Security+ topic 4.1
Mitigating Controls and Hardening
In SY0-801, mitigation moves into security operations. Hardening reduces the attack surface: change default passwords, remove unneeded software, disable unused ports and services, and apply secure baselines. Segmentation and isolation keep problems contained, and an application allow list lets only approved programs run. Patching fixes known vulnerabilities. Endpoint detection and response (EDR) and host-based firewalls protect devices, and mobile device management (MDM) enforces settings on phones and tablets. Least privilege gives every account only the access it needs, and decommissioning shuts down old systems safely.
Mitigating Controls and Hardening vocabulary
- Hardening: Reducing a system's attack surface by removing or disabling what it does not need.
- Secure baseline: A standard, approved configuration that systems are built and checked against.
- Application allow list: A list of approved programs; anything not on it is blocked.
- Least privilege: Giving users and systems only the access they need to do their job.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. A new server is deployed. Which of the following is the best first step to harden it?
- (A) Leave the default admin password for easy setup
- (B) Disable unused services and ports and change default passwords
- (C) Install extra software in case it is needed later
- (D) Turn off logging
Show answer
(B) Disable unused services and ports and change default passwords Hardening removes what is not needed and changes defaults.
2. A school wants only approved programs to run on lab computers. Which of the following is the best control?
- (A) An application allow list
- (B) A deny list of known games
- (C) Full disk encryption
- (D) A honeypot
Show answer
(A) An application allow list An allow list blocks everything that is not approved.
3. Which of the following best limits the damage if a help desk account is compromised?
- (A) Giving it domain admin rights
- (B) Applying least privilege so it has only the access it needs
- (C) Sharing it among all staff
- (D) Disabling its password expiration
Show answer
(B) Applying least privilege so it has only the access it needs Least privilege limits what an attacker can do with a stolen account.
4. A company needs to enforce screen locks and remote wipe on employees' phones. Which of the following should it use?
- (A) MDM
- (B) SIEM
- (C) DLP
- (D) WAF
Show answer
(A) MDM Mobile device management enforces settings on mobile devices.