An administrator is asked to harden a Linux server after installing the OS. Which of the following should the administrator do FIRST?

Installing the latest OS patches immediately addresses publicly disclosed vulnerabilities present in the default installation and closes attack vectors that exist before any other configuration is applied. Patching must come first because unpatched OS-level vulnerabilities can undermine every subsequent security control, including firewalls and intrusion detection systems.

Configuring a personal firewall is an important hardening step, but it should follow patching because firewall rules cannot compensate for exploitable unpatched vulnerabilities in the OS itself.

Disabling the Host-based Intrusion Detection System (HIDS) removes a security monitoring layer and reduces the server's defenses, which is contrary to the goal of hardening.

Enabling Wake-on-LAN (WOL) expands the attack surface by allowing remote power-on commands over the network, which increases risk rather than reducing it.