Which of the following describes how to enable services on a system?

Which of the following describes how to enable services on a system?

• A. Enable only necessary services, protocols, and daemons as required for the function of the system.
• B. Enable all services to minimize downtime.
• C. Disable services only after a breach.
• D. Enable extra services to support future expansion.

Answer: (A)

The main idea is to minimize the system’s attack surface by running only the services that are truly needed. In practice, enabling only the necessary services, protocols, and daemons keeps the system functional while reducing the number of potential entry points for attackers. Each extra service can introduce vulnerabilities, misconfigurations, or default credentials, and it complicates monitoring and patching. This approach aligns with hardening principles and the PCI DSS goal of limiting functions to what is required for the system’s purpose. Enabling all services to avoid downtime or enabling extra services for future expansion clashes with secure configurations, because it broadens exposure and increases risk. Waiting to disable services until after a breach is reactive and leaves the system vulnerable in between. A proactive, least-functionality stance is the best practice.

The main idea is to minimize the system’s attack surface by running only the services that are truly needed. In practice, enabling only the necessary services, protocols, and daemons keeps the system functional while reducing the number of potential entry points for attackers. Each extra service can introduce vulnerabilities, misconfigurations, or default credentials, and it complicates monitoring and patching. This approach aligns with hardening principles and the PCI DSS goal of limiting functions to what is required for the system’s purpose.

Enabling all services to avoid downtime or enabling extra services for future expansion clashes with secure configurations, because it broadens exposure and increases risk. Waiting to disable services until after a breach is reactive and leaves the system vulnerable in between. A proactive, least-functionality stance is the best practice.