Question 327 of 979
mediumMultiple ChoiceObjective-mapped
How to Restrict SSH Access to a Specific Group Using AllowGroups
A Linux server is configured to allow SSH access for remote administration. The security team wants to limit SSH access to only users in the 'ssh-users' group. Which configuration should be added to /etc/ssh/sshd_config?
Quick Answer
The answer is to add `AllowGroups ssh-users` to `/etc/ssh/sshd_config`. This directive works by instructing the SSH daemon to check the group membership of any user attempting to log in; only users who are members of the specified group—in this case, `ssh-users`—will be granted access, while all others are denied even if they have valid credentials. On the CompTIA Linux+ XK0-005 exam, this question tests your understanding of SSH access control directives, often contrasting `AllowGroups` with `AllowUsers` or `DenyGroups`. A common trap is confusing `AllowGroups` with `AllowUsers`—remember that `AllowGroups` checks group membership, not individual usernames. A helpful memory tip: think of "AllowGroups" as a bouncer checking for a group pass, not a guest list.
⚠ Common exam trap
A common mix-up: candidates confuse AllowUsers (which takes usernames) with AllowGroups (which takes group names), leading them to incorrectly select option A thinking it will filter by group membership.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AllowGroups ssh-users
The AllowGroups directive in /etc/ssh/sshd_config restricts SSH logins to only those users who are members of the specified group. By setting 'AllowGroups ssh-users', only users belonging to the 'ssh-users' group will be permitted to authenticate via SSH, directly fulfilling the security team's requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AllowUsers ssh-users
Why it's wrong here
AllowUsers expects usernames, not groups.
- ✓
AllowGroups ssh-users
Why this is correct
AllowGroups restricts SSH to group members.
- ✗
DenyUsers root
Why it's wrong here
This only denies root.
- ✗
PermitRootLogin yes
Why it's wrong here
This allows root login.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on XK0-006
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to restrict SSH access to only users in the 'sshusers' group. Which configuration should be added to /etc/ssh/sshd_config?
medium- A.AllowUsers sshusers
- B.DenyUsers sshusers
- ✓ C.AllowGroups sshusers
- D.PermitRootLogin no
Why C: The `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH login to users who are members of the specified group. By setting `AllowGroups sshusers`, only users belonging to the 'sshusers' group will be permitted to authenticate via SSH, while all others are denied. This matches the administrator's requirement precisely.
Variation 2. A system administrator needs to restrict SSH access to a Linux server to only users in the 'sshusers' group. Which configuration change achieves this?
easy- A.Add 'DenyUsers *' to /etc/ssh/sshd_config
- B.Set 'PermitRootLogin no' in /etc/ssh/sshd_config
- ✓ C.Add 'AllowGroups sshusers' to /etc/ssh/sshd_config
- D.Add 'AllowUsers sshusers' to /etc/ssh/sshd_config
Why C: The 'AllowGroups' directive in /etc/ssh/sshd_config restricts SSH access to only users who are members of the specified group. When set to 'AllowGroups sshusers', only users belonging to the 'sshusers' group will be permitted to log in via SSH, effectively blocking all others. This is the standard method for group-based access control in OpenSSH.
Variation 3. A systems administrator needs to restrict SSH access to a Linux server so that only users in the 'sshusers' group can log in. Which configuration change should be made in /etc/ssh/sshd_config?
medium- A.Add 'AllowUsers sshusers'
- B.Add 'DenyGroups all'
- ✓ C.Add 'AllowGroups sshusers'
- D.Add 'PermitRootLogin no' and add users to sshusers
Why C: The 'AllowGroups' directive in /etc/ssh/sshd_config restricts SSH login to only users who are members of the specified group. By adding 'AllowGroups sshusers', only users in the 'sshusers' group will be permitted to authenticate via SSH, while all others are denied. This is the standard OpenSSH mechanism for group-based access control.
Variation 4. A system administrator wants to restrict SSH access to a specific group of users. Which two methods can achieve this? (Select TWO.)
easy- A.Use /etc/security/access.conf
- ✓ B.Edit /etc/ssh/sshd_config and set AllowGroups engineers
- C.Modify /etc/pam.d/sshd to use pam_listfile.so
- D.Add users to the sshd group
- ✓ E.Edit /etc/ssh/sshd_config and set AllowUsers user1,user2,user3
Why B: The `AllowGroups` directive in `/etc/ssh/sshd_config` explicitly restricts SSH access to members of specified groups. When set to `AllowGroups engineers`, only users belonging to the 'engineers' group can authenticate via SSH, providing a straightforward and secure method for group-based access control.
Last reviewed: Jun 11, 2026
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.