hardMultiple ChoiceObjective-mapped
CS0-003 Practice Question: During a penetration test, an analyst…
During a penetration test, an analyst successfully exploits a privilege escalation vulnerability to gain root access on a Linux server. The server is used for application development. Which of the following remediation actions would be MOST effective in preventing similar attacks?
⚠ Common exam trap
CompTIA often tests the distinction between detection (HIDS), system hardening (sysctl), execution control (whitelisting), and access control (least privilege), expecting candidates to recognize that preventing privilege escalation requires limiting permissions rather than just monitoring or restricting specific binaries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply the principle of least privilege to user accounts
The principle of least privilege ensures that users and processes have only the minimum permissions necessary to perform their tasks. By applying this to user accounts, the attack surface for privilege escalation is reduced because even if an account is compromised, the attacker cannot easily escalate to root. This directly addresses the root cause of the vulnerability exploited in the scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a host intrusion detection system
Why it's wrong here
Deploying a host intrusion detection system (HIDS) is a crucial security measure for monitoring system activities and identifying suspicious behavior, including potential privilege escalation attempts. However, HIDS primarily functions as a detection and alerting tool; it does not inherently prevent an attacker from successfully escalating privileges once a vulnerability is exploited. While it provides valuable forensic data and real-time alerts, it does not block the underlying mechanism of privilege escalation itself.
- ✗
Harden the kernel using sysctl parameters
Why it's wrong here
Hardening the kernel through sysctl parameters can significantly enhance system security by disabling insecure features, enabling memory protections, and configuring network stack defenses. While this improves the overall resilience of the operating system against various exploits, it is a broad-spectrum defense. It does not directly prevent an attacker from leveraging misconfigured user accounts or applications with excessive permissions to escalate privileges, which is a common vector for post-exploitation.
- ✗
Implement application whitelisting
Why it's wrong here
Implementing application whitelisting is an effective control to prevent the execution of unauthorized or malicious software on a system, thereby reducing the attack surface. This measure ensures that only approved applications can run, which can stop many initial infection vectors. However, application whitelisting does not inherently address the issue of privilege escalation, as an attacker might exploit a vulnerability within an approved application that runs with elevated privileges, or leverage legitimate system utilities with excessive permissions to gain higher access.
- ✓
Apply the principle of least privilege to user accounts
Why this is correct
Applying the principle of least privilege to user accounts is the most direct and effective countermeasure against privilege escalation. This principle ensures that users and processes are granted only the minimum necessary permissions to perform their legitimate functions, and no more. By limiting the initial access an attacker gains, even if they compromise a user account, their ability to escalate privileges to administrative or system-level access is severely restricted, significantly reducing the potential impact of a successful exploit.
Go deeper
Related to this question
Learn chapter
Vulnerability Scanning Techniques
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Remediation
Remediation is the process of fixing or eliminating vulnerabilities, misconfigurations, or security weaknesses in an IT environment.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.