easyMultiple ChoiceObjective-mapped
CS0-003 Practice Question: Needs to implement a baseline configuration for…
A security engineer needs to implement a baseline configuration for all new Linux servers. Which of the following should be included in the baseline to reduce the attack surface?
⚠ Common exam trap
CompTIA often tests the distinction between preventive controls (reducing attack surface) and detective or corrective controls (logging, encryption), leading candidates to choose strong password policies or audit logging as the primary method to reduce attack surface.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable all unnecessary services and daemons.
Disabling all unnecessary services and daemons directly reduces the attack surface by eliminating potential entry points for exploitation. Each running service represents a vector for attacks, such as buffer overflows or misconfigurations, and removing them minimizes the number of listening ports and active processes. This aligns with the principle of least functionality, a core security baseline for Linux servers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable strong password policies for all users.
Why it's wrong here
Enabling strong password policies, including complexity requirements and regular rotation, significantly enhances the security of user authentication. While crucial for preventing unauthorized access via brute-force attacks or credential stuffing against existing login interfaces, this measure does not reduce the overall attack surface. The login mechanism itself remains an exposed entry point; strong passwords merely make it more resilient to specific types of credential-based attacks.
- ✗
Enable comprehensive audit logging.
Why it's wrong here
Implementing comprehensive audit logging is a critical detective control that provides invaluable visibility into system activities and potential security events. It facilitates threat detection, forensic analysis, and compliance reporting by recording system access, changes, and errors. However, audit logging does not proactively reduce the number of potential entry points or vulnerabilities an attacker can exploit, thus it does not shrink the attack surface.
- ✓
Disable all unnecessary services and daemons.
Why this is correct
Disabling services and daemons that are not essential for the system's intended function directly reduces the attack surface. Each active service typically listens on specific network ports or exposes APIs, creating potential entry points and increasing the likelihood of discovering exploitable vulnerabilities. By removing these unneeded components, an organization eliminates potential vectors for compromise, adhering to the principle of least functionality.
- ✗
Configure disk encryption for all data volumes.
Why it's wrong here
Configuring disk encryption for all data volumes is an essential control for protecting data confidentiality, particularly data at rest, against unauthorized access or physical theft. While vital for data security, encryption primarily protects the information *after* a system has been compromised or physically accessed. It does not reduce the number of network-accessible services, open ports, or software vulnerabilities that an attacker could exploit to gain initial access to the system, thus it does not reduce the attack surface.
Go deeper
Related to this question
Learn chapter
Security Metrics and KPIs
Key term
Attack surface
The attack surface is the total sum of all points in a system, network, or application where an unauthorized user can try to enter or extract data.
Key term
Security baseline
A security baseline is a documented minimum set of security configurations and settings that must be applied to a system, device, or network to ensure a known secure starting point.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.