Server Hardening Recommendations for Production Deployment

350-201 By islever Editorial Last updated Oct 31, 2026

Describe the use of hardening machine images for deployment Evaluate the security controls of an environment, diagnose gaps, and recommend improvement

Short answer

AD Set a strong BIOS/firmware password to prevent unauthorized changes to the server settings and Harden new servers in a network that is not open to the internet.

Question

A security engineer must deploy a new server for the accounting department. The engineer prepared the server and applications list to be installed. According to the company's IT security policy, servers must be hardened before deployment to production. Which two recommendations should a security engineer consider? (Choose two.)

Set a strong BIOS/firmware password to prevent unauthorized changes to the server settings. Correct Answer
Disable anonymous SID/Name translation.
Reduce logging level to improve server performance.
Harden new servers in a network that is not open to the internet. Correct Answer
Enable the default settings to ensure compatibility across network services.

Key Takeaways

The main trap is choosing specific OS-level configurations over foundational infrastructure controls like firmware passwords and network isolation.

This question addresses server hardening best practices, specifically focusing on firmware security and network segmentation for new deployments.

Common mistake: Choosing Option B because it sounds technical, but it is environment-specific and less universal than firmware protection and network isolation.

Expert Analysis

Firmware Security as a Hardening Baseline

The question requires identifying two recommendations for hardening a new server before production deployment. Option A, setting a strong BIOS/firmware password, is a fundamental physical and firmware security control. It prevents unauthorized users from changing boot sequences or accessing sensitive configuration settings, which aligns with industry standards like CIS Benchmarks.

Network Segmentation for Initial Deployment

Option D, hardening new servers in a non-internet-facing network, is the correct second recommendation. This practice, often called "staging" or using a "quarantine network," ensures that untested or newly configured systems do not expose vulnerabilities to the public internet until they are fully validated. This reduces the attack surface during the critical post-deployment phase.

Why Other Options Are Incorrect

Option B (Disable anonymous SID/Name translation) is specific to Active Directory environments and may not apply to all server types (e.g., Linux). Option C (Reduce logging level) is counterproductive to security monitoring and compliance. Option E (Enable default settings) violates the core principle of hardening, which requires removing unnecessary services and changing defaults to minimize risk.

Exam Strategy

When evaluating hardening options, prioritize controls that address the most fundamental layers of security first: physical/firmware access and network exposure. Avoid options that reduce visibility (like reducing logs) or rely on specific, non-universal configurations unless explicitly stated.

Frequently Asked Questions

Why is disabling anonymous SID translation not always required?

It is primarily relevant to Windows Domain Controllers and Active Directory environments. For general server hardening across diverse platforms, broader controls like firmware passwords are more universally applicable.

What is the purpose of staging servers in a non-internet network?

Staging allows for testing and validation without exposing potential vulnerabilities to external threats. Once hardened and verified, the server can be moved to its final production environment.

More 350-201 FAQ →

Community Votes

95%

95% of anonymous learners picked answer AD. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

ITshinobi 👍 1

I though A and B at first. After looking into it further, A and D are correct: 1. Why Option A is universally accepted: Industry hardening baselines (such as CIS Benchmarks) emphasize that operating system security can be completely bypassed if physical or firmware security is weak. Setting a firmware password blocks an attacker from altering the boot sequence to run a malicious live OS or bypassing encryption keys. 2. Why Option D is universally accepted: The fundamental rule of system deployment is to never place an unhardened, unpatched asset on an untrusted or internet-facing network. Doing so exposes it to immediate network scanning and automated exploitation before basic access controls can even be provisioned. Hardening must happen in a completely isolated staging or sandbox network. 3. The Debate on Option B (Disable anonymous SID/Name translation): Some platform threads note that disabling anonymous SID/Name translation is an excellent baseline recommendation specifically for Windows Server environments to prevent attacker enumeration. However, as a general question, A and D are treated as the higher-priority architectural principles that apply universally across any server OS platform (Windows, Linux, Unix, etc.).
BECAUSE 👍 1

A and B is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

← Back to 350-201 Study Guide