System Hardening CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security tester is assessing a legacy application server that runs a critical business application. The server has several hardening gaps: an outdated OS with known vulnerabilities, an unnecessary FTP service running, and weak password policy. The application cannot be migrated to a new server for at least six months. The tester must prioritize remediation to reduce the MOST immediate risk. Which remediation sequence should the tester recommend?

   • AApply all patches first, then disable FTP, then update the password policy
   • BEnforce a stronger password policy first, then disable FTP, then apply patches
   • CDisable the FTP service first, then apply critical security patches, then enforce a stronger password policy
   • DDisable FTP and enforce password policy simultaneously, then schedule patches for the next maintenance window
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of a configuration baseline in system hardening?

   • ATo provide a standard set of secure settings that can be applied consistently across systems
   • BTo document the history of all patches applied to a system
   • CTo record the performance metrics of a system over time
   • DTo list all users and their access rights on a system
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security tester is reviewing a newly deployed Linux web server that hosts a public-facing application. The server was built from a standard image, and the administrator claims it is hardened. During the review, the tester finds that the SSH service is listening on all interfaces, the default 'admin' user account is still present, and the system has not received security patches in 90 days. Which combination of hardening mechanisms is MOST directly missing based on this evidence?

   • AConfiguration baseline, file integrity monitoring, and log auditing
   • BPatch management, network segmentation, and encryption
   • CAccount management, application whitelisting, and vulnerability scanning
   • DService minimization, account management, and patch management
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following best describes the role of system hardening in the overall security posture of an organization?

   • AIt is primarily a regulatory compliance requirement with no direct security benefit
   • BIt is a substitute for other security controls such as firewalls and intrusion detection systems
   • CIt is a one-time activity performed during initial system deployment
   • DIt is a continuous process that adapts to new threats and changes in the system environment
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security tester is reviewing the hardening of a newly deployed server. The tester finds that the server has a host-based firewall enabled, but the firewall rules are not documented. The organization's hardening policy requires that all firewall rules be documented and reviewed. What should the tester do?

   • ADocument the rules based on the tester's own analysis and consider the issue resolved
   • BDisable the firewall until the rules are documented
   • CReport the undocumented firewall rules as a hardening gap and recommend documenting and reviewing them
   • DAccept the firewall rules because the firewall is enabled and that is the most important control
   Reveal Solution Discussion Select an answer first