Before publishing golden images for citizen-facing VMs, a city removes unnecessary services, closes unused ports, and disables default accounts. What is the primary security goal of these steps?
Select an answer to reveal the explanation.
Short Explanation
Every extra service and open port is another window left unlocked on the VM. Strip the fluff, shut unused doors, and kill default accounts so attackers have less to grab. That is hardening—shrink the attack surface before the image ever goes live.
Full Explanation
Hardening images reduces attack surface by removing unnecessary services, closing unused ports, and disabling default accounts before VMs face citizens. Those steps shrink what adversaries can probe or abuse on newly launched municipal workloads. Smaller surface area is a primary goal of secure image preparation.
Increasing the number of listening services to improve compatibility testing expands exposure. Keeping factory default passwords so imaging matches vendor media leaves known credentials in production. Exposing management ports to the Internet so vendors can patch without VPN increases remote attack opportunities.
Exam caveat: hardening is necessary but must be paired with patching cadence and least privilege; a hardened but unpatched image still ages poorly. Golden images should be scanned after hardening.
Operational check: build the image with unnecessary packages removed, verify few listening ports, confirm default accounts disabled/passwords randomized, run CIS/vuln scans, then publish for citizen-facing launch templates. Retest after each image refresh.
Automate a post-build smoke test that fails image publication if unexpected listening ports or default accounts reappear, keeping municipal golden-image hardening from regressing under package updates.