hardMultiple SelectObjective-mapped
CAS-004 Is hardening a Linux web server Practice Question
A security engineer is hardening a Linux web server. The team requires that the web server process cannot run with root privileges and that any file it writes must have minimal permissions. Which two controls should be implemented together? (Select TWO).
⚠ Common exam trap
Many candidates confuse chroot jails (Option B) or SELinux (Option C) as substitutes for running the process as a non-root user, but neither addresses the core requirement of preventing root-level execution; the question explicitly requires the process to not run with root privileges, which only a dedicated non-privileged user account achieves.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run the web server process under a dedicated non-privileged user account
Running the web server process under a dedicated non-privileged user account (Option A) ensures that even if the process is compromised, the attacker does not gain root privileges. This is a fundamental principle of least privilege, typically implemented by creating a system user (e.g., 'www-data' or 'httpd') with no login shell and assigning ownership of web directories to that user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run the web server process under a dedicated non-privileged user account
Why this is correct
This ensures the process does not run as root.
- ✗
Place the web server in a chroot jail
Why it's wrong here
Chroot affects filesystem access, not user context.
- ✗
Enable SELinux in enforcing mode with a targeted policy for the web server
Why it's wrong here
SELinux is a MAC system but the question asks for two controls; this is already covered by D.
- ✓
Apply mandatory access control (MAC) to restrict file permissions
Why this is correct
MAC ensures minimal permissions even if the process is compromised.
- ✗
Use file capability bounding sets to limit the web server's capabilities
Why it's wrong here
This limits capabilities but does not change the user context.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.