Examkin

Question

Difficulty: HardWorkstation Hardening and Best Practices

A system administrator is preparing to deploy a newly imaged standalone Windows workstation into a high-security corporate network environment. To ensure defense-in-depth and prevent exposure to network-borne threats during setup, the administrator must execute the workstation hardening baseline in a logical, secure sequence. What is the correct order of steps the administrator should take to secure the workstation from initial setup to final network placement?

  1. 1Change default administrative account credentials and verify that the local Guest account is disabled.
  2. 2Connect the system to an isolated remediation VLAN to download and install mandatory OS patches and antimalware signatures.
  3. 3Disable unneeded OS services, turn off AutoPlay/AutoRun policies, and close unused open network ports.
  4. 4Configure Local Group Policy settings to enforce screen lock timeouts, account lockout thresholds, and password complexity.
  5. 5Enable the host-based firewall with restrictive inbound rules and connect the workstation to the production network.

Answer

The correct sequence for hardening the workstation is: First, change default administrative credentials and disable the local Guest account; second, connect to an isolated VLAN to install OS patches and security definitions; third, disable unneeded OS services, AutoPlay, and unused ports; fourth, configure local group policies for screen lock and lockout thresholds; fifth, enable the host-based firewall and connect to the production network.
The correct order follows established CompTIA security hardening guidelines: credentials and accounts are secured first to eliminate default access risks; OS updates and signatures are downloaded on an isolated VLAN next; unnecessary services, ports, and AutoPlay are disabled to minimize the attack surface third; local security policies (such as screen lock timeouts and account lockout controls) are enforced fourth; and host-based firewalls are activated immediately prior to joining the production network fifth.

Step-by-Step Solution

1
Secure local identity and default access controls.
Default administrative credentials are changed, and the Guest account is verified disabled.
Initial access vector risks must be mitigated first so unauthorized users cannot log into the machine using vendor defaults.
2
Perform patch management on an isolated segment.
System OS patches and antimalware definitions are updated without exposing the unhardened system to production network threats.
An unpatched system exposed directly to the network can be compromised before security software is updated.
3
Perform attack surface reduction.
Unnecessary OS services, ports, and AutoPlay/AutoRun policies are disabled.
Disabling unneeded features reduces potential exploit vectors on the local system.
4
Enforce OS security policies.
Screen lock timeouts, account lockout controls, and password complexity rules are established.
Policy enforcement secures the operating system environment against local unauthorized physical access and brute-force attempts.
5
Activate network layer endpoint defenses and join production network.
Host-based firewall is enabled and system is moved to production network.
Activating host firewall controls before final network plug-in completes defense-in-depth isolation.

Key Concept

Workstation Hardening Sequence & Attack Surface Reduction
Rate this question

Topics

Workstation Hardening and Best Practices

More questions from this topic