Which statement best describes 'secure-by-default' settings?

• A. Systems are deployed with secure configurations and minimal access right away.
• B. Systems default to open access.
• C. Default settings vary by user.
• D. Security features are optional by default.

Answer: (A)

Secure-by-default means the system ships with strong security settings already in place and with the least privileges granted out of the box. This approach lowers the attack surface because services run with only the permissions they need, authentication and access controls are configured tightly, and security features are enabled by default unless you explicitly change them. That’s why describing systems as deployed with secure configurations and minimal access right away is the best fit.

Open access by default would increase exposure, contradicting secure-by-default. Defaults that vary by user lack a consistent, secure baseline. Making security features optional by default means security isn’t guaranteed when the system is first deployed.