Which of the following is the best security reason for closing service ports that are not needed?

Question

Options

• ATo mitigate risks associated with unencrypted traffic
• BTo eliminate false positives from a vulnerability scan
• CTo reduce a system's attack surface
• DTo improve a system's resource utilization

• A
  2% (1)
• B
  2% (1)
• C
  90% (43)
• D
  6% (3)

Explanation

Closing unused service ports directly reduces the attack surface - the set of entry points an attacker can exploit - because every open port is a potential vector for exploitation, unauthorized access, or service abuse. A is wrong because port closure isn't about encryption; unencrypted traffic on a needed port would still require a different control (like TLS). B is wrong because open ports that are genuinely vulnerable produce true positives, not false ones - closing them eliminates real risks, not scan noise. D is wrong because while fewer listening services can marginally free resources, that's an operational benefit, not a security rationale, and it's not the primary reason security policy mandates port closure.

Memory tip: Think of open ports as unlocked doors on a building - closing unnecessary ones doesn't soundproof the building (A) or fool the alarm system (B/D), it simply gives attackers fewer doors to try. "Fewer doors = smaller attack surface."

No community discussion yet for this question.