A security team wants to harden Windows endpoints by disabling unnecessary services. Which service is commonly exploited for lateral movement and should be disabled on workstations where it is not needed?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — disabling the SMB Server service on workstations that don't need to share files or printers cuts off a common lateral movement path used by PsExec and worms. You keep Windows Update, Defender, and DNS Client enabled because they protect and support the endpoint rather than expose it.
Full Explanation
The SMB Server service enables file and printer sharing; disabling it on workstations that do not need to serve shares eliminates a common lateral movement vector exploited by tools like PsExec and worm propagation. Disabling Windows Update creates a patch management gap that introduces more risk than it reduces. Disabling Windows Defender removes endpoint antivirus protection. The DNS Client caches DNS resolutions; disabling it can cause performance issues and is not a common exploit path.