問題文
A team adopts an external security benchmark for their clusters. What is the primary value of using such a benchmark rather than writing every control from scratch?
選択肢
- It removes the need to understand the underlying mechanisms, with the reviewers of the benchmark having already considered the interactions between the settings that it recommends.
- It supplies a reviewed baseline of concrete settings, so the team can start from an agreed reference and spend its effort on the parts that its own context requires.
- It guarantees that the cluster will not be compromised and no further review is required.
- It replaces the need for a threat model and the team can skip that exercise entirely.