200-201 Host-Based Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  systemctl disable servicename

  Why this is correct

  systemctl disable removes the service's symlinks from the systemd unit configuration, preventing it from starting automatically at boot while leaving the unit file intact. This directly addresses the autostart constraint, unlike stop, which only halts the running instance.

• ✗

  systemctl stop servicename

  Why it's wrong here

  systemctl stop halts the running unit for the current session only; the service's enablement symlinks remain, so it restarts at the next boot. systemctl disable removes those symlinks, preventing automatic startup. Stopping is tempting for immediate containment during triage, but it does not satisfy the requirement to stop the service starting automatically.

• ✗

  systemctl remove servicename

  Why it's wrong here

  systemctl has no remove subcommand; units are deleted by removing their unit files, not through systemctl. The correct action, systemctl disable, removes the enablement symlinks so the service stops starting automatically. The verb 'remove' is tempting because it sounds like deleting the service, but it is not a valid systemctl operation.

• ✗

  systemctl mask servicename

  Why it's wrong here

  systemctl mask links the unit to /dev/null, preventing it from being started manually or as a dependency, which is stronger than the question's requirement. systemctl disable removes the enablement symlinks so the service no longer starts automatically at boot. Masking is tempting for hard-blocking a malicious unit, but it exceeds what disabling alone demands.

Go deeper

Related to this question