In your cybersecurity class, you are learning about common security risks associated with web servers. One topic that comes up is the risk posed by using default server settings. Why is using…

Question

Options

• ADefault settings cause server malfunctions; simplify the settings
• BDefault settings allow unlimited login attempts; setup account lockout
• CDefault settings reveal server software type; change these settings
• DDefault settings enable auto-updates; disable and manually patch

• A
  5% (2)
• B
  2% (1)
• C
  93% (39)

Explanation

Explanation

Default server settings often expose identifying information such as server banners, version numbers, and software type (e.g., "Apache 2.4.1" or "IIS 10"), giving attackers a roadmap to exploit known vulnerabilities specific to that software - making Option C correct, as changing these default settings removes this critical intelligence from potential attackers. Option A is incorrect because default settings don't inherently cause malfunctions; they are a security concern, not a performance one. Option B is partially valid as a general security practice, but default settings don't specifically "allow unlimited login attempts" as their primary risk. Option D is actually the opposite of good security practice - disabling auto-updates increases risk rather than mitigating it.

Memory Tip: Think of default settings like a name tag that reveals your identity to criminals - the first thing you'd do is remove it. Default settings "advertise" your server's software, so the first step is always to hide or change that information to reduce your attack surface.

No community discussion yet for this question.