A vulnerability scan of newly launched IaaS virtual machines shows default services listening on many ports, including remote administration and file sharing services the workload does not use. What is the most appropriate system protection measure?

System protection for IaaS workloads is a customer responsibility, because the provider secures the physical hosts and hypervisor while the customer manages the guest operating system and everything above it. Hardening reduces attack surface by removing or disabling services, packages and accounts the workload does not need, applying a security baseline such as a CIS Benchmark, and enabling a host-based firewall that permits only required inbound ports. Building the hardened configuration into the base image ensures every new instance starts secure rather than being fixed afterward. Relying on the provider's default security group settings misreads shared responsibility; the provider does not harden guest operating systems in IaaS, and network filtering, while valuable as an additional layer, does not remove vulnerable services from the host. Scheduling recurring scans and recording open ports as a baseline normalizes the exposure instead of reducing it; detection without remediation leaves the services reachable. Encrypting volumes protects data at rest from offline access, but running services serve decrypted data to anyone who can authenticate or exploit them, so encryption does not address exposed services. Exam caveat: defense in depth pairs host hardening with network security groups; neither substitutes for the other. Operational check: rescan an instance launched from the hardened image and confirm only the documented required ports respond.