SY0-701 Question 145
Select 2A company is preparing 200 newly imaged Windows laptops for remote employees. During a pilot, a security review found that several laptops still had the vendor's default local administrator password, unnecessary remote-management software installed by the OEM, and multiple inbound services listening that are not required for business use. The company wants the MOST effective set of hardening actions to reduce the attack surface on these endpoints before deployment. Which TWO actions should the security administrator take first?
- A
Change the default local administrator passwords and remove the unnecessary OEM remote-management software
- B
Enable full-disk encryption and defer other changes until after deployment
- C
Disable unused ports/protocols and enforce a host-based firewall policy that blocks unnecessary inbound connections
- D
Install a host-based intrusion prevention system (HIPS) only, because it can replace other endpoint hardening controls
- E
Add endpoint protection software but keep the default passwords to simplify support during rollout
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are to change default passwords and remove unnecessary software, and to disable unused ports/protocols while enforcing host-based firewall rules. The scenario focuses on attack-surface reduction before deployment, so the highest-priority hardening actions are those that eliminate known weaknesses and unnecessary exposure. Changing default passwords addresses a critical authentication risk. Removing unneeded OEM software and disabling unneeded services follow the principle of least functionality, a common hardening best practice. Applying host-based firewall controls is particularly important for remote endpoints because protection must travel with the device, not depend solely on perimeter defenses.
Full-disk encryption is also a recommended control for laptops, but it primarily protects data at rest and does not remediate the immediate weaknesses identified in the pilot. Likewise, HIPS and endpoint protection are useful layers of defense, but they do not replace foundational hardening steps. Industry guidance from sources such as NIST SP 800-123 (Guide to General Server Security), NIST SP 800-41 (Guidelines on Firewalls and Firewall Policy), and CIS Benchmarks consistently emphasizes changing default configurations, removing unnecessary software/services, limiting exposed ports, and enforcing host-based firewall policies as core hardening measures.
- A. Correct.
Correct. Changing default passwords is a foundational hardening step because default credentials are commonly known, frequently targeted, and can enable immediate unauthorized access. Removing unnecessary OEM or preinstalled remote-management software also reduces attack surface by eliminating services and applications that are not needed for business operations and may introduce vulnerabilities or unmanaged listening services. This aligns with standard system-hardening guidance to change default configurations and uninstall unnecessary software before production use.
- B. Incorrect.
Incorrect. Full-disk encryption is an important protection for laptops, especially for lost or stolen devices, but it does not address the immediate exposure described in the scenario: default passwords, unnecessary software, and unneeded listening services. Deferring those changes leaves the systems vulnerable to local and remote compromise even if the disks are encrypted.
- C. Correct.
Correct. Disabling unused ports/protocols directly reduces the number of reachable services on each endpoint, and a host-based firewall provides policy-based control over inbound and outbound traffic regardless of network location. For remote laptops that will operate off the corporate network, host-based firewall rules are especially important because they continue to protect the device on home or public networks. Together, these actions meaningfully reduce exposure from unnecessary inbound services identified during the review.
- D. Incorrect.
Incorrect. HIPS can help detect or block malicious behavior on the host, but it is not a substitute for basic hardening such as removing unnecessary software, changing default passwords, disabling unused services, and configuring a host-based firewall. Defense in depth requires preventive hardening controls in addition to detection and blocking technologies.
- E. Incorrect.
Incorrect. Endpoint protection is valuable for malware detection and prevention, but keeping default passwords is a serious security weakness and contradicts basic hardening practice. Simplifying support is not a valid reason to leave known default credentials in place, since they materially increase the risk of compromise.