A cloud service provider wants to offer hardened virtual server images for provisioning purposes. This will enable users to use only the operating system services that are allowed by the provider. Whi

Disabling automatic updates on a provider-hardened image ensures that only vetted, approved patches are applied, preventing untested or unauthorized changes from altering the hardened security baseline that the provider controls.

Disabling the command prompt would prevent legitimate administrative access and is not a recognized server hardening practice.

Disabling unneeded ports and services reduces the attack surface by eliminating unnecessary entry points and running processes, which is a fundamental principle of server hardening.

Disabling the local administrator account removes a necessary management capability and is not a standard hardening step for provider-managed images.

Disabling remote desktop connection eliminates a common remote management channel without a proportional security benefit in a controlled provider environment.

Disabling complex passwords weakens authentication security, which is the opposite of hardening and directly introduces credential risk.