A security engineer is hardening a Windows Server 2022 system. Which CIS Benchmark recommendation has the highest impact on reducing the attack surface for a web server role?
Select an answer to reveal the explanation.
Short Explanation
You've got to pick the recommendation that disables unnecessary services and roles, removes default shares, enables a restrictive Windows Defender Firewall ruleset, and applies least privilege to service accounts. That's what cuts off real exploitation paths, including SMBv1, so it reduces the web server attack surface the most.
Full Explanation
Disabling unnecessary services and roles (FTP, Telnet, SMBv1, RDP if not needed), removing default shares, enabling Windows Defender Firewall with a restrictive ruleset, and applying the Principle of Least Privilege to service accounts is correct because attack surface reduction — disabling unused services, protocols (SMBv1 is a known critical vulnerability vector), and removing unnecessary shares — directly eliminates exploitation paths; combining this with a restrictive host firewall and least-privilege service accounts provides the highest security gain. Setting the screen saver timeout to 15 minutes is wrong because screen saver timeout is a minor control with minimal security impact. Changing the Administrator account display name is wrong because renaming the Administrator account provides trivial obscurity that is easily bypassed by querying the account SID. Enabling Windows Error Reporting to send crash dumps to Microsoft is wrong because error reporting to Microsoft is a privacy and data exposure consideration, not a meaningful attack surface reduction.