Larry, a security professional in an organization, has noticed some abnormalities In the user accounts on a web server. To thwart evolving attacks, he decided to harden the security of the web server

Enabling unused default user accounts created during OS installation increases the attack surface and is the opposite of hardening - these accounts should be disabled or removed.

Non-interactive accounts that do not require interactive login should be disabled or locked, not enabled, to prevent them from being leveraged by attackers.

Limiting administrator or root-level access to the minimum number of users is a core principle of least privilege, directly reducing the attack surface on a web server. Fewer privileged accounts mean fewer vectors an attacker can exploit if credentials are compromised. This countermeasure is a foundational hardening step recommended by security frameworks like CIS Benchmarks.

Retaining unused modules and application extensions increases the attack surface; hardening requires removing or disabling all unnecessary components.