Examkin

Soru

Zorluk: Çok zorWorkstation Hardening and Best Practices

A security administrator is preparing an unhardened, newly provisioned Windows workstation for deployment in a high-security enterprise environment. To minimize attack vectors prior to placing the system on the production network, the administrator must execute a comprehensive series of local configuration and security hardening controls. In what sequence should the technician perform the following workstation hardening steps to ensure proper dependency management and maximum initial security?

  1. 1Disable or rename default accounts (such as Guest and Administrator) and provision dedicated, strong password-protected local administrative accounts.
  2. 2Configure Local Security Policy settings to enforce account lockout thresholds, password complexity rules, and user rights assignments.
  3. 3Disable unnecessary system services, startup applications, and legacy feature components (such as AutoRun/AutoPlay).
  4. 4Configure Windows Defender Firewall rules to close unused inbound/outbound ports and restrict non-essential network communications.
  5. 5Enable BitLocker full-disk encryption and configure mandatory screen saver lockout timeouts.

Cevap

The correct procedural order is: first disable or rename default accounts and provision secured local accounts, second configure local account security policies (lockout and complexity), third disable unnecessary system services and features (AutoRun/AutoPlay), fourth configure Windows Defender Firewall and port restrictions, and fifth enable full-disk encryption (BitLocker) and screen lock policies.
Hardening a new workstation follows a logical defense-in-depth sequence: establishing strict local access control (account renaming/disabling), defining credential policies (lockout/complexity), minimizing software attack surface (disabling services/AutoRun), controlling network exposure (host firewall/ports), and finally applying physical and storage safeguards (BitLocker and screensaver locks).

Adım Adım Çözüm

1
Secure local user and administrator accounts
Default administrative pathways and Guest accounts are restricted or renamed, establishing baseline access control.
Before applying system-wide policies, control over account privileges must be established so default credentials cannot bypass configuration.
2
Enforce Local Security Policy baseline rules
Account lockout thresholds and password complexity criteria are activated via secpol.msc.
Establishing policy bounds on accounts protects the system against brute-force attempts during remaining configuration tasks.
3
Reduce attack surface by disabling unneeded services and features
Unused OS services, background apps, and removable media features like AutoPlay/AutoRun are turned off.
Eliminating unnecessary background features mitigates local and media-borne software vulnerabilities.
4
Restrict network boundaries via host firewall settings
Inbound and outbound network rules block unauthorized protocols and ports.
Network filtering ensures that remaining services do not expose unexpected network ports before network connection.
5
Implement data-at-rest and physical session security controls
BitLocker encrypts system drives and password-protected screensavers lock unattended sessions.
Storage encryption and inactivity timeouts complete the hardening baseline to guard against physical loss or unauthorized local access.

Anahtar Kavram

Workstation Hardening Procedural Sequence
Bu soruyu puanla

Konular

Workstation Hardening and Best Practices

Bu konudan daha fazla soru