Which of the following applies to newer versions of IOS that decrease their attack surface?

Modern security practices emphasize a "secure by default" posture to minimize the attack surface of a device. In line with this principle, newer versions of Cisco IOS and IOS XE ship with more non-essential services disabled by default. Services such as the HTTP server, finger, and various TCP/UDP small servers, which might have been enabled in older versions for administrative convenience, are now typically disabled. This forces administrators to explicitly enable only the services they require, reducing the number of open ports and potential vulnerabilities an attacker could exploit.

A. Telnet cannot be enabled or used: Telnet is still available for configuration in newer IOS versions for backward compatibility or specific use cases, although its use is strongly discouraged in favor of SSH.

B. The Cisco Discovery Protocol has been removed: The Cisco Discovery Protocol (CDP) remains a core, proprietary feature in Cisco IOS and is used for device discovery. It has not been removed from the operating system.

D. Two-factor authentication is default required: While newer IOS versions have robust support for two-factor authentication (2FA) via TACACS+ and RADIUS, it is not a default requirement and must be explicitly configured by an administrator.

1. Cisco Systems, Inc. (2023). Cisco Guide to Harden Cisco IOS Devices. This guide explicitly states, "Many services are enabled by default on Cisco IOS devices, some of which are not required in a regular network deployment. Every service that is running on a device is a potential attack vector." It then provides instructions for disabling services like ip finger, ip http server, and TCP/UDP small servers, which reflects the modern best practice of disabling services that are now off by default in newer releases. (Reference: "Unneeded Services" section).

2. Cisco Systems, Inc. (2023). Cisco IOS XE Security Configuration Guide, Release 17.x. In the "Configuring the HTTP Server and Client Services" chapter, the documentation for the ip http server command states, "The secure HTTP server is disabled by default." This is a specific example of a service being disabled by default in a modern IOS version to reduce the attack surface, contrasting with older versions where it was often enabled. (Reference: "HTTP Server and Client Services" section, Command Defaults).

3. Cisco Systems, Inc. (2023). Cisco IOS XE Security Configuration Guide, Release 17.x. The guide's section on "Securing User Services" details the configuration of Telnet and SSH. It confirms that Telnet is still a configurable option, stating how to create a Telnet-only access class, which would be impossible if the service were removed. (Reference: "Configuring Secure Shell" and "Configuring Telnet" sections).