A systems administrator is configuring Windows local group security baseline controls across newly deployed workstations. Match each workstation hardening policy control on the left to its corresponding primary risk mitigation on the right.
- Account Lockout Threshold PolicyMitigates automated brute-force password discovery attempts against user accounts.
- Disabling Unused Network Ports and ServicesReduces attack surface by blocking active listening channels and unneeded background daemons.
- Screen Lock Timeout with Re-authenticationPrevents unauthorized physical walk-up access to unattended active desktop sessions.
- Disabling AutoPlay and AutoRun featuresPrevents unauthorized code execution when malicious USB drives or optical disks are inserted.
Answer
Account Lockout Threshold Policy matches automated brute-force mitigation; Disabling Unused Network Ports and Services matches attack surface reduction of network channels; Screen Lock Timeout matches prevention of unattended physical access; Disabling AutoPlay/AutoRun matches prevention of automatic executable launching from removable storage.
Each workstation hardening policy directly addresses a distinct attack vector: account lockout limits online password cracking, service/port disabling removes latent attack surface, screen locking secures unattended physical hardware, and disabling AutoPlay blocks weaponized removable media.
Step-by-Step Solution
Key Concept
Workstation Hardening & Risk Mitigation Alignment