Server hardening PBQs test your ability to secure system configurations by applying security baselines, disabling unnecessary services, and reducing the attack surface. This guide teaches you the systematic approach to identifying and fixing insecure configurations.
Interactive simulation — no account required
Server hardening PBQs present you with a system configuration and ask you to identify security weaknesses or select the correct hardening actions. You'll analyze settings like running services, open ports, user accounts, and security policies to find vulnerabilities.
These questions test whether you can apply the principle of reducing attack surface. You might be asked to:
Every running service, open port, and installed application is a potential attack vector. Hardening means disabling or removing everything that isn't required for the server's specific function. If a web server doesn't need FTP, disable FTP. If it doesn't need a GUI, remove it.
Systematically evaluate server configurations using this approach:
Different servers have different legitimate services. Know what each type needs:
Needs HTTP/HTTPS. Probably needs SSH for admin. Remove FTP, Telnet, SMB, unnecessary scripting engines.
Ports: 80, 443, 22 (admin only)
Remove: GUI, development tools, sample appsNeeds database port (3306, 1433, 5432). Should NOT be directly accessible from internet.
Ports: DB port (internal only), 22 (admin)
Remove: Web server, FTP, direct internet accessNeeds SMB/CIFS (445) or NFS. Restrict to internal network only.
Ports: 445, 22 (admin)
Remove: Web services, database, external accessNeeds AD ports: LDAP, Kerberos, DNS, SMB. Highly sensitive—minimal additional services.
Ports: 53, 88, 389, 445, 636
Remove: Everything else. No web browsing.A newly deployed web server needs hardening review. The audit reveals several security issues that must be addressed:
FTP and Telnet must go. FTP transmits credentials in cleartext. Telnet is completely unencrypted. Neither is needed on a web server. Disable the services and close ports 21 and 23.
CUPS is unnecessary. A web server doesn't print. Every unnecessary service is potential attack surface. Remove it.
Default admin account is a target. Attackers know default account names. Rename it to something non-obvious or disable it entirely.
Root SSH is dangerous. If SSH is compromised, the attacker has immediate root access. Disable root login; admins should SSH as regular users and use sudo.
Server signature reveals information. Advertising "Apache 2.4.52" helps attackers find known vulnerabilities. Disable ServerSignature and ServerTokens.
Audit configurations and identify security weaknesses in interactive scenarios.
The exam references several security baseline standards. Know what they are:
CIS Benchmarks — Center for Internet Security provides detailed hardening guides for operating systems, applications, and cloud platforms. Widely used in industry.
DISA STIGs — Defense Information Systems Agency Security Technical Implementation Guides. Required for US government systems. Very detailed and strict.
Microsoft Security Baselines — Recommended Group Policy settings for Windows systems. Good starting point for Windows hardening.
Vendor Hardening Guides — Most software vendors publish security configuration guides. Oracle, Apache, Nginx all have hardening documentation.
When a PBQ mentions "industry standard baseline" or "CIS compliant," it's asking you to apply recognized hardening practices rather than inventing your own.
These actions apply to almost any server:
Watch for these frequently misconfigured settings:
Default credentials — Many appliances and applications ship with admin/admin or similar. Always change these.
Open management interfaces — Web consoles, SSH, RDP accessible from anywhere. Restrict to management network.
Verbose error messages — Stack traces and debug info help attackers. Show generic errors to users.
Directory listing enabled — Web servers showing directory contents expose file structure. Disable this.
Unnecessary file permissions — World-writable directories, overly permissive shares. Apply least privilege to file systems.
Unencrypted protocols — HTTP instead of HTTPS, FTP instead of SFTP, Telnet instead of SSH. Always encrypt.
A server hardening PBQ presents you with a server configuration (running services, open ports, user accounts, settings) and asks you to identify security weaknesses or select appropriate hardening actions. The goal is to reduce the attack surface by disabling unnecessary features and applying security baselines.
Attack surface is the sum of all points where an attacker could potentially enter or extract data from a system. Every running service, open port, user account, and installed application expands the attack surface. Hardening reduces attack surface by eliminating unnecessary components.
A security baseline is a documented set of security configurations that meet minimum security requirements. Organizations like CIS (Center for Internet Security) publish benchmarks for various operating systems and applications. Applying a baseline ensures consistent, known-good security settings.
Defense in depth. A firewall blocking port 21 stops external FTP access, but if an attacker gains internal access, FTP is still running. Disabling the service means it can't be exploited even if network controls fail. Both measures together provide layered security.
Apply these concepts with an interactive Server Hardening simulation.