Which practice is explicitly recommended in system config standards?

• A. Implementing only one primary function per server
• B. Enabling multiple primary functions on a single server
• C. Enabling unnecessary services
• D. Using vendor defaults

Answer: (A)

Configuring systems to do only what is necessary for their role reduces the potential entry points an attacker can exploit. When a server has a single primary function, you can harden and monitor it more effectively, keep software up to date for that specific function, and limit which services and accounts are active. This tight focus lowers the overall risk and makes compliance easier to demonstrate.

Why this is the best fit: limiting a server to one primary function directly aligns with system configuration standards that aim to minimize the attack surface and simplify secure hardening. It prevents the complexities and risks that come with running multiple roles on one machine.

Choosing multiple primary functions on a single server increases complexity and exposure, while enabling unnecessary services adds more potential vulnerabilities. Relying on vendor defaults often carries preenabled features and insecure baselines that don't meet hardened configuration requirements.