A technician is hardening a Windows workstation. One of the hardening requirements for the workstation is to prevent potential privilege escalation attacks on the local system. Which of the…

Question

Options

• AEnd the Isass.exe service running on the system.
• BUninstall and reinstall the antivirus program.
• CDisable and rename the administrator account.
• DUpdate the system with the latest security updates.

• A
  5% (1)
• C
  81% (17)
• D
  14% (3)

Explanation

Disabling and renaming the built-in Administrator account (C) is a direct countermeasure against privilege escalation attacks. The built-in Administrator account (SID ending in -500) is a well-known, high-value target - attackers frequently attempt to exploit it because its name is predictable and it has the highest level of local privilege. Renaming it removes the predictable attack surface, and disabling it means that even if an attacker discovers the new name, the account cannot be used for login. Option A is dangerous - lsass.exe is the Local Security Authority Subsystem Service, critical for authentication; terminating it would crash the system. Option B (reinstalling antivirus) addresses malware detection, not privilege escalation. Option D (security updates) is important general hardening but does not specifically target the privilege escalation attack vector as directly as removing access to the most privileged built-in account.

No community discussion yet for this question.