A security engineer is hardening a Windows Server 2022 system. Which CIS Benchmark recommendation has the highest impact on reducing the attack surface for a web server role?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because attack surface reduction — disabling unused services, protocols (SMBv1 is a known critical vulnerability vector), and removing unnecessary shares — directly eliminates exploitation paths; combining this with a restrictive host firewall and least-privilege service accounts provides the highest security gain. A is wrong because screen saver timeout is a minor control with minimal security impact.
Full explanation below image
Full Explanation
B is correct because attack surface reduction — disabling unused services, protocols (SMBv1 is a known critical vulnerability vector), and removing unnecessary shares — directly eliminates exploitation paths; combining this with a restrictive host firewall and least-privilege service accounts provides the highest security gain. A is wrong because screen saver timeout is a minor control with minimal security impact. C is wrong because renaming the Administrator account provides trivial obscurity that is easily bypassed by querying the account SID. D is wrong because error reporting to Microsoft is a privacy and data exposure consideration, not a meaningful attack surface reduction.