A penetration tester observes that several high-numbered ports are listening on a public web server. However, the system owner says the application only uses port 443. Which of the following would…

Moving the application to a different port is security through obscurity and does nothing to close the unneeded high-numbered ports that are already listening.

Restricting port 443 to specific IP addresses would block legitimate users from the application and does not address the other open ports on the server.

A web application firewall inspects HTTP/S traffic and cannot close or protect arbitrary high-numbered ports used by non-web services.

If the application legitimately requires only port 443, any other listening ports indicate services that are running without a business justification, directly violating the principle of least functionality. Disabling those services removes the exposure entirely rather than filtering or obscuring it. This is the most effective recommendation because it eliminates the attack vector at its source instead of trying to manage it around the edges.