A hardening team is configuring a Windows server to minimize attack surface against credential theft. Which combination of settings BEST reduces exposure?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — d is correct because these controls directly target credential theft vectors: NLA prevents pre-authentication exposure, disabling LLMNR and NetBIOS prevents Responder-style MITM attacks, Credential Guard protects LSASS credentials in a virtualization-based security enclave, and LSA restrictions prevent credential dumping. B is wrong because AV and default firewall settings are insufficient for protecting against targeted credential theft techniques.
Full explanation below image
Full Explanation
D is correct because these controls directly target credential theft vectors: NLA prevents pre-authentication exposure, disabling LLMNR and NetBIOS prevents Responder-style MITM attacks, Credential Guard protects LSASS credentials in a virtualization-based security enclave, and LSA restrictions prevent credential dumping. B is wrong because AV and default firewall settings are insufficient for protecting against targeted credential theft techniques. C is wrong because renaming the Administrator account is security theater and screen lock does not protect in-memory credentials. A is wrong because BitLocker protects data at rest on disk and does not address credential theft from a running system.