SY0-701 Question 146
Single answerA company is preparing 50 newly imaged laptops for remote employees. During a security review, the administrator finds that the standard image includes an old FTP client, several unnecessary remote administration tools, and a local administrator account that still uses the vendor's default password. The laptops must still allow users to access approved cloud applications over the internet, but management wants to reduce the risk of compromise before deployment. Which action would BEST address the most immediate hardening weaknesses on these endpoints?
- A
Enable full-disk encryption on all laptops
- B
Install endpoint protection and rely on it to block misuse of the existing tools
- C
Change the default local administrator password and remove the unnecessary software
- D
Configure a host-based firewall to allow only outbound HTTPS traffic
Show answer and explanation
Correct answer: C
Explanation
The best choice is to change the default local administrator password and remove unnecessary software because the scenario specifically identifies these as current weaknesses on the laptops. Security hardening guidance commonly emphasizes reducing attack surface, enforcing least functionality, and eliminating default credentials before systems are placed into production. Vendor default passwords are widely targeted by attackers, and unnecessary services or applications increase exposure without providing business value. While other controls listed in the options, such as full-disk encryption, endpoint protection, and host-based firewalls, are all valid endpoint hardening techniques, they do not most directly resolve the immediate findings described. This aligns with common best practices from sources such as NIST SP 800-123 for system security configuration and NIST SP 800-53 controls addressing configuration management, least functionality, and authenticator management.
- A. Incorrect.
Full-disk encryption is an important hardening control because it protects data at rest if a laptop is lost or stolen. However, it does not remediate the identified immediate weaknesses of default credentials and unnecessary software that increase the attack surface and likelihood of compromise. Encryption is valuable, but it is not the best answer to this specific scenario.
- B. Incorrect.
Endpoint protection is an important layer of defense and can detect malware or suspicious behavior, but it should not be used as a substitute for basic hardening. Leaving default passwords in place and retaining unnecessary administrative tools violates least functionality and creates preventable risk. This option reflects a common misconception that security software can compensate for poor baseline configuration.
- C. Correct.
This is the best answer because it directly addresses two high-priority hardening issues that were explicitly identified: default password changes and removal of unnecessary software. Changing vendor default credentials helps prevent trivial unauthorized access, and removing unused FTP and remote administration tools reduces the endpoint attack surface and limits opportunities for abuse. These are foundational hardening steps prior to deployment.
- D. Incorrect.
A host-based firewall is a useful hardening control, but allowing only outbound HTTPS traffic may break legitimate business functions and does not directly fix the exposed default local administrator password or the presence of unnecessary software. In addition, some cloud services may require other approved ports or supporting services. This option focuses on network restriction rather than the most immediate configuration weaknesses.