A security team receives a penetration test report recommending 'removal of unnecessary services and applications.' On a Windows Server 2019 server, which method enforces this recommendation while minimizing the installed attack surface?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Windows Server Core minimizes the installed components (no GUI, fewer binaries, smaller attack surface), and removing unnecessary roles/features (IIS if not a web server, print spooler, etc.) directly eliminates potential exploitation points. A is wrong because Office applications on servers are themselves a misconfiguration; the recommendation is about system roles and services, not productivity applications.
Full explanation below image
Full Explanation
B is correct because Windows Server Core minimizes the installed components (no GUI, fewer binaries, smaller attack surface), and removing unnecessary roles/features (IIS if not a web server, print spooler, etc.) directly eliminates potential exploitation points. A is wrong because Office applications on servers are themselves a misconfiguration; the recommendation is about system roles and services, not productivity applications. C is wrong because disabling Windows Update prevents security patches, creating additional vulnerability risk rather than reducing attack surface. D is wrong because network isolation reduces exposure but does not remove the underlying unnecessary services that could be exploited by attackers who do gain access.