hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: During a vulnerability scan, the scanner reports…
During a vulnerability scan, the scanner reports a high number of open ports on a server that is supposed to be a hardened web server. The analyst investigates and finds that the server is running unnecessary services. Which of the following is the MOST effective long-term solution?
⚠ Common exam trap
CompTIA often tests the distinction between detection (scanning) and remediation (configuration management), and the trap here is that candidates choose a reactive control like a firewall or manual disabling instead of the proactive, automated enforcement that prevents the issue from recurring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a configuration management baseline and enforce it
Implementing a configuration management baseline and enforcing it (Option A) is the most effective long-term solution because it ensures that the server is consistently provisioned with only the necessary services and configurations. This approach uses tools like Ansible, Puppet, or Chef to automatically remediate drift, preventing unnecessary services from reappearing after manual changes or reboots. It addresses the root cause by codifying the desired state, rather than relying on ad-hoc fixes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a configuration management baseline and enforce it
Why this is correct
Implementing and enforcing a configuration management baseline directly addresses the root cause of a high number of open ports. Configuration management tools define the desired secure state for systems, specifying exactly which services should run and which ports should be open. By continuously monitoring and automatically remediating any deviations from this established baseline, it ensures consistent hardening, prevents configuration drift, and proactively closes unnecessary ports across the entire environment, significantly improving the security posture.
- ✗
Disable the unnecessary services manually
Why it's wrong here
Manually disabling unnecessary services is a highly inefficient and error-prone approach, especially in environments with numerous systems. This method lacks scalability, as administrators might inadvertently miss services, incorrectly disable critical components, or fail to apply changes uniformly across all affected machines. Furthermore, manual configurations are susceptible to being overwritten by system updates or human error, leading to configuration drift and the re-emergence of vulnerabilities without a systematic, automated enforcement mechanism.
- ✗
Increase the frequency of vulnerability scans
Why it's wrong here
Increasing the frequency of vulnerability scans is a detection-focused activity that identifies symptoms (open ports) but does not provide a solution to the underlying configuration problem. While more frequent scans might highlight issues sooner, they do not prevent services from starting unnecessarily or automatically remediate misconfigurations. This approach would primarily result in an increased volume of alerts without addressing the root cause, potentially leading to alert fatigue rather than an improved security posture.
- ✗
Install a host-based firewall to block the ports
Why it's wrong here
Installing a host-based firewall to block ports is a reactive mitigation strategy rather than a comprehensive solution for managing service configurations. While firewalls add a layer of defense by restricting network access, they do not address why unnecessary services are running and listening on those ports internally. Firewalls can be misconfigured, bypassed by local processes, or even disabled, creating a false sense of security. A firewall prevents external access but doesn't enforce a secure internal baseline for service operation.
Go deeper
Related to this question
Learn chapter
Vulnerability Scanning Techniques
Key term
Vulnerability scan
A vulnerability scan is an automated process that checks systems, networks, and applications for known security weaknesses or misconfigurations.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
This CS0-004 question is part of Courseiva's 236-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.