nerdexam
CompTIA

SY0-301 · Question #572

A new web server has been provisioned at a third party hosting provider for processing credit card transactions. The security administrator runs the netstat command on the server and notices that…

The correct answer is B. HTTP. For a server processing credit card transactions, unencrypted HTTP on port 80 must be disabled because all payment data must transit only over encrypted HTTPS.

Security architecture

Question

A new web server has been provisioned at a third party hosting provider for processing credit card transactions. The security administrator runs the netstat command on the server and notices that ports 80, 443, and 3389 are in a `listening' state. No other ports are open. Which of the following services should be disabled to ensure secure communications?

Options

  • AHTTPS
  • BHTTP
  • CRDP
  • DTELNET

How the community answered

(53 responses)
  • A
    6% (3)
  • B
    83% (44)
  • C
    9% (5)
  • D
    2% (1)

Why each option

For a server processing credit card transactions, unencrypted HTTP on port 80 must be disabled because all payment data must transit only over encrypted HTTPS.

AHTTPS

HTTPS (port 443) uses TLS to encrypt traffic and is the required protocol for secure credit card processing - it must remain enabled.

BHTTPCorrect

HTTP (port 80) transmits data in plaintext, making it unsuitable for any server handling credit card transactions. PCI DSS requirements mandate that cardholder data be protected in transit using strong cryptography, so only HTTPS (port 443) should be active for web communications, and HTTP should be disabled to prevent accidental or forced downgrade.

CRDP

RDP (port 3389) is used for remote administration and while its exposure is a concern, the question asks specifically about securing communications, not remote management.

DTELNET

Telnet is not listed as listening in the netstat output, so it is not running on this server and cannot be disabled.

Concept tested: Disabling plaintext protocols for PCI compliance

Source: https://www.pcisecuritystandards.org/document_library/

Topics

#port security#RDP#unnecessary services#web server hardening

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-301 Practice