In the context of a security baseline, what is the primary purpose of difference analysis?

• A. To update the baseline with new standards
• B. To estimate project costs
• C. To identify deviations between current configurations and the baseline
• D. To generate user reports

Answer: (C)

Difference analysis centers on spotting deviations between what is currently deployed and the approved security baseline. A baseline captures the expected, hardened configurations; comparing live systems to it reveals configuration drift, unauthorized changes, or misconfigurations that could raise risk. Finding these deviations enables prompt investigation and remediation, helping maintain a consistent security posture and regulatory alignment across all assets. It’s not primarily about updating the baseline with new standards, budgeting, or producing user reports.