CAS-004 Is hardening a Linux server Practice Question

Correct answer & explanation

Options B and C are correct. Kernel hardening with sysctl (B) reduces the attack surface by disabling unnecessary kernel features and enforcing security settings (e.g., restricting dmesg, kernel pointer access). SELinux in enforcing mode (C) provides mandatory access control, limiting process capabilities and confining exploits even if a service is compromised. Option A is incorrect because disabling all non-root user accounts is impractical, violates the principle of least privilege, and does not directly prevent privilege escalation. Option D is incorrect because removing the SUID bit from all binaries is too broad; some SUID binaries are essential (e.g., sudo, passwd) and removing them breaks functionality without necessarily preventing escalation. Option E is incorrect; while restricting cron jobs to root may limit cron-based attacks, it is not a primary best practice for preventing privilege escalation and can break legitimate scheduled tasks.