standards, such as those from the Center for Internet Security (CIS) or the National Institute of Standards and Technology (NIST). Once it is created, IT teams use tools to automatically apply the baseline to all systems, and they regularly check to make sure nobody has accidentally changed a security setting.

Even for home users, the idea of a security baseline is useful. It means doing the basic things: installing updates, using a strong password, enabling two-factor authentication, and not clicking on suspicious links. If everyone followed a simple personal security baseline, many cyberattacks would fail.

A security baseline is a formally documented set of security configuration parameters, settings, and rules that define the minimum acceptable security posture for a specific type of system, device, or software application. It serves as a reference point against which actual configurations are measured and audited. In enterprise environments, security baselines are critical for enforcing consistency, reducing attack surface, and ensuring compliance with regulatory frameworks such as PCI DSS, HIPAA, GDPR, and ISO 27001.

Security baselines are typically derived from industry-recognized hardening guides. The most widely used sources are the Center for Internet Security (CIS) Benchmarks, the National Institute of Standards and Technology (NIST) Special Publication 800-53, and the Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs). These guides provide detailed, platform-specific configuration recommendations for operating systems (Windows, Linux, macOS), network devices (routers, switches, firewalls), cloud services (AWS, Azure, GCP), and applications (web servers, databases, email servers).

The implementation of a security baseline involves several technical components. First, the baseline is defined in a machine-readable format, often using Group Policy Objects (GPO) in Active Directory environments, Desired State Configuration (DSC) in PowerShell, or Ansible playbooks for Linux servers. The baseline settings can cover hundreds of individual parameters, including password policies (minimum length, complexity, expiration), account lockout thresholds, audit logging configurations, service disablement (removing unnecessary services like Telnet or FTP), registry key modifications, file permission restrictions, and firewall rule sets.

Once the baseline is defined, it is deployed using configuration management tools such as Microsoft Endpoint Configuration Manager (formerly SCCM), Azure Policy, AWS Config Rules, or Puppet. These tools can enforce the baseline automatically, remediate any drift, and generate compliance reports. Continuous monitoring is essential because systems can drift from the baseline due to manual changes, software updates, or user actions. Security Information and Event Management (SIEM) systems like Splunk or Azure Sentinel can be configured to alert when a system falls out of compliance with the baseline.

In cloud environments, security baselines are often implemented through policy-as-code. For example, in AWS, a security baseline might be enforced using AWS Identity and Access Management (IAM) policies that restrict permissions, AWS Config rules that check for unencrypted S3 buckets, and AWS CloudTrail logs that monitor for changes to key security settings. Azure offers Azure Policy and Azure Blueprints to enforce baselines across subscriptions. These tools ensure that any new resource automatically inherits the baseline configuration, preventing configuration drift from the moment of deployment.

A key technical aspect of security baselines is the concept of baselining as an ongoing process. It is not a one-time activity. When new vulnerabilities are discovered, or when software updates introduce new security features, the baseline must be updated. For example, when the Log4j vulnerability emerged in 2021, many organizations had to update their security baselines to ensure all Java applications were using a patched version. This process is known as baseline management and is part of a larger vulnerability management program.

Security baselines also play a role in incident response. When a security incident occurs, investigators compare the compromised system against its known baseline to identify changes made by the attacker. If the baseline shows that a particular service should be disabled, but it was found running during the investigation, that is a strong indicator of unauthorized activity. In forensic analysis, the baseline serves as a trusted starting point for determining what has changed.

For exams like AWS SAA, AZ-104, MS-102, and SC-900, you need to understand that security baselines are not just for on-premises systems. They are equally important for cloud resources. For example, the AZ-104 exam covers Azure Policy and how it can be used to enforce a security baseline across Azure subscriptions. The AWS SAA exam includes AWS Config and its rules for checking resource compliance against a baseline. The CISSP exam emphasizes the importance of baselines in the context of security governance and risk management. The Security+ exam covers baselines as a core concept of secure system design and implementation.

In the real world of IT, security baselines matter because they prevent the most common cause of security breaches: human error and inconsistent configurations. When every system is set up differently, it is impossible to know if the environment is truly secure. A single misconfigured server, perhaps one with a default password or an open port, can be the entry point for an attacker to compromise the entire network. Security baselines eliminate this risk by ensuring that every system starts from a known secure state.

Security baselines also matter for compliance. Many industries are required by law to follow specific security standards. For example, healthcare organizations in the United States must comply with HIPAA, which requires that systems have safeguards to protect patient data. A security baseline demonstrates that the organization has implemented these safeguards. During an audit, the auditor will ask to see the baseline and the evidence that systems conform to it. Without a baseline, the organization cannot prove it is compliant.

From a practical standpoint, baselines make IT management easier. When a new system needs to be deployed, the IT team does not have to manually configure every security setting. They can apply the baseline automatically, ensuring that the system is secure from the moment it goes live. This saves time and reduces the chance of mistakes. It also makes troubleshooting easier because if a problem occurs, the IT team knows that the system's security settings are at least at the baseline level.

Another reason security baselines matter is incident response. When a security breach happens, the first question is always 'What changed?' By comparing the current state of a system to its baseline, investigators can quickly identify what an attacker modified. Without a baseline, they would have to guess what the original configuration should have been. This significantly slows down the investigation and can allow an attacker to remain undetected for longer.

For IT professionals who manage large environments, baselines are essential for maintaining security at scale. You cannot manually inspect each of thousands of servers. With automated baseline enforcement, you can trust that all systems are configured correctly. This is why security baselines are a core component of frameworks like the NIST Cybersecurity Framework and ISO 27001.

In the AWS SAA exam, you might see a question like this: 'A company wants to ensure that all EC2 instances launched in its AWS account have encryption at rest enabled by default. What is the most efficient way to enforce this?' The correct answer is to use AWS Config with a managed rule that checks for encryption, and to use an IAM policy that denies the creation of unencrypted volumes. This is a security baseline enforcement question. Another scenario: 'A security team has defined a baseline for Linux instances that includes disabling root login via SSH. How can this be applied to all new instances in an Auto Scaling group?' The answer is to use a launch template or a custom Amazon Machine Image (AMI) that already has the baseline applied, and to use AWS Systems Manager to enforce the baseline on running instances.

For the Security+ exam, a typical multiple-choice question might read: 'An organization needs to ensure that all Windows 10 workstations have the same security settings, including disabling guest accounts and setting minimum password length. Which of the following should the organization implement?' The correct answer is a security baseline applied via Group Policy. A performance-based question might ask you to order the steps for implementing a security baseline: define the baseline, test it in a staging environment, deploy it using GPO, monitor for drift, and update the baseline when needed.

In the CISSP exam, questions are more theoretical. For example: 'An organization has implemented a security baseline for its servers. After a routine audit, several servers are found to have different configurations than the baseline. What is this condition called?' The answer is configuration drift. A follow-up question might ask: 'What is the best way to detect and correct configuration drift?' The answer is continuous monitoring with automated remediation, often using a configuration management tool.

For the AZ-104 exam, you might get a scenario: 'You are an Azure administrator responsible for enforcing security baselines across multiple subscriptions. You need to ensure that all resources are compliant with the company's security policy. What should you use?' The answer is Azure Policy and Azure Blueprints. The question might then ask: 'A non-compliant resource is found. How can you automatically remediate it?' The answer is to use a policy with a DeployIfNotExists effect that triggers a remediation task.

In the MS-102 exam, a typical question: 'Your organization uses Intune to manage Windows 10 devices. You need to ensure that all devices meet the company's security baseline. Which configuration profile type should you use?' The answer is a security baseline profile, which is a pre-defined set of settings in Intune. Another question: 'Users are turning off BitLocker on their devices, causing a security risk. How can you enforce the baseline?' The answer is to configure a policy that requires BitLocker and to set up automatic enforcement using Intune's compliance policies.

For the CySA+ exam, a scenario-based question: 'A security analyst notices that a web server that is normally compliant with the baseline is now showing an open port 3306 (MySQL). The baseline states that no database ports should be open. What is the first action the analyst should take?' The correct action is to investigate the change because it might indicate an unauthorized configuration change or a compromise. The analyst should then check logs to see who made the change and revert the server to the baseline if it was unauthorized.

Let's dive into how security baselines work in practice for a common scenario: securing Windows 10 workstations in an enterprise environment. You are the IT security administrator, and you need to ensure that all 500 laptops and desktops in your organization are consistently configured.

First, you start with a trusted source. The Microsoft Security Compliance Toolkit provides pre-built baselines for Windows 10. These baselines include configurations for User Account Control (UAC), Windows Defender Firewall, BitLocker, and many other settings. You download the baseline and import it into the Local Group Policy Object (LGPO) tool. This gives you a set of registry keys and policy settings that you can review.

Before deploying, you need to decide how to distribute the baseline. In an on-premises Active Directory environment, the best method is to create a Group Policy Object (GPO) linked to an Organizational Unit (OU) that contains all the Windows 10 computers. You edit the GPO to include the settings from the baseline. For example, under Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy, you set the minimum password length to 14 characters and require password history of 24 passwords. Under Windows Defender Firewall with Advanced Security, you enable the firewall for all profiles and block inbound connections by default.

But there is a challenge: some users need to connect to a legacy file server that uses an older, less secure protocol. If you blindly apply the baseline, those users will lose connectivity. This is where you customize the baseline. You create a separate GPO for a 'Legacy App Users' OU that still enforces most of the baseline but allows the specific legacy protocol. You also create a risk acceptance document signed by management acknowledging the exception.

Once the GPOs are deployed, you need to monitor compliance. You use a tool like Microsoft Endpoint Manager (Intune) or a third-party tool like ManageEngine. These tools can scan each computer and compare its settings against the baseline. The report shows which computers are compliant and which have drift. For example, a user might have disabled the firewall to run a local game server. The monitoring tool flags the device as non-compliant.

In a modern, cloud-connected environment, you would use Intune. Intune has built-in security baselines for Windows 10 and Windows 11. You simply select the baseline version and choose which settings to include. Intune then pushes these settings to enrolled devices using a configuration profile. You can also set up compliance policies that check if the device is compliant with the baseline. If a device is non-compliant, you can automatically revoke access to corporate resources.

What can go wrong? The most common issue is breaking an application. For example, the baseline might require that all network shares be encrypted. If an older application uses an unencrypted connection, it will stop working. That is why testing is crucial. Another issue is user pushback. Users might complain that they cannot install software or that they have to use complex passwords. In this case, education is important: explain why these settings are necessary for security.

Professioals should also understand that baselines are not a 'set and forget' activity. When Microsoft releases a new version of the Windows 10 security baseline (usually twice a year), you need to review the changes, test them, and deploy them. If you ignore the updates, your baseline becomes outdated and may miss new protections or include deprecated settings.

Finally, remember that baselines are just one part of a defense-in-depth strategy. They should be combined with regular vulnerability scanning, patch management, endpoint detection and response (EDR), and user training. A baseline cannot stop a determined attacker who has compromised a user's credentials, but it can make the attacker's job much harder.

A security baseline is a predefined set of security configuration settings and policies that establish a minimum security standard for devices, systems, and applications within an organization. It serves as a foundational benchmark against which all systems are measured, ensuring that every device adheres to a consistent, hardened configuration that reduces risk exposure. In the context of device management, security baselines are particularly critical because endpoints such as laptops, desktops, and mobile devices are often the first line of attack from malicious actors.

The concept of a security baseline extends beyond simple password policies or firewall rules. It encompasses a holistic approach to security posture, including settings for operating system hardening, application whitelisting, network access controls, user permissions, encryption standards, logging configurations, and patch management. In enterprise environments, security baselines are typically developed based on industry best practices, regulatory requirements, and threat intelligence. Frameworks such as the Center for Internet Security (CIS) Benchmarks, National Institute of Standards and Technology (NIST) Special Publication 800-53, and Microsoft Security Baselines are widely adopted to guide organizations in building effective baselines.

For exam candidates preparing for certifications like AWS-SAA, ISC2-CISSP, CySA+, MD-102, MS-102, AZ-104, SC-900, and Security+, understanding security baselines is essential. These exams test not only the definition but also the practical implementation, monitoring, and remediation of baseline deviations. For example, in AWS, security baselines apply to EC2 instances, S3 buckets, and IAM roles, often enforced through AWS Config rules or Service Control Policies (SCPs). In Microsoft environments, security baselines are deployed via Group Policy, Intune, or Azure Policy to enforce consistent settings across Windows devices and cloud resources.

Security baselines also play a pivotal role in compliance audits. They provide a measurable way to demonstrate adherence to standards like PCI DSS, HIPAA, GDPR, and SOC 2. Without a baseline, organizations struggle to prove that security controls are in place and effective. Baselines enable automated compliance checks, reducing manual effort and human error. Tools such as Microsoft Defender for Cloud, AWS Security Hub, and CIS-CAT (Configuration Assessment Tool) continuously compare system configurations against the defined baseline and alert administrators to any drift.

a security baseline is not static. As new threats emerge, software updates are released, and business requirements evolve, baselines must be reviewed and updated periodically. This lifecycle management includes baseline definition, deployment, monitoring, assessment, and remediation. In exam questions, candidates may be asked to identify when a baseline should be updated or how to handle a device that falls out of compliance. The key takeaway is that a security baseline is the minimum acceptable security configuration; anything below that level is considered a vulnerability or risk.

Finally, security baselines are tightly integrated with device management solutions. In Microsoft Intune (covered by MD-102 and MS-102), administrators can create and assign security baseline policies to Windows 10/11 devices, controlling settings like BitLocker encryption, firewall rules, antivirus configurations, and user account control. On-premises Active Directory leverages Group Policy to enforce similar baselines. In cloud environments like AWS and Azure, baselines are enforced through infrastructure-as-code templates, ensuring that every new resource is provisioned with security in mind. Understanding these integration points is crucial for exam success and real-world implementation.

In the AWS ecosystem, security baselines are enforced through a combination of AWS Config rules, Service Control Policies (SCPs), and the AWS Well-Architected Framework. A security baseline in AWS defines the minimum security posture for resources such as EC2 instances, S3 buckets, IAM users, VPCs, and RDS databases. Unlike traditional on-premises environments, cloud baselines must account for shared responsibility, where the customer is responsible for securing their data and configurations.

AWS Config is the primary service for baseline monitoring and compliance. It allows administrators to define custom or managed rules that check resource configurations against compliance standards. For example, a security baseline might require that all S3 buckets have block public access enabled, that EC2 instances use only approved AMIs, or that IAM users have MFA enabled. AWS Config continuously evaluates resources and generates compliance reports, alerting administrators when a resource deviates from the baseline. This is a frequent topic in AWS-SAA and SC-900 exams, where candidates must understand how to set up and interpret compliance results.

Another critical component is AWS Organizations and SCPs, which act as a security baseline across multiple accounts. SCPs allow central governance by restricting the maximum permissions available to IAM roles and users within member accounts. For instance, a baseline SCP might deny all actions on resources unless they are tagged with an approved environment tag. This ensures that developers cannot accidentally launch unmonitored resources. Exam questions often test the difference between SCPs, IAM policies, and resource-based policies, especially in multi-account scenarios.

Security baselines in AWS also leverage AWS Security Hub, which aggregates findings from Config, GuardDuty, Inspector, and other services. Security Hub provides a consolidated view of compliance scores based on industry standards like CIS AWS Foundations Benchmark and NIST 800-53. Administrators can configure automated remediation actions using AWS Lambda functions or Systems Manager Automation. For example, if an EC2 instance is found to have an open SSH port to 0.0.0.0/0, a remediation action can automatically revoke the security group rule. This is a practical approach tested in CySA+ and Security+ exams, emphasizing the importance of automated response.

A common pitfall when implementing AWS security baselines is overly permissive IAM roles or misconfigured S3 bucket policies. The principle of least privilege is central to any baseline. AWS provides tools like IAM Access Analyzer to identify resources shared with external entities, which is a direct violation of many baselines. Another key area is encryption. A baseline should mandate that all data at rest uses AWS KMS with customer-managed keys and data in transit uses TLS 1.2 or higher. AWS Config rules like s3-bucket-server-side-encryption-enabled and ec2-encrypted-volumes enforce these settings.

In exam contexts, candidates are often presented with scenarios where a security baseline has been violated and asked to determine the appropriate response. For example, if a Config rule shows that an S3 bucket is publicly accessible, the correct answer might involve updating the bucket policy or enabling block public access settings. Understanding the relationship between baseline definitions, compliance checks, and remediation actions is essential. The AWS security baseline is dynamic; updates to the underlying standards or threat landscape may require changes to Config rules or SCPs. Candidates should also know how to use AWS CloudFormation or Terraform to deploy baseline configurations as code, ensuring repeatability and auditability.

Finally, AWS Security Hub integrates with third-party tools and SIEMs to provide a holistic view. The baseline compliance score is often a key metric in security dashboards. For those pursuing AWS-SAA or SC-900, remember that security baselines are not just about detection but also prevention. By enforcing baselines at account creation or resource provisioning, organizations can reduce the attack surface significantly. This proactive approach is a core concept tested across all the listed exams.

Microsoft Intune is a leading cloud-based device management solution that includes built-in security baseline policies for Windows 10 and later devices. These baselines are pre-defined sets of configuration settings curated by Microsoft security experts to enforce a hardened state out of the box. They cover critical areas such as BitLocker drive encryption, Windows Defender Antivirus, user account control (UAC), firewall rules, browser security, and application control. For exams like MD-102, MS-102, and SC-900, understanding how to deploy and manage Intune security baselines is critical.

The primary advantage of using Intune security baselines is that they are regularly updated as new threats emerge and best practices evolve. Microsoft publishes baseline versions (e.g., Security Baseline for Windows 10 May 2020, November 2022) and automatically notifies administrators when a new version becomes available. However, the baseline does not automatically apply; administrators must either assign a baseline to a group or import the settings into a custom policy. This distinction is often tested: a candidate must know that baselines are provided as templates, not automatically enforced, unless an administrator actively assigns them.

Each Intune security baseline policy contains hundreds of individual settings, but exam questions focus on the most impactful ones. For example, BitLocker encryption settings ensure that all drives, including fixed data drives and removable drives, are encrypted. Windows Defender Antivirus settings include real-time protection, cloud-delivered protection, and sample submission. UAC settings control when and how administrative privileges are elevated. Firewall settings typically enforce default inbound block and outbound allow rules, with specific exceptions for authorized applications. These settings collectively create a baseline that significantly reduces the risk of malware infection, data exfiltration, and unauthorized access.

Deploying an Intune security baseline is straightforward. Administrators navigate to the Endpoint Security node, select Security Baselines, choose a baseline template (e.g., Windows 10 Security Baseline), and assign it to Azure AD groups. The baseline can be customized by toggling individual settings, but the default configuration represents the recommended security posture. Once assigned, devices check in during their next sync and apply the settings. If a setting conflicts with an existing Configuration Manager or Group Policy setting, Intune settings take precedence, which is a key point for MD-102 and MS-102 exams.

One common exam scenario involves monitoring compliance. Intune provides a report on how many devices are compliant with the assigned baseline. Devices that are non-compliant may be blocked from accessing corporate resources via Conditional Access policies. For example, if a device fails to have BitLocker enabled, Conditional Access can prevent it from accessing Exchange Online or SharePoint. This combination of baseline enforcement and conditional access is a powerful security control tested in SC-900 and MS-102.

Troubleshooting baseline issues is another critical skill. If a Windows device fails to apply a baseline setting, the administrator should check the device sync status, review the Settings Catalog for conflicts, and examine the Windows event logs under Microsoft/Intune. A common cause of failure is that the device is not properly enrolled in Intune or that the user account lacks the necessary licenses (e.g., Microsoft 365 E3 or E5). Exam questions may present a scenario where a device shows as compliant but the actual configuration is incorrect, requiring the administrator to manually verify using the Microsoft Endpoint Manager console or the Windows Security app.

Finally, Intune security baselines are not limited to Windows. There are baselines for Microsoft Edge and also for Windows 365 Cloud PCs. For cross-platform management, Intune supports security policies for macOS, iOS, and Android devices, but these are not referred to as baselines in the same sense. Understanding the scope and limitations helps in answering exam questions about device management. The bottom line is that Microsoft Intune security baselines provide a fast, reliable way to enforce consistent security settings across thousands of devices, reducing the administrative burden and improving the overall security posture.

The Center for Internet Security (CIS) Benchmarks are globally recognized, consensus-based best practices for security configuration. They serve as a de facto security baseline for operating systems, cloud platforms, network devices, and applications. For professionals preparing for ISC2-CISSP, CySA+, Security+, and AZ-104, understanding CIS Benchmarks is essential because they are frequently referenced in exam objectives and real-world compliance frameworks. CIS Benchmarks provide detailed, step-by-step guidance on how to harden a system against known attack vectors.

Each CIS Benchmark is organized by technology and version. For example, CIS Benchmark for Windows 10, for Ubuntu Linux, for AWS Foundations, and for Microsoft Azure. The benchmarks are divided into levels. Level 1 recommendations are easy to implement with minimal impact on functionality and are considered a good starting point for any security baseline. Level 2 recommendations offer more advanced hardening but may reduce system usability or require more testing. In exam contexts, candidates are often asked to choose the appropriate level for a given environment. For example, for a server running critical applications, Level 1 is typically sufficient, while a highly sensitive environment like a government system may require Level 2.

CIS Benchmarks are updated regularly as new vulnerabilities are discovered and attack techniques evolve. Organizations that adopt CIS Benchmarks as their security baseline must have a process for periodically reviewing and updating their configurations. Automated tools like CIS-CAT (CIS Configuration Assessment Tool) can scan systems and compare them against the latest benchmark version, generating compliance reports. This automation is a key topic in CySA+ and Security+ exams, where candidates must interpret scan results and prioritize remediation actions.

A common exam question format presents a scenario where a company uses CIS Benchmark Level 1 for its Windows servers. An administrator notices that the server is failing a specific check related to password length. The correct response should involve identifying the failing setting, understanding its importance, and applying the appropriate Group Policy or Intune policy to enforce the required password length. CIS Benchmarks also include recommendations for logging, auditing, and disabling unnecessary services, all of which are foundational to a strong security posture.

For cloud environments, CIS Benchmarks for AWS and Azure are particularly relevant. The AWS Foundations Benchmark covers IAM, S3, logging (CloudTrail), VPC, and EC2. For instance, it recommends ensuring that S3 buckets have block public access enabled, that CloudTrail is enabled in all regions, and that IAM users require MFA. In AZ-104 and SC-900 exams, candidates must understand how Azure Policy can be used to enforce CIS Azure Foundations Baseline recommendations. Azure Policy definitions can be assigned at the management group level to ensure that new resources automatically comply with the baseline.

One challenge with CIS Benchmarks is that they can be overwhelming due to the sheer number of recommendations. Organizations must prioritize based on risk. Examining the CIS Controls (formerly Critical Security Controls) provides a high-level framework that maps to the benchmarks. For example, CIS Control #1 is Inventory and Control of Hardware Assets, which aligns with baseline recommendations for disabling unnecessary devices. CIS Control #7 is Continuous Vulnerability Management, which relates to regular scans against the baseline. This mapping is often tested in ISC2-CISSP exams, where candidates must connect controls to implementation.

Finally, it is worth noting that CIS Benchmarks are not mandatory by law, but they are widely adopted due to their alignment with other standards like NIST and PCI DSS. They provide a clear, actionable baseline that can be audited. For exam preparation, candidates should be familiar with the structure of CIS Benchmarks (levels, categories, scoring) and know how to use tools like CIS-CAT or cloud-native solutions (e.g., AWS Security Hub, Azure Security Center) to assess compliance. The ability to interpret a scan result and apply remediation is a skill that directly translates to passing questions on CySA+, Security+, and AZ-104.