4.3 Given a scenario, apply network security features, defense techniques, and solutions
Device Hardening
📘CompTIA Network+ (N10-009)
What Are Default Passwords?
A default password is a username/password combination that comes preconfigured on many devices, systems, and services.
These are usually set by vendors to make setup easier. Examples in IT systems include:
- Default admin passwords on firewalls
- Default login credentials on network switches
- Default passwords for virtual appliances
- Default credentials for web-based management interfaces
These default credentials are widely known, easy to guess, and often publicly listed on support websites or documentation.
This means attackers are aware of them.
Why Changing Default Passwords Is Critical
Leaving a default password unchanged creates a major security risk. Attackers often try these default credentials first when attempting to access:
- Virtual machines
- Storage devices
- Containers
- IoT devices
- Network appliances
- Azure virtual appliances or templates you deploy
Risks of Not Changing Default Passwords
- Unauthorized access
Attackers can log in and control the device or service. - Misuse of resources
For example, attackers might use your VM for malicious activity. - Data exposure
Sensitive files or configurations could be accessed. - Privilege escalation
A default admin password often gives full control. - Spread of attacks
Attackers may use one compromised device to access others in your environment.
For exam purposes, remember this:
Default passwords are one of the easiest ways attackers gain initial access. Changing them is one of the simplest hardening techniques.
Where You Must Change Default Passwords (AZ-104 Focus)
As an Azure Administrator, you will manage multiple resources that require password changes. Below are IT-related examples relevant to your role.
1. Azure Virtual Machines
- When deploying Linux or Windows VMs, never keep default admin credentials.
- Always create a strong admin username and password or use SSH keys.
2. Azure Virtual Network Appliances
Examples include:
- Firewalls
- Load balancers
- VPN gateways
- Security appliances deployed from Azure Marketplace
Many of these appliances come with default login credentials until you configure them.
You must change these immediately after deployment.
3. On-premises to Azure hybrid devices
Examples:
- Azure AD Connect server
- VPN devices
- ExpressRoute routers
Any device used in hybrid networking may ship with default credentials.
4. IoT Devices Integrated with Azure
IoT devices and controllers often include default usernames and passwords that must be changed before connecting them to your Azure environment.
5. Storage Systems and Management Interfaces
Some cloud storage gateways or controllers use default admin accounts.
How to Properly Change Default Passwords
For the exam, know these best practices:
1. Change the password during initial configuration
Do not wait until after deployment.
2. Create strong passwords (Azure Recommended)
- At least 12–16 characters
- Mix of uppercase, lowercase, numbers, and symbols
- Avoid dictionary words
3. Do not reuse old passwords
Each service or device should have a unique password.
4. Disable or remove default accounts if possible
If a device allows disabling the default admin account, do it.
5. Use Azure Key Vault to store credentials
This helps secure passwords instead of storing them in plain text.
6. Enforce password rotation policies
Azure AD provides password policy options such as complexity, history, and expiration.
How Azure Helps Improve Password Security
As an Azure Administrator, you should know the built-in services that help enforce strong password practices:
1. Azure AD Password Protection
- Blocks weak or commonly used passwords
- Uses Microsoft’s global banned password list
- Allows you to create a custom banned password list
2. Azure AD Authentication Methods Policy
Allows use of:
- Passwordless authentication
- Multi-Factor Authentication (MFA)
- FIDO2 security keys
- Authenticate apps
This reduces dependency on passwords.
3. Azure Policy
You can apply policies to ensure:
- VMs are deployed with non-default admin usernames
- Secure configurations are enforced
Exam Tips for This Topic
Memorize the following points:
✔ Default passwords must always be changed during setup
✔ Leaving default credentials is a major security vulnerability
✔ Cloud appliances from Azure Marketplace may include default accounts
✔ Use strong, unique passwords (or passwordless methods)
✔ Store credentials securely in Azure Key Vault
✔ Disable default accounts when possible
✔ Azure AD Password Protection helps enforce strong password usage
This topic is commonly tested in questions involving:
- Device hardening
- Securing VMs
- Protecting Azure services
- Preventing unauthorized access
- Initial configuration of network devices
Summary
Changing default passwords is one of the simplest, fastest, and most effective ways to harden devices and secure your Azure environment. Default credentials are widely known and extremely vulnerable, so replacing them with strong, unique passwords (or using passwordless authentication) is essential for maintaining security.
This is a core concept for both real-world Azure administration and the AZ-104 exam.
