Securing Web Servers: Priority for Common Threats
You have been hired as an intern at a start-up company. Your first task is to help set up a basic web server for the company's new website. The team leader has asked you to make sure the server is secure from common threats. Based on your knowledge from studying for the CEH exam, which of the following actions should be your priority to secure the web server?
Community Votes
71% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The core concept tested is server hardening priorities, with the common trap being the confusion between data protection (SSL) and infrastructure security (patching).
This question addresses the primary action required to secure a web server against common threats. The correct answer is C because patching vulnerabilities is the foundational step in hardening the system.
Many candidates select D (SSL/TLS) because they prioritize data encryption over system integrity, failing to recognize that an unpatched server is vulnerable regardless of SSL status.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Regularly updating and patching server software (Option C) is the most critical priority for securing a web server from common threats. This practice directly addresses known vulnerabilities in the operating system, web server software (like Apache or Nginx), and underlying libraries. Without these patches, the server remains exposed to exploits such as remote code execution, which no amount of network-level security can prevent.Why the Other Options Are Wrong
While installing a WAF (Option B) provides a layer of defense, it cannot protect against zero-day vulnerabilities or flaws in the OS itself if the server is not patched. Limiting concurrent connections (Option A) helps mitigate Denial-of-Service attacks but does not address the root cause of system compromise. Encrypting the website with SSL/TLS (Option D) protects data in transit but does not secure the server's internal components or prevent attackers from exploiting software bugs to gain control of the machine.Community Comment Notes
The community debate highlights a common misunderstanding of 'security.' Users like obadawi and LoveBug4 argue for SSL/TLS, believing data protection is the top priority. However, experienced analysts like insaniunt and Mos3ab correctly emphasize that without a patched, secure foundation, encryption is irrelevant if the server is already compromised. As blehbleh noted, the focus must be on protecting the server itself first.Exam Strategy
Always distinguish between protecting the data (confidentiality) and protecting the system (integrity/availability). When asked about securing the 'server' or 'system,' prioritize patching and hardening before considering perimeter defenses.
Frequently Asked Questions
Why isn't SSL/TLS the first priority?
SSL/TLS encrypts data in transit but does not fix vulnerabilities in the server software that allow attackers to take control.
Is a WAF better than patching?
No. A WAF filters traffic but cannot protect against vulnerabilities in the underlying OS or application code that hasn't been patched.