AP Cybersecurity Drill 19: Device Hardening Checklist

Question 1. Which checklist item most directly leaves known software flaws unpatched on these laptops?

• A) Operating-system updates are manual and often skipped on the devices ✓
• B) The host firewall has been turned off on each of the laptops
• C) The default administrator account is enabled with its default password
• D) Unused services and ports have all been left switched on

Explanation: Choice A is correct. Skipped updates mean published fixes for known vulnerabilities are never applied, so those flaws stay open. Choice B is incorrect. A disabled firewall widens network exposure but does not itself leave code unpatched. Choice C is incorrect. A default admin account is a credential weakness, not an unpatched-software issue. Choice D is incorrect. Extra open services enlarge the attack surface but are separate from missing patches.

Question 2. Which change best reduces the chance that a known vulnerability stays unpatched?

• A) Turn the host firewall back on for every laptop out on the sales floor
• B) Disable the extra services and ports the laptops do not need
• C) Set operating-system updates to install automatically on a schedule ✓
• D) Rename the default administrator account to a less obvious label

Explanation: Choice C is correct. Automatic scheduled updates apply published fixes promptly without relying on someone remembering, closing known vulnerabilities as they are released. Choice A is incorrect. A firewall filters traffic but does not patch software. Choice B is incorrect. Disabling unused services shrinks the attack surface but does not apply patches. Choice D is incorrect. Renaming the admin account does little, since the default password remains the real weakness.

Question 3. With the host firewall off, which sign would most likely reveal unwanted inbound connections to a laptop?

• A) A pop-up announcing that the operating system finished a routine update
• B) A monitoring log showing outside addresses reaching unexpected open ports ✓
• C) A reminder that the default administrator password has not yet been changed
• D) A note that several unused background services are still set to run on startup

Explanation: Choice B is correct. With no firewall filtering, monitoring that shows external addresses connecting to open ports is the direct evidence of unwanted inbound traffic. Choice A is incorrect. An update notice reflects patching status, not inbound connections. Choice C is incorrect. A password reminder concerns credentials, not live connections. Choice D is incorrect. A note about unused services describes attack surface, not observed inbound traffic.

Question 4. What is the best way to address the default administrator account?

• A) Leave it enabled but rely on the host firewall alone to block any misuse
• B) Keep the default password but limit the account to daytime working hours only
• C) Email the default password to all floor staff so that logins are never delayed
• D) Disable it, or set a strong unique password and tightly restrict its use ✓

Explanation: Choice D is correct. Disabling the account, or setting a strong unique password and tightly restricting its use, removes a widely known, easily guessed entry point. Choice A is incorrect. A firewall does not stop someone who logs in with valid default credentials. Choice B is incorrect. Keeping the default password leaves the account guessable regardless of hours. Choice C is incorrect. Sharing the password broadly makes the weakness worse.

Question 5. Why does turning off unused services and ports improve the security of these laptops?

• A) It guarantees the operating system will always update itself without any prompting
• B) It shrinks the attack surface, leaving fewer entry points for an attacker ✓
• C) It fully replaces the need for a host firewall on each deployed laptop
• D) It changes the default administrator password to a strong, unique value

Explanation: Choice B is correct. Each running service or open port is a possible way in, so disabling the ones not needed reduces the number of targets an attacker can probe. Choice A is incorrect. Closing ports does not control how updates are applied. Choice C is incorrect. Reducing services complements but does not replace a firewall. Choice D is incorrect. Disabling services does not alter the admin password.