Aditya is a Windows security professional. His organization uses the Microsoft Internet Information Services $($IIS$)$ web server for its e$-$commerce website. Aditya recently learned about a few serious vulnerabilities in IIS. Which of the following is his best course of action to reduce the attack surface of IIS?

Question $15$ options:

Disable IIS.

Establish controls on IIS to mitigate the vulnerabilities.

Install only the Windows Server Core option.

Limit physical access to the IIS server.