Study. uk . com
  1. Home
  2. All questions
  3. Question 570

CISM study material · question 570 of 1000

NIST notes that many system functions and services are provided by default. What does it ask organisations to do about them?

  1. Leave them enabled unless a vulnerability is published
  2. Review them carefully to determine which are candidates for elimination, since some are not needed for essential operations
  3. Document them in the system security plan and then take no further action, since a default that has been recorded is a default that has been accepted
  4. Disable all of them and re-enable on request
Show the answer

Answer: B. Review them carefully to determine which are candidates for elimination, since some are not needed for essential operations

SP 800-100 points out that defaults ship with more than essential operations need, and asks for a careful review to work out which of those functions and services can go.

Source: NIST SP 800-100 (NIST) — Table 14-1 CM Control Family

Challenge yourself on this topic → Study as cards