At go-live the appliance still has five protocols enabled from months of compatibility testing, while the approved design calls for only three. What is the right post-deployment action on the unused services?
Select an answer to reveal the explanation.
Short Explanation
Every port left open from testing is a door you no longer remember unlocking. Unused services should be off, not firewalled or hidden - disable them, document it, and keep a clean path to re-enable if a real need ever shows up. Minimal surface is a decision made at cutover, not a wish later.
Full Explanation
DD OS services are enabled individually, so the enabled set is a decision that should match the approved design, and cutover hygiene audits what runs against what was planned. Every testing-era service is a listener taking connection attempts, an attackable authentication surface, and a patch obligation - with no owner and no use case. Disabling is reversible; an omission discovered later is re-enabled in a change window. Waiting for complaints keeps the surface open: unused is not unreachable, and automated attackers scan every standard port regardless. Firewall blocks cover one path while the service keeps listening on every other route - replication links, management neighbors, future integrations - and drift silently reopens the hole; disabling is the durable control. Obscure ports are security by invisibility: scanners sweep full port ranges routinely, so a hidden listener is one scan from exposure, and nonstandard porting breaks legitimate use later. Exam caveat: disable one service at a time with rollback ready, and confirm no backup application touches the service for occasional validation paths before removing it. Operational check: produce the enabled-services list, diff it line by line against the approved design, disable the extras in a change window, then rerun application connectivity tests.