mediumMultiple SelectObjective-mapped
XK0-006 Practice Question: Restrict SSH access to the server so that only a…
An administrator needs to restrict SSH access to the server so that only a specific IP range (192.168.1.0/24) can connect, and password authentication is disabled. Which THREE steps must be taken?
⚠ Common exam trap
Candidates often think 'UsePAM yes' or 'PermitRootLogin without-password' are necessary for IP restriction or disabling passwords, when in fact they address unrelated authentication mechanisms and are not among the three required steps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a firewall rule: iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP
It uses iptables to create a firewall rule that accepts SSH traffic (TCP port 22) only from the 192.168.1.0/24 subnet, followed by a catch-all rule that drops all other SSH traffic. This enforces network-level access control. Option D is correct because 'AllowUsers *@192.168.1.*' in sshd_config restricts SSH logins to users connecting from IP addresses matching that pattern, providing application-level filtering. Option E is correct because 'PasswordAuthentication no' disables password-based authentication, forcing the use of key-based or other non-password methods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set 'UsePAM yes' in sshd_config
Why it's wrong here
This enables PAM, not IP restriction.
- ✓
Add a firewall rule: iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP
Why this is correct
Firewall restricts source IP at network layer.
- ✗
Set 'PermitRootLogin without-password' in sshd_config
Why it's wrong here
This only affects root login, not source IP restriction.
- ✓
Add 'AllowUsers *@192.168.1.*' to /etc/ssh/sshd_config
Why this is correct
This restricts SSH login to users originating from that subnet.
- ✓
Set 'PasswordAuthentication no' in sshd_config
Why this is correct
Disables password-based authentication.
Visual reference
Go deeper
Related to this question
Learn chapter
File Transfer and Remote Access
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.