Which components should be included in a server security evaluation?

• A. System types, system operations, system hardening, and security operations
• B. User training program and helpdesk response
• C. Physical security of the building
• D. Software licensing inventory

Answer: (A)

Evaluating server security focuses on the server itself and how it is managed and protected. Start by identifying the server types and configurations—physical, virtual, or cloud, along with operating systems and roles—so you know what controls are appropriate and where risks may lie. Then look at how the server is operated: how patches are applied, how backups and recovery are handled, and how changes are managed. Next, assess how the server is hardened: minimizing open services, applying secure configurations, enforcing strong authentication, restricting privileged access, and ensuring secure firewall and network settings are in place. Finally, review security operations: logging and monitoring, alerting, incident response procedures, and how the server’s security data feeds into overall monitoring and response processes. These elements together create a complete view of the server’s security posture. While user training, physical building security, and software licensing are important to security in general, they’re not the core components of a server security evaluation.