Question
New devices were deployed on a network and need to be hardened. The network contains a cloud network (SQL server, web server and Linux server), a firewall, a switch, a wireless controller, a workstation, two wireless access points (WAP-1 and WAP-2) and user accounts.
For each device, select the appliance-hardening technique that provides the most secure solution.
Explanation
On the SQL server, role-based access control with least privilege limits who can read or change data; blocking port 1433 would break the database service and enabling all services widens the attack surface. On the web server, enforcing TLS 1.3 protects the traffic users send, while basic authentication and disabling HTTPS weaken it. On the Linux server, disabling direct root access forces administrators to use individual accounts and privilege escalation; disabling SELinux removes a protection. On the firewall, limiting administrative access to its management interfaces keeps attackers away from the device that enforces policy; an implicit allow posture is the opposite of the default-deny rule a firewall should apply, and disabling remote management or SSH would cut off secure administration. On the switch, disabling unused ports stops anyone from plugging in an unauthorized device. On the wireless controller, a RADIUS server gives centralized 802.1X authentication instead of local log-ins or default SNMP communities. On the workstation, enabling OS updates keeps it patched, whereas VNC and remote management add exposure. On WAP-2, MAC filtering is the only option that restricts access (SSLv2 is broken and bridge mode is not a control). For user accounts, password complexity strengthens credentials, while the other choices weaken them. On WAP-1, WPA3 is the current strongest Wi-Fi security; 802.11b is obsolete.
