SSCP Systems and Application Security Practice Question
A system administrator is applying CIS Benchmarks to a Windows server. Which TWO hardening measures are typically recommended by CIS? (Select TWO.)
⚠ Common exam trap
The trap here is that 'enable all features' sounds like maximum functionality, but hardening exams consistently test that CIS Benchmarks are about minimization — fewer services, fewer features, stronger authentication, and more logging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforce strong password policies
Option C (Enforce strong password policies) is correct because CIS Benchmarks for Windows Server explicitly require configuring account policies such as minimum password length (typically 14 characters), password complexity, maximum password age, and password history to reduce the risk of brute-force and credential-guessing attacks. Option D (Disable unused services) is correct because CIS hardening guidance mandates disabling or setting to Disabled any unnecessary services (e.g., Fax, Windows Search, Remote Registry) to shrink the attack surface and eliminate unneeded listening ports and privileged functionality. Option A is wrong because enabling all Windows features by default directly contradicts CIS least-functionality principles, which call for removing or not installing unneeded roles and features. Option B is wrong because CIS Benchmarks require enabling and configuring audit logging (e.g., via Advanced Audit Policy) to capture security-relevant events, not disabling it. Option E is wrong because allowing anonymous enumeration of SAM accounts is a known information-disclosure weakness that CIS explicitly prohibits by requiring the Anonymous Enumeration of SAM Accounts and Shares setting to be Disabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable all Windows features by default
Why it's wrong here
Enabling all Windows features by default directly contradicts CIS Benchmark guidance, which requires disabling unnecessary roles, services and features to shrink the attack surface. It is tempting because a full installation guarantees application compatibility, and that approach suits general-purpose build images where broad functionality matters more than hardened configuration.
- ✗
Disable audit logging
Why it's wrong here
Disabling audit logging removes the event records CIS relies on to detect control failures, directly contradicting benchmark requirements that mandate enabling specific audit policies. It is tempting because audit logs consume disk space and add overhead, so disabling them can appear to reduce resource usage — a trade-off sometimes considered in tightly constrained lab or test environments.
- ✓
Enforce strong password policies
Why this is correct
Strong password policies enforce complexity, length and expiry through Group Policy, blocking weak credentials that brute-force and credential-stuffing attacks exploit. CIS Benchmarks recommend this account-policy hardening for Windows servers, satisfying the stem's requirement for a typically recommended measure.
- ✓
Disable unused services
Why this is correct
Disabling unused services removes unnecessary listening ports and attack surface from the Windows server. CIS Benchmarks recommend this service-hardening measure, satisfying the stem's requirement, because each disabled service eliminates potential exploitation paths that attackers could otherwise target.
- ✗
Allow anonymous enumeration of SAM accounts
Why it's wrong here
CIS Benchmarks require anonymous SAM account enumeration to be disabled, since it exposes usernames to unauthenticated attackers. Enabling it directly contradicts that hardening baseline. It is tempting because legacy applications and pre-Windows 2000 compatibility sometimes rely on anonymous enumeration for domain trust and share discovery, where it would be the deliberate choice.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.