What should be verified regarding vendor defaults and default accounts before installing a system on the network?

• A. Vendor defaults should be left unchanged.
• B. All vendor defaults are changed before installation, and unnecessary default accounts are removed or disabled.
• C. Only some vendor defaults are changed.
• D. Default accounts should be left for troubleshooting.

Answer: (B)

Before putting a system on the network, you should harden it by changing vendor defaults and removing or disabling unnecessary default accounts. The main idea is to start with a unique, tightly controlled baseline so attackers can’t guess or reuse built-in credentials to gain access.

Vendor defaults are widely known and often documented for easy access. If those defaults remain in place, an attacker can exploit them to gain initial access or escalate privileges with little effort. By changing all vendor defaults and removing or disabling default accounts that aren’t needed, you drastically reduce the attack surface and lower the chance of an easy breach during deployment.

Leaving defaults unchanged leaves obvious, predictable weaknesses that PCI DSS and secure configuration practices require you to address. Changing only some defaults still leaves gaps, and keeping default accounts for troubleshooting creates predictable gateways an attacker could exploit. In practice, you should establish a secure baseline by altering all defaults and ensuring only necessary accounts are enabled, with strong authentication and documented, approved access methods for any troubleshooting needs.