Host Firewall Hardening and Least Privilege for Security+
Exhibit
Server review: - Inbound firewall policy: allow any source to any port - Web service account: domain admin - Required flows: load balancer to web service, jump host to admin port - No other inbound access should be permitted
A web server should accept traffic only from a load balancer and a management jump host. The current host firewall allows all inbound ports, and the web service runs as a domain administrator. Which two changes most improve hardening without breaking the required access pattern? Select two.
Quick Answer
The answer is to restrict the host firewall to only the load balancer and management jump host, and to run the web service under a dedicated nonadministrative service account. These two changes directly enforce host firewall hardening and least privilege by limiting inbound traffic to specific source IPs and required ports while stripping unnecessary administrative rights from the service process. On the Security+ SY0-701 exam, this scenario tests your understanding of network segmentation and the principle of least privilege as applied to both access control and service accounts—a common trap is to only fix the firewall while leaving the service running with excessive privileges. Remember the memory tip: “Lock the door and drop the keys”—restrict what comes in (firewall rules) and limit what the service can do (nonadmin account).
⚠ Common exam trap
The trap here is that candidates often focus on password strength or patching schedules while ignoring the critical need for network segmentation and least-privilege service accounts, which are the foundational controls tested in this question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict host firewall rules to required source addresses and ports.
Restricting host firewall rules to only the load balancer and management jump host's source IP addresses and required ports (e.g., HTTP/HTTPS for the load balancer, SSH/RDP for the jump host) enforces the principle of least privilege. This eliminates the risk of exposing unnecessary services to the entire network, which is a common attack vector. The current 'allow all inbound ports' configuration violates basic network segmentation and access control best practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restrict host firewall rules to required source addresses and ports.
Why this is correct
Restricting the firewall to only the needed sources and ports reduces the attack surface immediately. It enforces the trust boundary around the server and prevents unnecessary inbound exposure from other networks.
- ✓
Run the service under a dedicated nonadministrative service account.
Why this is correct
A dedicated low-privilege account follows least privilege and limits damage if the web service is compromised. The service can still function, but it no longer carries unnecessary domain administrator power.
- ✗
Leave SSH open to every subnet and rely on strong passwords.
Why it's wrong here
Open access across all subnets creates a wide attack surface. Strong passwords help, but they do not compensate for exposing management services to networks that do not need them.
- ✗
Give the service account local administrator rights so it can restart itself.
Why it's wrong here
Extra administrative rights increase the impact of compromise and are not required for a normal web service. Self-restart can usually be handled through a service manager without granting full admin privileges.
- ✗
Disable patching during business hours permanently.
Why it's wrong here
Disabling patching indefinitely hurts resilience and leaves known vulnerabilities unaddressed. Maintenance windows should be planned, not eliminated, especially for internet-facing systems.
Go deeper
Related to this question
Learn chapter
Access Control Models (DAC, MAC, RBAC)
Key term
Hardening
Hardening is the process of securing a computer system or network by reducing its attack surface, disabling unnecessary services, and applying security configurations.
Key term
Host firewall
A host firewall is a software-based security tool that runs directly on an individual device, such as a laptop, server, or desktop, to monitor and control incoming and outgoing network traffic based on a set of security rules.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During an incident, a server administrator needs elevated access to production logs for exactly two hours after manager approval. The organization does not want standing privileged accounts. Which solution is the best fit?
medium- A.Add the administrator to a permanent domain admin group so access is always available.
- ✓ B.Use just-in-time privileged access through a privileged access management workflow.
- C.Create a shared administrator account for the incident team and change the password afterward.
- D.Grant access by sending the administrator a VPN profile with broader network reach.
Why B: Just-in-time (JIT) privileged access through a Privileged Access Management (PAM) workflow is the best fit because it grants the administrator elevated permissions for exactly two hours, then automatically revokes them. This aligns with the requirement for time-limited access without maintaining standing privileged accounts, reducing the attack surface and ensuring compliance with the principle of least privilege.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.