A systems administrator was tasked with decommissioning a server that contains sensitive data. The systems administrator powered down the server so it was no longer accessible from the network. Two weeks later, during an investigation by security, it is discovered that an employee within the company accessed the server that morning and attempted to access the restricted data. Physical security logs show no one entered the server room. Which of the following hardening techniques was MOST likely neglected on this server?

Question

Accepted Answer

D. Disabling WOL WOL is a network standard that enables a powered-off machine's NIC to listen for a 'magic packet' and boot the system remotely. Because the server was powered down but WOL was not disabled in BIOS/UEFI or on the NIC, an employee could have sent a magic packet over the network to wake the server and then accessed the restricted data - fully consistent with no physical entry being recorded in the server room.

Answer

A. Enabling intrusion detection Enabling intrusion detection can alert on suspicious access but cannot prevent a powered-down server from being remotely woken up via a WOL magic packet.

Answer

B. Stopping unneeded services Stopping unneeded services is a hardening step for running systems and is irrelevant when the server has been powered down.

Answer

C. Installing only required software Installing only required software reduces attack surface on an active system but has no effect on whether a powered-down server can be remotely started.

A systems administrator was tasked with decommissioning a server that contains sensitive data. The systems administrator powered down the server so it was no longer accessible from the network. Two…

Question

Options

How the community answered

Why each option

Topics

Community Discussion