A security team wants to harden Windows endpoints by disabling unnecessary services. Which service is commonly exploited for lateral movement and should be disabled on workstations where it is not needed?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the SMB Server service enables file and printer sharing; disabling it on workstations that do not need to serve shares eliminates a common lateral movement vector exploited by tools like PsExec and worm propagation. A is wrong because disabling Windows Update creates a patch management gap that introduces more risk than it reduces.
Full explanation below image
Full Explanation
B is correct because the SMB Server service enables file and printer sharing; disabling it on workstations that do not need to serve shares eliminates a common lateral movement vector exploited by tools like PsExec and worm propagation. A is wrong because disabling Windows Update creates a patch management gap that introduces more risk than it reduces. C is wrong because disabling Windows Defender removes endpoint antivirus protection. D is wrong because the DNS Client caches DNS resolutions; disabling it can cause performance issues and is not a common exploit path.