At a retailer, staff close an unused remote-desktop port on the registers, while a missing patch remains on the file server. What did closing that port reduce?

It reduced attack surface by closing an unused remote-desktop port on the registers is what changed. Attack surface is the set of ways in that you expose. An unused remote-desktop port on the registers was one of those ways. Closing it removes that exposure on the registers. The missing patch on the file server is a different machine and a different problem, and the scenario says that patch is still missing. It removed the missing patch on the file server, so that server weakness is gone claims the file-server weakness is gone. Closing a port on the registers does not install a fix on the file server, so that weakness remains exactly as it was. It is an exploit, working attack code aimed at the registers' remote-desktop service would mean the team ran attack code against the remote-desktop service. Closing an unused port is a reduction of exposure, not an exploit, and no attack code is described. It is a SOC metric such as time to detect or time to contain for the store names clocks the SOC uses, such as time to detect and time to contain. Those measure how an incident moved through the team. Closing a port is a change to what is exposed, not a measurement of response time. Exam caveat: reducing attack surface and removing a vulnerability are different jobs, and doing the first on one host does not finish the second on another host. Operational check: confirm the remote-desktop port no longer accepts connections on the registers, and separately confirm the file server still lacks the missing patch.