An inventory finds six test databases restored from production copies over the past two years, still online with real customer data and old login accounts. No project uses them and their owners have confirmed they are no longer needed. Which action best reduces the attack surface?
Select an answer to reveal the explanation.
Short Explanation
Forgotten databases are the attic full of old paperwork with your Social Security number on it; nobody's watching, and burglars love attics. If nobody needs them, you get rid of them properly. Patching or hiding something you don't need still leaves it there to be found.
Full Explanation
Attack surface management includes identifying and removing assets that no longer serve a purpose. Stale test copies of production data are a common source of breaches because they hold real sensitive data while receiving less attention than production: old logins, missed patches and weak monitoring. Since the owners confirmed the databases are unneeded, the best action is to decommission them through change management, first retaining anything a retention policy requires and then securely deleting the databases, their backups and their login accounts. That removes the data and the entry points entirely. Patching them and keeping them online maintains the exposure and adds ongoing maintenance cost for systems with no business purpose. Renaming them and moving them to another port is obscurity; the data stays reachable and any scan will still find the listener. Disabling the old logins removes one path in, but the customer data remains online, other accounts or privileged users can still reach it, and the environment still has to be secured indefinitely. Exam caveat: test environments built from production data should use masked or anonymized copies so this risk does not arise. Operational check: confirm the databases, their backups and their logins are gone, and update the asset inventory.