AZ-802 Secure Windows Server Infrastructure Practice Question
You are securing a Windows Server 2022 instance against potential malware. Which THREE actions are recommended to minimize the attack surface?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable unnecessary services and features.
Reducing the attack surface is a proactive security strategy that involves disabling unnecessary features and services. By removing unused software, restricting network exposure, and managing administrative privileges, you limit the vectors available for a potential intruder to gain a foothold. This process is essential for maintaining the integrity of the server and ensuring that only required code runs, thereby reducing the risk of exploitation and unauthorized system access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disable unnecessary services and features.
Why this is correct
Disabling unneeded services and features removes potential entry points and reduces the number of running processes. Each active service represents a potential vulnerability; by minimizing the count, you simplify the security footprint and significantly lower the probability of an attacker finding a weakness to exploit in background services.
- ✗
Install all available third-party toolbars and plugins.
Why it's wrong here
Installing unnecessary third-party plugins increases the attack surface by introducing additional, potentially vulnerable code onto the system. These plugins often lack rigorous security auditing compared to built-in features, making them prime targets for malware distribution and privilege escalation attacks. A secure server should only contain vetted, essential software components.
- ✓
Apply the Windows Defender Exploit Guard policy.
Why this is correct
Exploit Guard provides advanced protection against common attack techniques, such as memory corruption or script-based exploits. By applying these policies, you add a layer of behavioral analysis and blocking capabilities, ensuring the system can defend itself even if a vulnerability exists in an application or a core OS component.
- ✗
Configure Windows Firewall to allow all inbound traffic.
Why it's wrong here
Allowing all inbound traffic effectively negates the protection provided by the firewall, exposing every service on the server to the network. A secure configuration should follow the principle of least privilege, explicitly allowing only necessary ports and protocols while denying all other traffic by default to prevent unauthorized access.
- ✓
Implement AppLocker or Windows Defender Application Control.
Why this is correct
AppLocker and WDAC allow you to create an allow-list of approved applications, preventing unauthorized or malicious executables from running. This is a powerful control that stops malware even if it manages to bypass other perimeter defenses, as the operating system will refuse to execute any code not explicitly authorized.
About these practice questions
One of 116 original AZ-802 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.