How can the DevOps Engineer prevent any user from logging in with the default admin credentials during startup of the AEM instance?

How can the DevOps Engineer prevent any user from logging in with the default admin credentials during startup of the AEM instance?

• A. Change the default AEM admin password on initial setup.
• B. Disable the OSGi web console login bundle by using the production ready runmode.
• C. Configure the dispatcher to prevent access to /system/console.
• D. Update the default password in the OSGi configuration for the OSGi web console.

Answer: (A)

The key idea is to remove the widely known default credentials before the instance becomes exposed. In AEM, the admin account often ships with a default password that attackers can guess, so if you boot up with that known pair, someone could gain admin access as soon as the instance starts. Changing the default AEM admin password during the initial setup directly tackles this risk by ensuring no one can log in with a well-known credential, no matter which access path they try (the author interface, CRX/DE, or the OSGi/web console). Relying on a production run mode to disable the OSGi web console login bundle isn’t a dependable safeguard, and it doesn’t replace the need to secure the actual admin credentials. Blocking access to /system/console via the dispatcher can reduce exposure, but it only hides the console while still leaving other entry points open and using the default password elsewhere. Updating a single OSGi web console setting doesn’t address the broader problem of the default admin password being known and usable across the system. The clearest, most robust preventive measure is to change the admin password during initial setup.

The key idea is to remove the widely known default credentials before the instance becomes exposed. In AEM, the admin account often ships with a default password that attackers can guess, so if you boot up with that known pair, someone could gain admin access as soon as the instance starts. Changing the default AEM admin password during the initial setup directly tackles this risk by ensuring no one can log in with a well-known credential, no matter which access path they try (the author interface, CRX/DE, or the OSGi/web console).

Relying on a production run mode to disable the OSGi web console login bundle isn’t a dependable safeguard, and it doesn’t replace the need to secure the actual admin credentials. Blocking access to /system/console via the dispatcher can reduce exposure, but it only hides the console while still leaving other entry points open and using the default password elsewhere. Updating a single OSGi web console setting doesn’t address the broader problem of the default admin password being known and usable across the system. The clearest, most robust preventive measure is to change the admin password during initial setup.