easyMultiple ChoiceObjective-mapped
220-1202 Practice Question: During a security audit, a Linux server is found…
During a security audit, a Linux server is found to have a configuration file that is world-writable. The file /etc/app/config.cfg must only be readable and writable by the root user. Which command should the administrator run?
⚠ Common exam trap
It's easy for candidates to confuse the numeric permission values, often picking `644` (thinking it restricts write access) or `400` (thinking read-only is sufficient), while overlooking the explicit requirement for both read and write by root.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
chmod 600 /etc/app/config.cfg
`chmod 600` sets the file permissions to read and write for the owner (root) and no permissions for group or others. This satisfies the requirement that only root can read and write `/etc/app/config.cfg`, as root is the owner of the file.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
chmod 777 /etc/app/config.cfg
Why it's wrong here
Octal 777 grants read, write, and execute permissions to the file's owner, its group, and all other users on the system. This extremely permissive setting is a severe security vulnerability for a sensitive configuration file, as it allows any user to modify, delete, or potentially execute its contents, completely undermining system integrity and confidentiality. Such permissions are rarely, if ever, appropriate for critical system files.
- ✗
chmod 644 /etc/app/config.cfg
Why it's wrong here
Octal 644 sets permissions as read and write for the file's owner, but only read access for both the file's group and all other users. While preventing unauthorized writing, allowing 'others' to read a sensitive configuration file means its contents, which may include critical system settings or credentials, are exposed to any non-root user. This fails to meet stringent security requirements for confidentiality, as the information is not adequately protected from unauthorized viewing.
- ✓
chmod 600 /etc/app/config.cfg
Why this is correct
Octal 600 assigns read and write permissions exclusively to the file's owner, typically the 'root' user for system configuration files. Crucially, it explicitly revokes all permissions – read, write, and execute – for both the file's group and all other users on the system. This configuration ensures that only the designated administrator can view or modify the file's contents, providing the highest level of confidentiality and integrity for a critical configuration file.
- ✗
chmod 400 /etc/app/config.cfg
Why it's wrong here
Octal 400 grants read-only permission solely to the file's owner, while explicitly denying all permissions to the file's group and all other users. Although this setting offers strong protection against unauthorized modification, it inherently prevents the owner (e.g., root) from making necessary administrative changes or updates to the configuration file. This violates the practical requirement that the administrator must be able to write to the file for proper system management, rendering it unsuitable despite its security.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.