CAS-004 Security Engineering Practice Question
An organization is implementing SSH hardening for server access. Which configuration change most effectively reduces the attack surface against brute-force and credential theft?
⚠ Common exam trap
Candidates often confuse 'reducing attack surface' with 'obscuring the service' — candidates often pick port changes or rate-limiting because they sound like hardening, but only eliminating the password credential actually removes the attack vector.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable public-key authentication and disable password authentication.
Public-key authentication replaces the shared secret (password) with an asymmetric key pair, so there is no reusable credential an attacker can brute-force or steal via phishing/keylogging. Disabling password authentication also eliminates the entire class of credential-guessing attacks against SSH. This is the single most impactful hardening step because it removes the attack vector rather than merely slowing it down.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the default SSH port from 22 to a high-numbered port.
Why it's wrong here
Moving SSH to a non-standard port only evades opportunistic scanners; the daemon still accepts password authentication, so brute-force and credential-stuffing attempts against a discovered port succeed. Port relocation suits reducing log noise from automated scans, whereas disabling password authentication and enforcing key-based logins removes the credential attack surface.
- ✓
Enable public-key authentication and disable password authentication.
Why this is correct
Public-key authentication replaces reusable passwords with a private key the client holds, so there is no shared secret to brute-force or steal through phishing. Disabling password authentication removes that credential path entirely, directly shrinking the attack surface.
- ✗
Set MaxAuthTries to 6 to limit login attempts.
Why it's wrong here
MaxAuthTries of 6 still permits six password guesses per connection and does nothing against stolen or reused credentials, so brute-force and credential theft remain viable. It suits throttling noisy clients, but the effective control is disabling password authentication entirely and requiring key-based credentials, ideally with MFA.
- ✗
Use TCP wrappers to restrict source IP addresses.
Why it's wrong here
TCP wrappers filter by source address at the host level, but they do not stop brute-force guessing or credential theft from permitted networks, nor do they remove password authentication. They suit environments needing coarse network-based access lists; disabling password authentication and requiring key-based credentials addresses the actual attack vector.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.