XK0-006 Security Practice Question
An administrator needs to harden SSH access. Which TWO settings in /etc/ssh/sshd_config are recommended to improve security? (Choose two.)
⚠ Common exam trap
A common mix-up: candidates think changing the default SSH port (Option E) is a strong security measure, but the exam considers it a weak control compared to disabling root login and password authentication, which directly address authentication vulnerabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PermitRootLogin no
Option B (PermitRootLogin no) is correct because disabling direct root logins over SSH forces attackers to compromise a normal user account and then escalate privileges, removing a high-value, well-known target and enabling accountability through sudo or su. Option D (PasswordAuthentication no) is correct because it disables password-based authentication, requiring key-based (public/private key) authentication instead, which is not vulnerable to brute-force or credential-guessing attacks. Option A (PermitRootLogin yes) is wrong because it explicitly allows root to log in directly, the opposite of hardening. Option C (Protocol 1) is wrong because SSH protocol 1 is deprecated and insecure (weak integrity/crypto), and modern OpenSSH only supports protocol 2 anyway. Option E (Port 22) is wrong because it merely sets the default port and provides no real security benefit; changing the port is at most minor obscurity, not a recommended hardening control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PermitRootLogin yes
Why it's wrong here
PermitRootLogin yes allows direct root logins over SSH, removing accountability and exposing the most privileged account to brute-force attacks; hardening sets it to no or prohibit-password. It is tempting because root access is sometimes needed administratively, but that is achieved via sudo from a named account, not direct root login.
- ✓
PermitRootLogin no
Why this is correct
PermitRootLogin no blocks direct root authentication over SSH, forcing administrators to log in as unprivileged users before escalating via sudo or su. This removes root as a brute-force target and preserves attributable audit trails, directly satisfying the hardening requirement to reduce remote attack surface on the SSH daemon.
- ✗
Protocol 1
Why it's wrong here
Protocol 1 enables the obsolete SSH-1, which has known cryptographic weaknesses, so it weakens rather than hardens access. It is tempting because disabling legacy versions is a hardening principle, but the correct setting is Protocol 2, which forces the modern protocol. SSH-1 must never be selected on a hardened host.
- ✓
PasswordAuthentication no
Why this is correct
Disables password auth, forces key-based.
- ✗
Port 22
Why it's wrong here
Port 22 is the default SSH listening port, so retaining it exposes the service to automated scanning and brute-force attempts; hardening typically moves it to a non-default port. It is tempting because port configuration is a legitimate sshd_config setting, but changing the port is the hardening action, not keeping the default.
Go deeper
Related to this question
Learn chapter
File Transfer and Remote Access
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 781 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.