Introduction to Minimizing the Attack Surface

Which statement best defines the security principle of minimizing the attack surface?

• Adding more services to improve redundancy and performance

• Reducing the number of potential entry points or vulnerabilities attackers can exploit

• Allowing broader access to increase usability for all users

• Encrypting all data at rest without changing system configuration

According to the material, which actions directly help reduce the number of ways an attacker can exploit a system?

• Enabling all optional services by default

• Minimizing running services, open ports, and exposed code base

• Sharing administrator credentials to simplify support

• Disabling network segmentation

Which action best aligns with the Principle of Least Privilege to minimize the attack surface?

• Allow all users administrator rights for convenience

• Grant users only the minimum access needed to perform their functions

• Disable all services, including essential ones

• Install additional optional modules to expand functionality

Which action best exemplifies network segmentation to limit the potential impact of a breach?

• Placing applications in containers or virtual machines

• Configuring a firewall to block all outgoing traffic

• Dividing the network into isolated parts based on function or trust level

• Enabling remote access to all internal services

A company wants to reduce exposure of internal services while allowing remote employees to connect securely. Which approach aligns with the guidance?

• Expose all services directly to the internet for convenience

• Use VPNs or other secure methods for remote access and limit service exposure

• Rely only on strong passwords without network controls

• Disable the firewall to prevent conflicts

Which security tool is specifically used to identify and address potential security weaknesses in a system?

• Intrusion Detection/Prevention Systems (IDS/IPS)

• Vulnerability Scanners

• Firewall Rules

• Encryption Algorithms

Which statement best explains how minimizing the attack surface supports regulatory compliance?

• It eliminates the need for any security controls.

• It helps meet regulatory and industry standards that require robust security practices and improves audit readiness.

• It guarantees that no security incidents will occur.

• It primarily focuses on reducing software licensing fees.

Which action best exemplifies "Service Reduction" when simplifying and hardening systems to minimize the attack surface?

• Disabling non-essential services and features

• Adding more monitoring tools to all servers

• Granting administrative rights to power users

• Enabling all default services for compatibility

Which statement best describes the principle of least privilege as part of implementing strong access controls?

• Grant users broad access to reduce support requests

• Apply the minimum necessary permissions for users to perform their tasks

• Allow temporary admin rights to all new users

• Assign access based solely on seniority

In role-based access control (RBAC), how are permissions primarily assigned?

• Individually to each user based on personal preferences

• Randomly to distribute workload

• According to predefined user roles and responsibilities

• Through automated malware detection rules