Req 2.2.4 is about configuring security parameters. How should you verify these parameters?

Req 2.2.4 is about configuring security parameters. How should you verify these parameters?

• A. Interview admins and review config standards to verify common security param settings are included
• B. Document only some parameters
• C. Ignore config standards
• D. Change security params randomly

Answer: (A)

Verifying security parameters relies on having a clear, approved baseline and confirming that it’s actually applied in practice. The best way to do this is to interview administrators to understand what settings are prescribed and why, and to review the official configuration standards to ensure those common security parameter settings are indeed included and covered by policy. This dual approach shows that there’s both a documented expectation and real-world implementation, which is essential for consistent, repeatable security across environments. Documenting only some parameters misses breadth and leaves gaps in coverage. Ignoring the configuration standards means there’s no baseline to verify against, so you can’t reliably judge whether settings meet policy. Changing security parameters randomly is unsafe and does not provide a valid verification of proper configuration.

Verifying security parameters relies on having a clear, approved baseline and confirming that it’s actually applied in practice. The best way to do this is to interview administrators to understand what settings are prescribed and why, and to review the official configuration standards to ensure those common security parameter settings are indeed included and covered by policy. This dual approach shows that there’s both a documented expectation and real-world implementation, which is essential for consistent, repeatable security across environments.

Documenting only some parameters misses breadth and leaves gaps in coverage. Ignoring the configuration standards means there’s no baseline to verify against, so you can’t reliably judge whether settings meet policy. Changing security parameters randomly is unsafe and does not provide a valid verification of proper configuration.