Which of the following preventative controls would be appropriate for responding to a directive to reduce the attack surface of a specific host?

Installing anti-malware adds a detection and blocking layer against malicious software but does not remove unused services or close ports, so it does not reduce the attack surface.

An IDS is a detective control that monitors traffic and generates alerts on suspicious activity; it does not remove attack vectors or reduce the number of exploitable services.

Taking a baseline configuration documents the current state of a system for change comparison; it is an operational practice and does not actively reduce the number of services or entry points on the host.

Attack surface reduction means removing or disabling all components of a system that are not required for its intended function, thereby eliminating potential vectors an attacker could exploit. Disabling unnecessary services closes listening ports, removes running processes, and eliminates code paths that could contain vulnerabilities. This is a proactive hardening measure that directly and permanently shrinks the set of exploitable entry points on the host.