Which approach reduces the attack surface by applying secure configuration baselines (for example CIS benchmarks) through centralized management tools like GPOs or scripts?

• A. Applying secure configuration baselines via GPOs or scripts
• B. Disabling security tools to improve performance
• C. Ignoring baseline recommendations
• D. Manual ad hoc changes to configs

Answer: (A)

Applying secure configuration baselines through centralized management tools like GPOs or scripts is the approach that reduces the attack surface. By enforcing recognized baselines (such as CIS benchmarks) across all endpoints, you minimize configuration drift and ensure consistent, auditable security settings on every machine. Group Policy Objects push and enforce settings at scale, while scripts can automate additional secure configurations where needed, making it easier to maintain a hardened posture over time. This centralization means fewer misconfigurations, more reliable compliance, and quicker detection of deviations, all of which shrink opportunities for attackers.

Disabling security tools removes essential controls and creates obvious vulnerabilities. Ignoring baseline recommendations leaves systems exposed to known weaknesses. Manual ad hoc changes lead to inconsistent configurations and drift, undermining the goal of a uniform, hardened environment.