What is attack surface and how can you reduce it?

• A. The total number of devices connected to the network.
• B. The physical surface area of the data center.
• C. The set of points where an attacker can interact with a system; reduce by minimizing exposed endpoints, removing unused services, and implementing network segmentation.
• D. The time to patch all vulnerabilities.

Answer: (C)

Attack surface is the set of points where an attacker can interact with a system. Each exposed endpoint, service, API, or interface represents a potential entry path that an attacker could try to exploit. Reducing it happens by closing or limiting those paths: minimize exposed endpoints by turning off or restricting services and ports that aren’t needed, remove unused services and features, and implement network segmentation so that even if an attacker gains access to one area, they’re limited from moving freely to others. This approach lowers the number of opportunities an attacker has and tightens control over how different parts of the system talk to each other.

For context, think of every open port, every active API, and every remote management interface as a possible door into the system. Closing doors, removing unnecessary doors, and separating spaces so a breach in one area doesn’t give a path to everything else are practical ways to cut down the attack surface. Patching frequency or the sheer count of devices are important for risk, but they don’t define what the attack surface is or how to shrink it directly.