A security administrator has been assigned to review the security posture of the standard corporate system image for virtual machines. The security administrator conducts a thorough review of the…

Mandatory access controls (MAC) define access policies based on labels and classifications, but they do not address the removal or disabling of unnecessary user accounts found in the image.

Disabling remote login addresses one specific attack vector (remote access), but it does not correct the broader deficiency of unnecessary user accounts and other configuration issues identified during the review.

Host hardening is the comprehensive process of securing a system by removing or disabling unnecessary accounts, services, open ports, and default configurations to reduce the attack surface. The scenario describes a full security review of a VM image covering logs, installation procedures, network config, and user accounts - all of which fall under host hardening activities. Disabling unused accounts identified during the review is a specific host hardening task applied to a standard corporate image.

Disabling services addresses unnecessary running processes, but the question specifically highlights unused user accounts as the deficiency, making this only a partial remediation and not the comprehensive solution that host hardening provides.