mediumMultiple ChoiceObjective-mapped
220-1102 Practice Question: During a security audit, you find that a…
During a security audit, you find that a configuration file /etc/app/config.cfg has permissions -rwxrwxrwx. What command should you run to restrict it so only the owner can read and write, and the group can read, while others have no access?
⚠ Common exam trap
CompTIA often tests the distinction between 644 and 640, where candidates mistakenly choose 644 because they forget that 'others have no access' means the last digit must be 0, not 4.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
chmod 640 /etc/app/config.cfg
The requirement is to set permissions so the owner can read and write (6), the group can read (4), and others have no access (0). The octal representation 640 achieves exactly this: 6 (rw-) for owner, 4 (r--) for group, and 0 (---) for others. This matches the security policy of restricting access to only the owner and group read access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
chmod 640 /etc/app/config.cfg
Why this is correct
The chmod 640 /etc/app/config.cfg command correctly sets the file permissions using octal notation. The '6' grants the file owner read and write access (4+2), allowing them to modify the configuration. The '4' assigns read-only access to the file's group, enabling applications running under that group to read the necessary settings. Finally, the '0' ensures that all other users have no access whatsoever, adhering to the principle of least privilege for sensitive configuration data.
- ✗
chmod 750 /etc/app/config.cfg
Why it's wrong here
Setting permissions to chmod 750 /etc/app/config.cfg is inappropriate for a configuration file because it grants execute permissions. The '7' for the owner (read, write, execute) and '5' for the group (read, execute) are unnecessary for a file that is meant to be read by an application, not executed as a program. Granting execute permissions to a non-executable file is a security misconfiguration, potentially allowing malicious actors to exploit the file if it were somehow made executable in a different context.
- ✗
chmod 644 /etc/app/config.cfg
Why it's wrong here
The chmod 644 /etc/app/config.cfg command fails to meet the security requirements because the final '4' grants read access to 'others'. While the owner gets read/write and the group gets read, allowing any user on the system (not the owner or in the group) to read the configuration file is a significant security vulnerability. This could expose sensitive information such as API keys, database credentials, or internal network paths, which should remain confidential.
- ✗
chmod 600 /etc/app/config.cfg
Why it's wrong here
Using chmod 600 /etc/app/config.cfg is too restrictive for the specified requirements. While it correctly limits 'others' to no access, the '0' for the group means that the file's designated group also has no permissions. If an application or service relies on this configuration file and runs under the context of that group, it would be unable to read the file, leading to application errors or complete failure. The requirement explicitly states the group needs read access.
Go deeper
Related to this question
Learn chapter
Windows Command Line Tools
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.