Applying the latest vendor patches and updates is the first action that will lock down the system and minimize the risk of an attack, because it will fix any known vulnerabilities or bugs that could be exploited by attackers.
Installing an antivirus on the server, running a vulnerability scanner, and reviewing access controls are also important security measures, but they are not the first actions to take. An antivirus may not detect all types of malware, a vulnerability scanner may not find all the flaws in the system, and access controls may not prevent all unauthorized access12. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 10, page
883; CISSP Practice Exam - FREE 20 Questions and Answers, Question 8.