You have been hired as an intern at a start-up company. Your first task is to help set up a basic web server for the company's new website. The team leader has asked you to make sure the server is…

Limiting concurrent connections mitigates denial-of-service risks but does nothing to address vulnerabilities in the server software itself, making it a partial control rather than a foundational security measure.

A web application firewall adds an important defensive layer against attacks like SQLi and XSS, but it is a compensating control that does not eliminate underlying vulnerabilities caused by unpatched software.

Regularly updating and patching server software is the highest priority because unpatched vulnerabilities are the most commonly exploited attack vector against web servers. Attackers actively scan for known CVEs in outdated software, and patching directly closes these doors before other security layers are even needed. This is a foundational principle in CEH and general security hardening - no other control compensates for running vulnerable, unpatched software.

Encrypting traffic with SSL/TLS protects data in transit from eavesdropping and man-in-the-middle attacks, but it does not protect the server from exploitation of software vulnerabilities, which is a more fundamental and immediate threat.