61. Which of the following security practices best describes these recommendations?
Answer: A
Attack surface reduction
The recommendations provided focus on minimizing potential entry points for attackers, which is the essence of attack surface reduction. By decommissioning unused web servers, closing open ports, and removing sensitive information from public records, the company is actively reducing its exposure to threats.
A) Attack surface reduction
This option is correct because it directly aligns with the recommendations given. Each action—decommissioning web servers, closing unused ports, and removing sensitive information—aims to lessen the overall attack surface by eliminating unnecessary assets and information that could be exploited by malicious actors.
B) Vulnerability assessment
This option is incorrect as a vulnerability assessment involves identifying, quantifying, and prioritizing vulnerabilities in a system. While the recommendations may be informed by the findings of a vulnerability assessment, they are more about taking proactive steps to reduce exposure rather than assessing existing vulnerabilities.
C) Tabletop exercise
This option is not applicable here. A tabletop exercise is a discussion-based session where team members walk through a simulated emergency situation to improve response strategies. The recommendations do not involve creating or testing response plans but rather implementing specific security measures.
D) Business impact analysis
This option is also incorrect. A business impact analysis is focused on identifying the effects of disruptions to business operations and determining how to prioritize recovery efforts. The recommendations do not pertain to assessing business continuity or operational impacts but rather to enhancing security posture.
Conclusion
The focus of the recommendations on reducing exposure to potential attacks clearly aligns with the concept of attack surface reduction. All other options, including vulnerability assessment, tabletop exercise, and business impact analysis, do not pertain to the proactive measures aimed at minimizing security risks as described in the extract. Thus, option A is the most suitable choice.