easyMultiple Choice
CAS-004 Practice Question: A system administrator is configuring a Linux…
A system administrator is configuring a Linux server to host a web application. Which file permission should be set for the private SSL key?
⚠ Common exam trap
A common mix-up: candidates confuse file permissions for private keys with those for public certificates or configuration files, often choosing 644 because it is common for non-sensitive files, but private keys must never be readable by anyone except the owner.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
600
The private SSL key must be protected from unauthorized access because it is used to decrypt traffic and establish trust. Setting permissions to 600 (owner read/write only) ensures that only the root or the application user who owns the key can read it, preventing other users or processes from extracting the key material.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
600
Why this is correct
Permission 600 grants read and write to the owner only, denying all access to group and others. This satisfies the stem's requirement for a private SSL key, since any broader permission such as 644 would expose the key material to other local users.
- ✗
644
Why it's wrong here
644 grants read access to group and world, exposing the private key to every local account, so any user could copy it and impersonate the server. It is tempting because 644 suits ordinary web content and public certificates, where world readability is harmless and expected.
- ✗
444
Why it's wrong here
444 removes write permission but still permits world and group reads, so any local user can copy the private key. It is tempting because read-only appears hardened, and 444 is correct for public artefacts such as certificates or static content that must never change.
- ✗
755
Why it's wrong here
755 makes the key world-readable and world-executable, granting every local account access to the private key material. It is tempting because 755 is the standard mode for directories and executable scripts, where traversal and execution by all users is intended.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.