SY0-701 Question #584: Real Exam Question with Answer & Explanation

Question

Which of the following should a security team do first before a new web server goes live?

Options

• AHarden the virtual host.
• BCreate WAF rules.
• CEnable network intrusion detection.
• DApply patch management.

Explanation

Hardening the virtual host is the correct first action because it establishes a secure baseline for the server before it's exposed to any traffic or threats - this means removing unnecessary services, disabling unused ports, applying least-privilege configurations, and locking down default settings. Without hardening, every other control is protecting a fundamentally insecure foundation.

Why the distractors are wrong:

• B (WAF rules): A WAF is a compensating control layered on top of the server - it filters traffic but doesn't fix insecure server configurations underneath it.
• C (Network IDS): IDS is a detective control; it alerts on attacks in progress but does nothing to prevent the underlying vulnerabilities that hardening would eliminate.
• D (Patch management): Patching is important and is actually part of hardening, but hardening is the broader, holistic process - making D a subset of A, not a standalone first step.

Memory tip: Think "secure the brick before building the wall." Hardening = the brick (the server itself). WAF, IDS, and patching = the mortar and coating added afterward. You always start with the brick.

No community discussion yet for this question.