Courseiva
easyMultiple ChoiceObjective-mapped

XK0-006 Practice Question: A Linux administrator discovers that a user's…

A Linux administrator discovers that a user's home directory contains a file with setuid bit set, owned by root. The file is not part of any authorized software. What is the most appropriate immediate action?

⚠ Common exam trap

Many exam-takers choose deletion (Option B) as the 'obvious' fix, overlooking the forensic value of the file and the fact that removing the setuid bit is a less destructive and equally effective containment measure.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Remove the setuid bit with 'chmod u-s <file>'

The immediate priority is to neutralize the unauthorized setuid root binary, which poses a privilege escalation risk. Removing the setuid bit with 'chmod u-s' disables the ability for any user to execute the file with root privileges, containing the threat without destroying evidence that may be needed for forensic analysis. This aligns with security best practices of preserving artifacts while mitigating active risks.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Move the file to /tmp for further analysis

    Why it's wrong here

    Moving does not remove the setuid bit; the risk remains.

  • Delete the file immediately to remove the threat

    Why it's wrong here

    Deleting may destroy evidence needed for investigation.

  • Change the file owner to the user with 'chown user:user <file>'

    Why it's wrong here

    Changing ownership does not remove the setuid bit; root ownership is required for setuid to be effective.

  • Remove the setuid bit with 'chmod u-s <file>'

    Why this is correct

    This removes the setuid bit, preventing privilege escalation, while preserving the file.

About these practice questions

Courseiva writes every XK0-006 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.