What Should Be Done First Before a Web Server Goes Live?

SY0-701 By islever Editorial Last updated

Given a scenario, apply common security techniques to computing resources. Given a scenario, select mitigation techniques or controls to secure an enterprise environment.

Short answer

A Harden the virtual host first by removing unnecessary services and applying secure baseline configurations before the new web server goes live, ahead of WAF rules and NIDS.

Question

Which of the following should a security team do first before a new web server goes live?
  1. Harden the virtual host. Correct Answer
  2. Create WAF rules.
  3. Enable network intrusion detection.
  4. Apply patch management.

Key Takeaways

It tests secure deployment order: the exam wants the broad host-hardening baseline first, while the trap is treating patch management as a standalone first step.

This SY0-701 scenario asks for the first security action before a new web server is exposed; the correct choice is to harden the virtual host (A), not to start with WAF rules, NIDS, or patch management.

Common mistake: Option D, apply patch management, is the plausible wrong answer because patching removes known vulnerabilities and is part of secure builds; however, it is a narrower task within hardening and 'apply patch management' describes an ongoing process, not the first host-level action before go-live.

Expert Analysis

Why the patch-first answer is tempting Option D, apply patch management, is the most attractive wrong answer because it sounds like the most concrete way to remove known vulnerabilities before exposure. It satisfies the 'new server' part of the stem and the desire to eliminate known CVEs, but it stops being correct at 'first': it assumes the host's secure configuration baseline already exists. Learners defending D describe a patch-then-harden sequence, and that has practical merit: a new server should not go live with missing OS or web-server patches. The question asks what the security team should do first, however, and CompTIA treats patching as one task inside the broader host-hardening baseline, not as the baseline itself. 'Apply patch management' also names an ongoing program rather than the immediate build action.

Why A is the first action Option A, harden the virtual host, covers disabling unnecessary services and default accounts, tightening permissions, removing unused ports, and applying secure configuration. That reduces the server's own attack surface before it can receive production traffic. WAF rules (B) and network intrusion detection (C) are layered filtering and monitoring controls around an already-built host; they do not make the virtual host secure first. Learners supporting A make the same distinction: patching is necessary, but it is a subset of hardening.

Exam takeaway The correct choice is A. When the stem emphasizes before go-live, select the host-level baseline that establishes a secure configuration. Do not let a narrow but operationally important task such as patching displace the broader first control.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question asks what to do 'first' before exposure, eliminate controls that monitor or filter traffic, because they assume the host is already built. Also separate a broad baseline action from a component: patching is a hardening task, but 'apply patch management' describes an ongoing program rather than the initial host build. Choose the option that reduces the server's own attack surface before it can receive production traffic.

Frequently Asked Questions

Why isn't patch management the first step before a new web server goes live?

Patching is necessary, but CompTIA frames it as a task within host hardening. The broader first action is to harden the virtual host—remove unnecessary services, tighten permissions, and establish a secure baseline—before adding WAF or NIDS layers.

When should WAF rules and network intrusion detection be enabled?

They are layered controls that filter or monitor traffic after the host has a secure baseline. Creating WAF rules (B) or enabling NIDS (C) before hardening would leave the server itself unnecessarily exposed.

What does hardening a virtual host include?

It includes disabling unused services and default accounts, closing unnecessary ports, applying secure configuration settings, enforcing least privilege, and validating file and directory permissions. Patching is one part of this baseline, not a replacement for it.

More SY0-701 FAQ →

Discussion 16 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 16

  1. Anyio 👍 11 Answered A
    The correct answer is: A. Harden the virtual host. Explanation: Hardening the virtual host is the first step a security team should take before a new web server goes live. This involves securing the server by removing unnecessary services, applying secure configurations, and minimizing potential attack surfaces. Hardening ensures the server is in a secure state before it is exposed to potential threats. Create WAF rules (B) is important but should be done after the server is hardened, as the Web Application Firewall (WAF) rules depend on the server's configuration and applications. Enable network intrusion detection (C) is a broader network security measure and should be implemented after the server itself is secured. Apply patch management (D) is critical but is part of the ongoing maintenance process and should follow initial hardening. Thus, hardening the virtual host is the first and most critical step to ensure the web server is secure before it goes live.
  2. tomahawk117 👍 5 Answered D
    The question says nothing about a a virtual host. After setting a new web server you'll want to make sure its patched.
  3. jbmac 👍 3 Answered D
    The correct answer is: D. Apply patch management. Explanation: Before a new web server goes live, the first thing the security team should do is ensure that the server is patched. Patch management ensures that all known vulnerabilities in the operating system, software, and web server components are addressed. This is crucial to minimize the attack surface and prevent exploitation of known vulnerabilities. Applying the latest patches is a foundational step in securing any system before it is exposed to the internet.
  4. 5a5837f 👍 3 Answered D
    Lol, I discussed with ChatGPT because it doesn't follow its own rules sometimes. I support D. Here is why: - Apply patches is also part of the more general hardening terminology. - Apply patches is literally the first thing you should do to secure (not just maintenance). - CompTIA often rewards the answer that is the most direct operational control for the stated risk (apply patches), not the broad umbrella term that contains it (hardening your shi). May the universal chaos fall in your favor.
  5. Fourgehan 👍 3 Answered A
    Before a new web server goes live, the first step should be to harden the virtual host, which involves securing the server by: Disabling unnecessary services and ports. Configuring secure protocols. Setting strong authentication and authorization policies. Ensuring file permissions and directory structures are appropriately configured. Hardening ensures that the server's baseline security posture is strong and minimizes vulnerabilities that attackers could exploit
Show 11 more comments
  1. Cocopqr 👍 3 Answered D
    D. Apply patch management. Patching the server first ensures it's up-to-date and less vulnerable to attacks.
  2. Fhaddad81 👍 3
    Why not b Create WAF rules.?
  3. Empath 👍 2 Answered A
    Answer: A. Harden the virtual host. Reasoning: Before exposing a new web server to the internet, the first step is to ensure the system itself is hardened — removing unnecessary services, disabling default accounts, enforcing least privilege, securing configurations, and tightening permissions. Hardening reduces the attack surface so that even if later controls fail, the server itself is less vulnerable. B. Create WAF rules — important, but WAFs protect against application-layer attacks; they should be added after the server itself is secured. C. Enable network intrusion detection — helps detect threats but doesn’t prevent vulnerabilities from being exploited. D. Apply patch management — critical, but patching is a subset of hardening. Hardening encompasses patching plus many other baseline security steps. ✅ So the first action is to harden the virtual host.
  4. 78834d6 👍 2 Answered D
    Correct answer is D. n secure system deployment, the correct order is: - Patch (remove known vulnerabilities) - Harden (reduce attack surface) - Configure WAF/NIDS (monitor and block threats) - Test and validate (ensure everything works securely)
  5. LavaBoi 👍 2 Answered A
    Applying patch management doesn’t fit with what the question is asking. Applying patch management is the process of setting up the patch management instead of running the patch. Therefore, the correct answer is hardening the virtual host.
  6. Clau95 👍 2
    Ran the same question and according to chat GPT the correct answer is D - Apply patch management
  7. kippedwards8 👍 2 Answered A
    A. Harden the virtual host This is the correct answer according to chat GPT
  8. danielbadasu 👍 1
    Explanation: Hardening the virtual host is the first step a security team should take before a new web server goes live. This involves securing the server by removing unnecessary services, applying secure configurations, and minimizing potential attack surfaces. Hardening ensures the server is in a secure state before it is exposed to potential threats. Create WAF rules (B) is important but should be done after the server is hardened, as the Web Application Firewall (WAF) rules depend on the server's configuration and applications.
  9. Segunmx 👍 1 Answered A
    A. Harden the virtual host. Explanation: Before a new web server goes live, hardening the virtual host should be the first step. Hardening involves configuring the server to reduce vulnerabilities and enhance security.
  10. MarysSon 👍 1 Answered A
    Harden the virtual host is more logical. While applying patches is necessary, the activity is a subset of hardening the host. Patches defend against commonly known vulnerabilities, but hardening does more
  11. pchuu 👍 1 Answered A
    Patching is a subset of hardening. Answer is A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide