Which of the following is typically included in system config standards?

• A. Changing vendor defaults
• B. Enabling only necessary services
• C. Removing unnecessary functionality
• D. Keeping default passwords unchanged

Answer: (C)

System configuration standards establish a secure baseline for systems to minimize risk. The best approach is to remove functionality that isn’t required, because every extra feature, port, protocol, or default setting adds potential vulnerabilities. By eliminating unnecessary functionality, you shrink the attack surface and make it easier to maintain consistent, hardened configurations across the environment. While changing vendor defaults or enabling only necessary services can be part of hardening, the overarching standard is to remove what isn’t needed; keeping default passwords unchanged is insecure and would never be part of a secure baseline.