hardMultiple Select
Troubleshooting SSH Connection Failures on Linux
A Linux server is not accepting SSH connections. The administrator wants to troubleshoot the issue. Which THREE actions should be taken?
Quick Answer
The answer is to check the SSH daemon configuration file, firewall rules, and service status. The primary configuration file for the OpenSSH server, /etc/ssh/sshd_config, controls critical settings like the listening port, permitted authentication methods, and whether root login is allowed; a syntax error or a misconfigured directive here will silently prevent connections. On the CompTIA Linux+ XK0-005 exam, this question tests your systematic approach to service troubleshooting, often hiding traps where a candidate jumps to restarting the service without verifying the config file first. When you cannot SSH into a Linux server, always start by checking the sshd_config for errors, then confirm the sshd service is running with systemctl status sshd, and finally inspect firewall rules using iptables -L or ufw status to ensure port 22 is open. Remember the mnemonic “CSF” — Config, Service, Firewall — to lock in the correct order of attack.
⚠ Common exam trap
CompTIA often tests the misconception that reinstalling a package or rebooting is a valid first troubleshooting step, when in reality, checking configuration files, service status, and firewall rules are the precise, targeted actions required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check /etc/ssh/sshd_config for configuration errors
Option B is correct because /etc/ssh/sshd_config is the primary configuration file for the OpenSSH daemon, and syntax errors, invalid directives, or a misconfigured ListenAddress/Port will prevent sshd from starting or accepting connections. Option C is correct because if the sshd service is not running, no process will be listening on TCP port 22, so verifying its state with systemctl status sshd (and starting it if needed) is a fundamental troubleshooting step. Option E is correct because firewall rules managed by iptables or ufw can silently drop or reject inbound TCP/22 traffic, so checking them with iptables -L or ufw status confirms whether the port is actually reachable. Option A is not appropriate because rebooting is a disruptive, non-diagnostic action that does not identify the root cause and may mask the problem. Option D is not appropriate because reinstalling openssh-server is unnecessary when the issue is more likely configuration, service state, or firewall-related, and it does not address the actual fault.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reboot the server
Why it's wrong here
Rebooting clears diagnostic state such as running services, logs and connection attempts, and may mask the fault without identifying it. It is tempting because reboots often restore service temporarily, and it would be correct as a last resort once the root cause is known and recovery is the goal.
- ✓
Check /etc/ssh/sshd_config for configuration errors
Why this is correct
Inspecting /etc/ssh/sshd_config verifies the daemon's own settings, such as PermitRootLogin, Port and AllowUsers, which directly govern whether sshd accepts connections. A malformed directive or invalid port binding prevents the service from starting or listening, satisfying the stem's requirement to troubleshoot why the Linux server refuses SSH connections.
- ✓
Check if sshd service is running (systemctl status sshd)
Why this is correct
SSH connections require the sshd daemon to be listening; if it is stopped or failed, nothing accepts port 22. Running systemctl status sshd confirms whether the service is active, exposing the daemon-level cause of the refused connections.
- ✗
Reinstall the SSH package (apt reinstall openssh-server)
Why it's wrong here
Reinstalling the package overwrites binaries and configuration, potentially destroying the faulty config or logs needed to diagnose why sshd is refusing connections. It is tempting because package reinstallation fixes corrupted binaries, and it would be correct once corruption is confirmed as the cause.
- ✓
Check firewall rules (iptables -L or ufw status)
Why this is correct
Even with sshd running, packet-filtering rules can silently drop inbound TCP port 22. Checking iptables -L or ufw status reveals whether the host firewall is blocking SSH, satisfying the need to rule out network-layer rejection.
Go deeper
Related to this question
Learn chapter
Networking Fundamentals and Configuration
Key term
systemctl
systemctl is the command-line tool used to inspect, start, stop, enable, or disable services managed by the systemd init system in Linux.
Key term
Process
In IT service management, a process is a structured set of activities designed to accomplish a specific objective, such as managing incidents or changes, by transforming inputs into defined outputs.
About these practice questions
This XK0-006 question is part of Courseiva's 781-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on XK0-006
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user is able to ping the Linux server but cannot connect via SSH. The SSH service is running and listening. Which configuration file should the administrator review FIRST?
medium- A./etc/pam.d/login
- ✓ B./etc/ssh/sshd_config
- C./etc/nsswitch.conf
- D./etc/hosts.allow
Why B: The SSH service is running and listening, but the user cannot connect. This points to a configuration issue within the SSH daemon itself. The `/etc/ssh/sshd_config` file controls SSH server settings such as allowed authentication methods, port numbers, and user access restrictions (e.g., `AllowUsers`, `DenyUsers`, `PermitRootLogin`). Reviewing this file first is the logical step to identify why connections are being rejected despite the service being active.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.