SY0-701 Security Architecture Practice Question
After a server rebuild, a Windows administrator notices several unneeded services are still enabled, including Remote Registry and Print Spooler on a server that only hosts a database. What should the administrator do to reduce attack surface and keep the build consistent?
⚠ Common exam trap
A common mix-up: candidates think adding monitoring or moving subnets compensates for insecure configurations, but the SY0-701 exam emphasizes that reducing attack surface requires removing unnecessary services, not just detecting or isolating them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply the approved secure baseline and disable unnecessary services.
Applying an approved secure baseline and disabling unnecessary services (Option B) directly reduces the attack surface by removing potential entry points like Remote Registry (which allows remote modification of the registry) and Print Spooler (which has known privilege escalation vulnerabilities, e.g., CVE-2021-34527). This also ensures build consistency by enforcing a standardized configuration across all servers, which is critical for compliance and manageability in a Windows environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install additional endpoint monitoring agents to compensate for the extra services.
Why it's wrong here
Endpoint detection and response (EDR) or monitoring agents improve visibility into process behavior, network connections, and indicators of compromise, but they are a detective control, not a preventative or corrective control. Observing the extra services does not reduce the attack surface or eliminate the risk posed by software that is not required; the services remain active and exploitable. Additional agents also add management overhead and may introduce performance or compatibility issues.
- ✓
Apply the approved secure baseline and disable unnecessary services.
Why this is correct
An approved secure baseline (e.g., CIS Benchmarks or Microsoft Security Baseline) specifies the required configuration settings, including which services, roles, and features must be disabled or removed to minimize the attack surface. By comparing the rebuilt server to this baseline and then stopping or removing non-essential services, the administrator directly eliminates unnecessary listening ports, background processes, and potential privilege escalation vectors. This is the proper remediation because it addresses the root cause: the server is running services beyond what its role requires.
- ✗
Increase the disk encryption key size to protect the running services.
Why it's wrong here
Full-disk encryption (e.g., BitLocker) with a larger key size (e.g., AES-256 vs. AES-128) protects the confidentiality of data at rest against offline threats like disk theft, but it has no effect on the runtime state of active network services. The extra services are listening and running, so an attacker can exploit vulnerabilities in those services regardless of cryptographic key length. Encryption is a data-at-rest control, not a live attack-surface reduction measure.
- ✗
Move the server to a different subnet and leave the configuration unchanged.
Why it's wrong here
Network segmentation can limit which hosts can reach the server, thereby reducing the number of potential attackers, but it does not remove the vulnerable services themselves. If the server still runs unneeded services, any compromised adjacent host or a misconfigured ACL could allow access to those services, and they may remain reachable to a broader set of users than intended. Also, moving subnets may break legitimate functionality or require firewall adjustments, and it leaves the underlying hardening deficiency unresolved.
Go deeper
Related to this question
Learn chapter
Secure Network Design Principles
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Attack surface
The attack surface is the total sum of all points in a system, network, or application where an unauthorized user can try to enter or extract data.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.