The first thing to do is reduce the attack surface by disabling or removing services you don’t need and closing ports you don’t require. A freshly provisioned Linux VM often starts with multiple services enabled by default or from the image, and each active service or listening port can be a potential entry point for attackers. By auditing what’s running and which ports are open, then turning off unneeded services and blocking those ports with a firewall, you limit how an attacker could reach the system. This sets a safer baseline for later hardening steps and ensures only the essential components are exposed. In practice, you’d check which services are enabled and actively running, stop and disable those that aren’t required for your workload, and remove unnecessary packages if appropriate. Then verify open ports and limit access to only what’s necessary, using firewall rules or security groups. After this, you can enable and harden the required services with secure configurations, proper authentication, and monitoring. Why the other ideas don’t fit: adding more services only increases risk, leaving all services enabled maintains a broad attack surface, and enabling root login over SSH gives direct administrator access and is a well-known security risk—use a non-root user with sudo and prefer key-based authentication.

Data sovereignty means laws require data to be stored and processed within specific borders. That directly influences cloud provider selection and how you design data architecture. When choosing a provider, you look for those that offer data residency options in the required region and that provide contracts, audits, and controls that align with local regulations. For the data architecture, you must design to keep data in the permitted region, which may involve regional data stores, regional backups and disaster recovery, and limiting cross-border data transfers. You might also manage encryption keys within the same region or under a jurisdiction-approved key management approach, and you’ll need to assess whether regional replication is allowed and how it impacts latency and privacy obligations. In short, data sovereignty drives both where you host data and how you structure data flows and protections across regions.

Full backups perform a complete copy of all designated data every time the job runs. This means each backup session captures every file, regardless of what was backed up before, creating a self-contained restore point. Because you don’t rely on previous backups to reconstruct the data, restores can be done from that single backup image. The trade-off is that full backups take longer and use more storage, since every run duplicates all data. In contrast, differential backups copy only what changed since the last full, and incremental backups copy only what changed since the previous backup, which is why they don’t match the “copy everything every time” behavior. Synthetic backups, while involving full images, are created by assembling data from earlier backups rather than copying all data anew on every run.

Monitoring a single server for malicious behavior and stopping it on the host is a host-based prevention capability. A Host-based Intrusion Prevention System runs on the individual server and watches for suspicious activity at the system and application level, such as unusual process creation, file or registry changes, or unauthorized access attempts. When it detects something malicious, it can block the action in real time, terminate processes, or tighten controls directly on that machine, stopping the threat where it originated. An IDS provides detection and alerts about potential attacks, but it typically doesn’t automatically prevent or halt activity on the host. A SIEM gathers and correlates logs from many sources to provide broader visibility and incident response, not real-time host blocking. An IPS focuses on inspecting and blocking traffic at the network level, preventing threats from traversing the network path rather than controlling the behavior of a single host’s processes.