Hardening shows up on SY0-701 as a set of lists. Establish a baseline. Deploy it. Keep it in place. Patch things. Segment things. Least privilege. Rip out whatever nobody uses. You can learn all of that in an evening and still get the questions wrong, because the exam is rarely asking you to recite a technique. It hands you a network that was configured correctly at some point, then asks what has happened since.
Below is the material that keeps costing people points, and the shape each question tends to take.
The jump server is one door you built on purpose
Professor Messer defines a jump server as a device on the inside of your network that is accessible from the outside. An administrator connects to the jump server first, and from there SSHes on to the actual web server to change a config. That is the whole mechanism.
The part people skip is why anybody would want that. Nobody adds a hop for fun. You are collapsing a hundred possible entry points into one, so you have a single box to harden, a single box to log, a single box to put multifactor in front of. That server is a deliberate way in, and its value is exactly proportional to how well you defend it.
Which is why the exam question is almost never what the thing is. It is closer to: you have a jump server, now what? Someone unauthorized who gets on that box is already inside, and can reach the devices behind it. So the right answers cluster around restricting who can reach it, strong authentication on it, and logging what happens there. Wrong answers tend to hand you more infrastructure instead.
The distractor to watch is the proxy. A forward proxy sits between your internal users and the internet and makes outbound requests on their behalf. Administrative access coming in is the jump server's job. If the stem is about employees browsing the web, you want the proxy. If it is about admins reaching servers they cannot touch directly, you want the jump server. Direction is the whole tell.
A baseline has three verbs, and the questions live in the third
Establish the baseline. Deploy the baseline. Maintain the baseline.
Establishing means you do not invent it. You get a starting configuration from the application developer or from the operating system manufacturer, then modify it to fit your organization. Deploying means an automated process rather than a person walking desk to desk, so Active Directory group policy for the Windows fleet, an MDM for the phones, something like the Microsoft Security Compliance Toolkit as a central console.
Then comes the third verb, and it is where the points are. Maintaining means you keep checking that the baseline is still in effect and you audit for it. You revisit it when a new vulnerability shows up, or when the application itself gets updated.
Notice what that does to a scenario. Suppose a stem describes machines that were built to standard and now differ from each other. Did deployment fail? No. The organization deployed once and never audited, which is why continuous monitoring or a configuration audit is the answer and reimaging is not, since reimaging fixes today and changes nothing about month seven.
The words stay the same until the device changes
Hardening techniques repeat across every target. Install patches. Use least privilege. Get rid of unused software and accounts. Change default credentials. Put an EDR agent on it. Segment it. Reading the objectives, it looks like one list applied nine times.
The difference is what each device is allowed to do.
A workstation or a server can take patches on a schedule, so patching and least privilege and endpoint protection are all live answers there. A mobile fleet gets an MDM that pushes settings and updates out. Network gear gets its default credentials replaced and its authentication pointed at a central server.
Then you reach equipment that cannot be treated that way. ICS and SCADA systems run a factory floor or a power system, and the standard advice there is an air gap, no internet connectivity and severely restricted access. Real time operating systems get isolated and stripped back to the minimum services they need. Embedded systems and IoT devices go behind their own firewall on their own network segment.
So a stem puts you in front of a controller running a production line, and the tempting answer is to apply the latest update. That is the question. Availability is the constraint on that equipment, and the exam knows it, so the control shifts from patching to isolation.
Default credentials are the free point
Somewhere in your exam there is a question that resolves to changing the default password on an appliance. Switches and routers ship with credentials printed in a manual anybody can download. It is the least interesting item in the objectives and one of the most reliably tested. Do not let it fall out of your head just because it seems obvious.
What to do with this
Take any hardening item and ask two things. What is it protecting? And what does it take to keep that in place next quarter? The second question is what exam scenarios get built around, because that is where real organizations actually fail, and a maintenance failure is more interesting to write a question about than an installation.
If you want to know whether this material is landing, the free diagnostic at secplusmastery.com/diagnostic will tell you which domains are carrying you and which ones are not, and the rest of secplusmastery.com has practice questions and labs for whatever comes back weak.
Top comments (0)