A hardening review finds that a file server is listening for FTP and Telnet, although nobody uses either service; administrators connect with SSH and users access shares over SMB. Which action most effectively reduces the server's attack surface?
Select an answer to reveal the explanation.
Short Explanation
Every open service is a door, and you've got two doors nobody even walks through. Changing the port number just moves the door; an IDS just watches it. If you don't need it, turn it off -- that's attack surface reduction in one line.
Full Explanation
Open ports and running services are part of a system's attack surface, because each listening service can be probed, brute-forced or exploited. Services that serve no business purpose add risk with no benefit, and FTP and Telnet are particularly concerning because both transmit credentials in cleartext. Disabling and removing unused services is a core hardening step that eliminates the exposure rather than managing it. Moving the services to nonstandard ports is security through obscurity: scanners identify services by their responses on any port, so the exposure remains. Claiming unused services draw no attack traffic is false, because automated scanning targets any reachable service regardless of whether legitimate users rely on it. Adding intrusion detection signatures provides visibility into attacks against the services but leaves both exposed; detection is valuable, yet it does not reduce the attack surface the question asks about. Exam caveat: compare listening services against a documented baseline, because unexpected services can also indicate compromise rather than mere misconfiguration. Operational check: disable and uninstall the two services, confirm with a port scan that only the required ports remain open, and update the server's hardening baseline so the services stay off after future rebuilds.