What Server Hardening Steps Should an Administrator Take Before Deployment?
Short answer
AC Disable default accounts. Remove unnecessary services.
Question
Key Takeaways
This question tests knowledge of proactive system hardening techniques versus reactive or administrative tasks, with the trap being options like logging or inventory management which support operations but do not reduce initial vulnerabilities.
Server hardening focuses on proactively reducing the attack surface by disabling default accounts and removing unnecessary services. The community unanimously agrees that options A and C are the correct technical hardening measures for pre-deployment configuration.
Common mistake: Candidates often incorrectly select E because it relates to security monitoring, but log forwarding is a post-deployment operational control, not a hardening step that reduces the initial attack surface.
Expert Analysis
Why the Answer Is Correct
Disabling default accounts eliminates known credential vectors that attackers frequently exploit during initial compromise attempts. Removing unnecessary services directly shrinks the attack surface by closing unused ports and eliminating potential software vulnerabilities. Both actions are foundational hardening practices recommended by industry benchmarks before a system enters production.
Why the Other Options Are Wrong
Adding the server to the asset inventory is a crucial governance task but does not technically harden the operating system. Documenting default passwords is a dangerous practice; secure configurations require changing or disabling them immediately rather than recording them. Sending server logs to the SIEM supports detection and response but occurs after deployment and does not reduce pre-existing vulnerabilities.
Community Comment Notes
As highlighted in top-voted comments [1][2], both choices directly minimize system exposure prior to go-live. Multiple users note that hardening specifically targets vulnerability reduction rather than administrative tracking or monitoring setup. The unanimous vote distribution reflects strong alignment with official CompTIA objectives for secure configuration.
Official Reference
- https://www.cisecurity.org/benchmark/microsoft_windows_server
- https://pages.nist.gov/800-123/r4/
- https://cyber.dhs.gov/
These links open the official vendor documentation in a new tab.
Exam Strategy
When evaluating hardening questions, focus exclusively on actions that reduce the attack surface or eliminate known vulnerabilities before the system goes live. Filter out monitoring, auditing, and inventory options, as these support operations but do not constitute technical hardening controls.
Community Votes
100% of anonymous learners picked answer AC. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
jafyyy 👍 2AC - these options ensure the server is secure before deployment.
-
tripletripe805692 👍 1AC is correct. both actions make the server less vulnerable.
-
a4e15bd 👍 3A&C are correct
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →