220-1102 Question 551
Single answerDisabling unused portsA technician is hardening several shared Windows 11 workstations in a front-desk area. The systems are used only for web-based scheduling and do not require Bluetooth, infrared, or removable storage devices. Management is concerned about users connecting unauthorized peripherals or copying data to external devices. Which action is the BEST way to reduce this risk while keeping the systems functional for their intended purpose?
- A
Disable unused hardware ports and interfaces in UEFI/BIOS or through device management policies
- B
Enable file and printer sharing only for administrators
- C
Configure the workstations to obtain IP addresses automatically from DHCP
- D
Increase the local password complexity requirements for all users
Show answer and explanation
Correct answer: A
Explanation
The best answer is to disable unused ports and interfaces because the scenario is specifically about reducing the chance of unauthorized peripherals being connected and preventing data from being copied to external devices. For A+ Core 2, this aligns with security best practices for endpoint hardening: disable features and services that are not required for business use. Examples include disabling unused USB functionality, Bluetooth, infrared, or other onboard ports when they are not needed. This follows the principle of least functionality, a common security concept also reflected in industry guidance such as CIS Controls and NIST hardening practices, which recommend minimizing unnecessary services, devices, and attack surfaces. The other options may be valid security or administrative tasks, but they do not directly solve the problem of unused ports and interfaces.
- A. Correct.
This is correct. Disabling unused ports and interfaces such as USB storage, Bluetooth, and infrared is a standard endpoint-hardening measure that reduces the attack surface and helps prevent unauthorized device connections and data exfiltration. In practice, this can be done in firmware settings for onboard ports or through operating system and administrative policies, depending on the device and organization. This directly addresses the stated risk without affecting the workstation's web-based scheduling role.
- B. Incorrect.
This is incorrect. File and printer sharing settings relate to network resource access, not to preventing users from connecting unauthorized local peripherals or copying data to removable media. Someone might choose this because it sounds like a security control, but it does not address unused physical or wireless interfaces.
- C. Incorrect.
This is incorrect. DHCP configuration determines how the workstation receives network settings. It has no meaningful impact on whether users can plug in removable devices, use Bluetooth, or access disabled hardware interfaces. This is a plausible distractor because it is a common administrative setting, but it is unrelated to port hardening.
- D. Incorrect.
This is incorrect. Strong passwords are an important security best practice, but they do not prevent a user from attaching unauthorized devices to available ports or using enabled local interfaces. A candidate might pick this because it improves overall security, but it does not specifically mitigate the risk described in the scenario.