A company has just completed a security audit and received initial results from the auditor. The results show that the ethical hacker was able to gain access to the company servers by exploiting…

Discretionary access controls (DAC) place access decisions with individual resource owners rather than enforcing a centralized policy, making them insufficient for enterprise-wide hardening against privilege abuse across hypervisor environments.

Disabling unnecessary accounts removes default or dormant accounts such as guest accounts that attackers commonly exploit for initial access, directly addressing the audit finding that the ethical hacker accessed servers as guests and administrators.

Changing default passwords is a valid hardening step but does not address the root cause of the exploit, which was the existence of unnecessary accounts and the absence of role-based privilege separation.

Antivirus software detects and removes malware but does not prevent unauthorized access achieved through misconfigured or non-hardened hypervisor guest accounts and administrator privileges.

Role-based access controls (RBAC) restrict what actions users can perform based on their assigned role, limiting the privilege escalation and lateral movement that allowed the ethical hacker to operate as an administrator across hosts and VMs.