Systems That Have Default Configurations Are Common Targets During a Pentest

Multiple Choice

Systems that have default configurations are common targets during a pentest. Which of the following is not a default configuration?

A) Setup a webserver that uses a secondary that only invited users will know about
B) Keeping the directory structures the same as installed, for easier maintenance
C) Allowing the sample pages of the webserver to remain so as not to confuse anyone until the real site is built
D) Keeping the default user accounts to make sure access is always available.