hardMultiple SelectObjective-mapped
XK0-006 An administrator is hardening a Linux server Practice Question
An administrator is hardening a Linux server. Which three of the following actions reduce the attack surface? (Select THREE).
⚠ Common exam trap
CompTIA often tests the misconception that setting a restrictive umask or enabling USB storage is a hardening action, when in fact umask 022 is the default and permissive, and enabling USB storage expands the attack surface rather than reducing it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disabling unnecessary services
Disabling unnecessary services reduces the attack surface by eliminating potential entry points for attackers. Each running service exposes network ports, system resources, and code paths that could contain vulnerabilities. By stopping and masking services not required for the server's role (e.g., using systemctl disable and mask), the administrator minimizes the number of exploitable components.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Setting default umask to 022
Why it's wrong here
This is a default setting and does not reduce attack surface significantly; a more restrictive umask like 077 would.
- ✓
Disabling unnecessary services
Why this is correct
Reduces potential entry points for attackers.
- ✗
Enabling USB mass storage kernel module
Why it's wrong here
This increases attack surface by allowing USB storage devices.
- ✓
Using a host-based firewall
Why this is correct
Controls network traffic and blocks unwanted connections.
- ✓
Enforcing strong password policies
Why this is correct
Mitigates brute-force and guessing attacks.
Visual reference
Go deeper
Related to this question
Learn chapter
Linux Fundamentals and History
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
systemctl
systemctl is the command-line tool used to inspect, start, stop, enable, or disable services managed by the systemd init system in Linux.
About these practice questions
This XK0-006 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.