CAS-004 Key exchange algorithms Practice Question
A security engineer is hardening SSH server configuration. Which TWO options improve security? (Select TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict allowed key exchange algorithms to strong ones
Restricting key exchange algorithms to strong ones (B) prevents downgrade attacks and ensures only secure cryptographic methods are used. Using key-based authentication only (C) eliminates password-based vulnerabilities such as brute-force and credential theft. Option D (disable root login) is also a security best practice but is not one of the two required selections in this question. Option A weakens security by allowing weak ciphers, and option E introduces password authentication which increases attack surface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow all cipher suites for compatibility
Why it's wrong here
Allowing all cipher suites for compatibility reduces security by including weak ciphers. This does not improve security.
- ✓
Restrict allowed key exchange algorithms to strong ones
Why this is correct
Restricting allowed key exchange algorithms to strong ones eliminates weak algorithms, improving security.
- ✓
Use key-based authentication only
Why this is correct
Using key-based authentication only eliminates password-based authentication, which is vulnerable to brute-force attacks. This improves security.
- ✗
Disable root login via SSH
Why it's wrong here
Disabling root login via SSH is a good security practice, but the question asks for the two options that improve security among the given list; the intended correct answers are B and C.
- ✗
Enable password authentication for convenience
Why it's wrong here
Enabling password authentication for convenience weakens security by allowing password-based logins, which are susceptible to brute-force attacks. This does not improve security.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.