Which statement best describes the required validation before installing a system on the network regarding vendor defaults and default accounts?

• A. All vendor defaults are changed before installation.
• B. Unnecessary default accounts are allowed if not used.
• C. All vendor defaults are changed and unnecessary default accounts removed or disabled before installation.
• D. Vendor defaults can be left as is.

Answer: (C)

Before placing a system on the network, you must establish a secure starting point by hardening vendor defaults and pruning accounts. Vendor-supplied defaults are widely known and often used as an easy entry point for attackers. If these defaults remain, or if default accounts that aren’t needed stay enabled, the system has predictable access paths that can be exploited. The best practice is to change all vendor defaults and remove or disable any unnecessary default accounts before installation. This minimizes the attack surface from day one and ensures a solid security baseline for ongoing configuration.