CS0-003 Vulnerability Management Practice Question
A cybersecurity analyst is reviewing the configuration of a Linux server against CIS Benchmarks. The analyst notices that several settings deviate from the recommended baseline. Which TWO of the following are most likely to be considered Level 1 CIS Benchmark recommendations?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set password expiration to 90 days
CIS Level 1 recommendations are basic security settings that do not cause significant operational impact. Setting password expiration and disabling root SSH login are common Level 1 items.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove all unnecessary packages and services
Why it's wrong here
Removing all unnecessary packages and services is a sound hardening practice that reduces the attack surface, but it is typically categorized as Level 2 in the CIS Benchmarks. This is because the removal process can break expected functionality if an application relies on a particular package or daemon, requiring thorough business impact analysis and testing. Level 1 controls are intended to be low-impact, universally applicable security settings, so this action does not qualify as a Level 1 baseline.
- ✗
Enable mandatory access control (SELinux) in enforcing mode
Why it's wrong here
Enabling SELinux in enforcing mode provides strong mandatory access control, but it is commonly relegated to Level 2 because enforcing mode can deny legitimate application operations when policies are not fully tuned, potentially causing service outages. This requires significant policy customization and testing for each environment, making it disruptive for organizations not already prepared. A Level 1 control must be deployable with minimal operational friction, which enforcing mode does not always offer, so it is not the correct choice here.
- ✓
Set password expiration to 90 days
Why this is correct
Setting password expiration to 90 days aligns with CIS Level 1 recommendations because it is a fundamental, low-impact security control that requires minimal configuration via PAM or Group Policy. It directly mitigates risk by limiting the window of opportunity for an attacker who has compromised a credential, ensuring that stolen passwords become invalid within a defined period. This setting rarely breaks applications or user workflows, making it a textbook Level 1 baseline requirement.
- ✓
Disable SSH root login
Why this is correct
Disabling SSH root login is a CIS Level 1 hardening step because it eliminates the risk of direct root brute-force attacks over the network without affecting legitimate remote administration—admins can still use a standard user account and escalate privileges with sudo. This change is simple, reliable, and does not degrade functionality, so it is considered a core, high-value control. It is universally recommended and can be applied immediately, fitting the Level 1 criteria of security impact with minimal operational disruption.
- ✗
Configure audit rules for file permission changes
Why it's wrong here
Configuring audit rules to monitor file permission changes is a powerful forensic control, but it is generally assigned to Level 2 in the CIS Benchmarks. The reason is that extensive audit logging can generate large volumes of data, increasing storage costs and potentially causing performance degradation on busy systems. Additionally, the rule sets are highly site-specific—organizations may need to tailor them to their own compliance requirements—so they are not a uniform, low-impact Level 1 setting.
Go deeper
Related to this question
Learn chapter
Security Metrics and KPIs
Key term
Impact
Impact is the measure of the potential damage or harm that a risk event could cause to an organization's assets, operations, or reputation.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 236 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.