Which installation practice is required for vendor defaults?

• A. Vendor defaults should be left as provided.
• B. Vendor defaults should be partially changed.
• C. All vendor defaults should be changed before installation.
• D. Vendor defaults can be changed after a year.

Answer: (C)

Vendor-default configurations and credentials create predictable entry points for attackers, so it’s essential to change all vendor defaults before the system is installed. By updating default passwords, usernames, and security parameters, you remove widely known access paths and reduce the attack surface, which is exactly what PCI DSS requires before a system becomes active on the network. Leaving defaults as provided leaves known credentials and settings in place, making compromise far easier; partially changing or delaying changes still leaves significant risks. Therefore, changing all vendor defaults prior to installation is the best practice to ensure a secure deployment.