hardMultiple ChoiceObjective-mapped
SSCP Practice Question: Is migrating from on-premises servers to a cloud…
An organization is migrating from on-premises servers to a cloud IaaS model. The security team must ensure that virtual machine (VM) images are hardened before deployment. Which of the following is the MOST effective control to ensure consistency and compliance with security baselines?
⚠ Common exam trap
A common mix-up: candidates choose vulnerability scanning or patching because they focus on security after deployment, missing the core principle that proactive, immutable infrastructure via golden images is the most reliable way to enforce consistent baselines at scale.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a golden image that is hardened and approved for use, and deploy VMs from that image
Creating a golden image that is hardened and approved for use ensures that every VM deployed from it inherits a consistent, pre-configured security baseline. This approach eliminates configuration drift and manual errors by baking security controls into the image before deployment, making it the most effective control for consistency and compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform vulnerability scans on each VM after deployment
Why it's wrong here
Post-deployment scanning detects issues but does not prevent them from being deployed.
- ✗
Apply the latest OS patches to each VM immediately after deployment
Why it's wrong here
Patching is only one aspect of hardening; configuration settings are also critical.
- ✓
Create a golden image that is hardened and approved for use, and deploy VMs from that image
Why this is correct
A golden image enforces a consistent secure baseline from the start.
- ✗
Train administrators on hardening procedures and rely on manual configuration
Why it's wrong here
Manual configuration is error-prone and inconsistent.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.