hardMultiple ChoiceObjective-mapped
XK0-006 Practice Question: Refer to the exhibit
Network Topology
Refer to the exhibit. A security analyst notices repeated failed SSH login attempts from multiple IP addresses. Which two actions would best mitigate this brute-force attack? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set PermitRootLogin to no in /etc/ssh/sshd_config to prevent root login.
The logs show repeated failed SSH login attempts from multiple IPs, characteristic of a brute-force attack. Setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents attackers from targeting the root account directly, a common target. Installing and configuring fail2ban automatically blocks IPs after a configurable number of failed attempts, reducing the attack surface. Option B (changing the port) is security through obscurity and not a robust mitigation—automated scanners will find the new port. Option C (disabling password authentication) may be a valid long-term security measure but is not the most immediate mitigation, and it could break legitimate users if keys are not yet deployed. Option D (increasing MaxAuthTries) would allow more attempts, making the attack easier, not harder.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set PermitRootLogin to no in /etc/ssh/sshd_config to prevent root login.
Why this is correct
Setting PermitRootLogin to no in /etc/ssh/sshd_config prevents direct root login, eliminating a common target for brute-force attacks as seen in the logs showing repeated root login attempts.
- ✗
Change the SSH port to a non-standard port to evade automated attacks.
Why it's wrong here
Changing the SSH port to a non-standard port relies on security through obscurity; automated scanners can easily probe other ports, so it is not a reliable mitigation.
- ✗
Disable password authentication and force key-based authentication only.
Why it's wrong here
Disabling password authentication and forcing key-based authentication is a strong security practice, but it is not the most direct mitigation for the current attack scenario and could inadvertently lock out users who rely on passwords.
- ✗
Increase MaxAuthTries to allow more retries before disconnection.
Why it's wrong here
Increasing MaxAuthTries would allow more retries before disconnection, which worsens the attack by giving attackers more attempts per connection.
- ✓
Install and configure fail2ban to block IPs after multiple failed attempts.
Why this is correct
Installing and configuring fail2ban monitors logs for repeated failures and blocks offending IPs, directly countering the brute-force attack observed from multiple IPs.
Go deeper
Related to this question
Learn chapter
Installing Linux and Package Management
Key term
fail2ban
Fail2ban is a security tool that monitors log files for repeated authentication failures and temporarily bans the offending IP addresses using firewall rules.
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
About these practice questions
One of 979 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.