SSCP Risk Identification, Monitoring, and Analysis Practice Question
Which of the following is a primary purpose of implementing a security baseline such as the CIS Benchmarks?
⚠ Common exam trap
The exam often tests the distinction between a preventive control (security baseline) and detective/reactive controls (IDS, SIEM, SOAR), so candidates mistakenly choose options that describe monitoring or response functions instead of the foundational hardening purpose of a baseline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To establish a minimum level of security for system configurations
The primary purpose of implementing a security baseline such as the CIS Benchmarks is to establish a minimum level of security for system configurations. These benchmarks provide prescriptive, consensus-based configuration guidelines (e.g., disabling unnecessary services, setting file permissions, enforcing password policies) that reduce the attack surface and ensure a consistent, hardened starting point across all systems in an organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To automate incident response procedures
Why it's wrong here
CIS Benchmarks define secure configuration settings for systems; they contain no playbooks, triggers or orchestration to execute response actions. It tempts because baselines underpin detection and response maturity, but automating incident handling is the role of SOAR platforms or SIEM response workflows.
- ✓
To establish a minimum level of security for system configurations
Why this is correct
CIS Benchmarks define hardened configuration settings that every system must meet, so the baseline establishes a minimum security floor rather than a maximum or an optional target. This directly satisfies the stem's requirement for a primary purpose: consistent, documented minimum configuration across systems.
- ✗
To detect real-time threats
Why it's wrong here
Benchmarks specify hardened configuration states applied at build or audit time; they do not continuously monitor activity or correlate events to identify live threats. It tempts because hardened systems reduce attack surface, but real-time detection belongs to IDS, EDR or SIEM tooling.
- ✗
To comply with regulatory requirements for log retention
Why it's wrong here
CIS Benchmarks prescribe secure configuration settings, not retention periods or log lifecycle rules, so they cannot satisfy retention mandates. It tempts because benchmark compliance supports audit evidence, but log retention requirements are met through logging policy and SIEM storage configuration.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is a primary purpose of a security baseline, such as the CIS Benchmarks?
easy- ✓ A.To provide a secure configuration standard for systems
- B.To calculate annualized loss expectancy
- C.To replace the need for vulnerability scanning
- D.To detect intrusions in real-time
Why A: A security baseline like the CIS Benchmarks establishes a hardened, consistent configuration standard for operating systems, applications, and network devices. This reduces the attack surface by disabling unnecessary services, enforcing least privilege, and applying specific registry or file permission settings. It is a foundational step in secure system deployment and ongoing compliance.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.