Which of the following is the best method to reduce the attack surface of an enterprise network?

Question

Options

• ADisable unused network services on servers.
• BUse port security for wired connections.
• CChange default passwords for network printers.
• DCreate a guest wireless network for visitors.

• A
  12% (3)
• B
  4% (1)
• C
  77% (20)
• D
  8% (2)

Explanation

Note: The marked correct answer (C) appears to be incorrect. The best answer for reducing attack surface is A, and this is worth flagging before an exam.

Why A is actually correct: Disabling unused network services is the textbook definition of attack surface reduction - fewer running services means fewer exploitable entry points. This is a core hardening principle in Security+, CISSP, and CIS Benchmarks: if a service isn't needed, it shouldn't exist on the network.

Why the other options don't fit as well:

• C (Change default passwords on printers): Good credential hygiene, but the service/attack vector still exists - you've made it harder to exploit, not smaller. This is hardening, not attack surface reduction.
• B (Port security for wired connections): Access control that limits who can connect, but doesn't reduce the services/vectors exposed on the network itself.
• D (Guest wireless network): Network segmentation that isolates untrusted users - a good practice, but it arguably adds a network segment rather than reducing the overall attack surface.

Memory tip: Attack surface = "how many doors exist." Reducing it means removing doors (disabling services), not just changing the locks (passwords) or adding a side entrance (guest network).

If this came from a practice exam or question bank, it may contain an error - worth verifying against an authoritative source like CompTIA's official study materials.

No community discussion yet for this question.