Examkin

Question

Difficulty: MediumWorkstation Hardening and Best Practices

An IT technician is tasked with performing baseline workstation hardening on a newly deployed Windows system before issuing it to an employee. In which sequential order should the technician perform these hardening steps to establish proper security controls from account access to session security?

  1. 1Disable the built-in Guest account and rename the default Administrator account.
  2. 2Configure local password complexity rules and account lockout thresholds.
  3. 3Disable AutoRun and AutoPlay features for external media drives.
  4. 4Enable a screen lock timeout that requires password authentication upon resume.

Answer

The correct procedural order is: first, disable the built-in Guest account and rename the default Administrator account; second, configure local password complexity and account lockout policies; third, disable AutoRun and AutoPlay for external media; and fourth, enable a screen lock timeout requiring a password on resume.
The correct order follows standard baseline security principles: eliminating high-risk default account exposure first, establishing robust user authentication rules second, restricting dangerous system automation (AutoRun/AutoPlay) third, and finalizing local physical session security (screen lock timeouts) fourth.

Step-by-Step Solution

1
Address account vulnerabilities by disabling the Guest account and renaming the default Administrator account.
Known default account vectors are closed, preventing unauthorized privilege escalation.
Securing default credentials must occur before enabling broader account governance policies.
2
Define password complexity and lockout policies in Local Security Policy.
User authentication rules are hardened against dictionary and brute-force attempts.
Password and lockout baselines enforce credential strength for all created user profiles.
3
Configure Local Group Policy to disable AutoRun and AutoPlay.
Automatic background execution from connected USB or optical media is suppressed.
Restricting peripheral execution protects the system from drive-by hardware infection.
4
Set the screen saver timeout and enforce password protection upon waking.
Active user sessions lock automatically during periods of inactivity.
Session protection prevents unauthorized physical access when an authorized user steps away.

Key Concept

Workstation Baseline Hardening Sequence
Rate this question

Topics

Workstation Hardening and Best Practices

More questions from this topic