A new server built from a vendor's default image goes live with the default administrator account enabled, sample web applications installed and several unused services listening on the network. Which action best reduces its attack surface?
Select an answer to reveal the explanation.
Short Explanation
A default build is like a new house with every window open and the spare key under the mat. Hardening means you close what you don't use and change what came from the factory. Logging and snapshots help after a break-in, but they don't shut a single window.
Full Explanation
Hardening reduces a system's attack surface by removing or disabling everything it does not need and changing insecure defaults. For this server that means disabling or renaming the default administrator account and setting strong credentials, uninstalling the sample web applications, stopping and disabling unused services, closing their listening ports and then applying a secure configuration baseline. Each removed component is one less thing an attacker can exploit. A load balancer distributes traffic for availability and capacity, but every server behind it would expose the same default account and services, so the attack surface is unchanged. Verbose logging improves detection and investigation by recording what happens to the default account, yet it does nothing to stop an attacker from using that account in the first place. A snapshot supports recovery after a compromise, which is valuable, but recovering to the same weak configuration simply restores the same exposure. Exam caveat: hardening is usually applied through a documented baseline or benchmark so every new build starts secure, rather than fixing servers one at a time after deployment. Operational check: run a port scan and a configuration scan against the server, confirm only required ports answer, confirm the default account is disabled, and compare the result against the organization's approved hardening baseline.