220-1102 Question 497
Single answerHardening techniquesA small accounting firm is preparing a Windows 11 laptop for a seasonal employee who will only use a web-based tax application and Microsoft Teams. The technician must reduce the attack surface without breaking the employee's required tasks. Which action is the BEST hardening step to implement first on this laptop?
- A
Disable unnecessary startup applications and uninstall unused software
- B
Give the employee local administrator rights so approved software updates can be installed quickly
- C
Turn off User Account Control so prompts do not interrupt the employee's work
- D
Disable Microsoft Defender Firewall because the laptop is used mostly inside the office network
Show answer and explanation
Correct answer: A
Explanation
The best answer is to disable unnecessary startup applications and uninstall unused software because hardening focuses on minimizing the attack surface while preserving required functionality. For a user who only needs a web app and collaboration software, removing unnecessary applications is a practical, low-impact control. Other common hardening practices include using standard user permissions, enabling host-based firewalls, keeping anti-malware protections enabled, applying updates, and disabling unused services or features. This aligns with widely accepted endpoint security guidance from Microsoft security baselines and the principle of least privilege: keep only what is needed, restrict what is not, and leave protective controls enabled.
- A. Correct.
Correct. Removing unused software and disabling unnecessary startup applications is a core hardening technique because it reduces the system's attack surface. Fewer installed applications and background processes mean fewer vulnerabilities, fewer exploitable services, and less opportunity for persistence by unwanted software. In this scenario, the employee only needs a browser and Teams, so eliminating unneeded applications is an appropriate first step that supports the required business use.
- B. Incorrect.
Incorrect. Granting local administrator rights weakens security rather than hardening the device. Standard user access is a security best practice because it limits the ability to install unauthorized software, change security settings, or execute malware with elevated privileges. A user might choose this option because it sounds operationally convenient, but convenience does not equal hardening.
- C. Incorrect.
Incorrect. User Account Control helps prevent unauthorized system-level changes by requiring elevation for administrative actions. Disabling it removes an important layer of defense and makes it easier for malicious or unintended changes to occur silently. Someone might choose this option to reduce interruptions, but reducing prompts is not a valid security hardening reason.
- D. Incorrect.
Incorrect. Disabling the host firewall is the opposite of hardening. Endpoint firewalls provide protection even when a device moves between networks or when threats originate from inside the local network. An office network is not inherently trusted, and best practice is to keep the firewall enabled with appropriate rules.