A security engineer must deploy a new server for the accounting department. The engineer prepared the server and applications list to be installed. According to the company's IT security policy…

Question

Options

• ASet a strong BIOS/firmware password to prevent unauthorized changes to the server settings.
• BHarden new servers in a network that is not open to the internet.
• CDisable anonymous SID/Name translation.
• DReduce logging level to improve server performance.

• A
  89% (25)
• B
  7% (2)
• C
  4% (1)

Explanation

Option A is correct because setting a strong BIOS/firmware password is a foundational hardening step - it prevents unauthorized physical or low-level access to server settings before an OS even loads, which aligns directly with hardening-before-deployment policies.

Option B is also likely the intended second correct answer (the question says "choose two," but only A is listed). Hardening a server in an isolated, non-internet-facing network is a best practice because it prevents exposure of vulnerabilities during the configuration window, before security controls are fully in place.

Option C (disable anonymous SID/Name translation) is a valid Windows-specific hardening control, but it's a narrow, OS-level setting rather than a broad server hardening recommendation - it wouldn't be the top-level guidance a policy document would highlight.

Option D is wrong because reducing logging undermines security visibility. Server hardening guidelines consistently recommend increasing or maintaining logging to support auditing, incident response, and compliance - never sacrificing it for performance.

Memory tip: Think of server hardening in two phases - protect the foundation (BIOS password = physical/firmware layer) and control the environment (isolated network = no exposure during setup). "Harden in the dark, deploy in the light."

No community discussion yet for this question.