220-1102 Question 537
Single answerChange default passwordsA technician is deploying several new wireless access points and a small business firewall at a branch office. During setup, the technician notices the devices still use the vendor's default administrator usernames and passwords printed in the quick-start guide. The office manager wants the network online quickly and suggests changing the passwords later after users are connected. Which action should the technician take FIRST to follow security best practices while completing the deployment?
- A
Change the default administrator passwords on each device before placing them into production
- B
Leave the default passwords in place temporarily, but disable SSID broadcast until the end of the day
- C
Connect the devices now and rely on the firewall's default rules to protect the management interfaces
- D
Document the default passwords in the asset inventory so the IT team can update them during the next maintenance window
Show answer and explanation
Correct answer: A
Explanation
The correct first step is to change default administrator passwords before the devices are placed into production. One of the most basic security hardening practices in A+ Core 2 is removing default credentials because they are widely known from vendor manuals, support sites, and attacker wordlists. This applies to network devices, embedded systems, printers, cameras, and other appliances. Industry guidance from organizations such as NIST and CISA consistently emphasizes eliminating default passwords as part of secure configuration and initial device hardening. In a real deployment, the technician should set strong unique administrative passwords, document them securely according to company policy, and then continue with the rest of the configuration.
- A. Correct.
Correct. Default credentials are publicly known or easily searchable and are a common target for attackers. Best practice is to change default administrative passwords immediately during installation, before the devices are exposed to users or the network. This reduces the risk of unauthorized access to management interfaces and is a standard hardening step for routers, firewalls, access points, printers, IoT devices, and other infrastructure.
- B. Incorrect.
Incorrect. Disabling SSID broadcast does not secure the device's administrative account or management interface. Attackers on the local network or anyone with physical access could still attempt to log in using the known default credentials. Hidden SSIDs are not a substitute for changing default passwords.
- C. Incorrect.
Incorrect. Firewall rules do not eliminate the risk of using default administrator credentials. Management access may still be available from internal networks, and many attacks come from insiders, misconfigurations, or malware already inside the environment. Device hardening should start with changing default credentials.
- D. Incorrect.
Incorrect. Documenting credentials can be part of asset management, but leaving default passwords unchanged until a later maintenance window creates an unnecessary security gap. The immediate priority is to replace vendor defaults with strong unique passwords before production use.