mediumMultiple SelectObjective-mapped
SSH Hardening: Key-Based Auth and Root Login Restrictions
A Linux administrator is hardening a server. Which TWO actions are effective in preventing unauthorized access via SSH? (Select TWO.)
Quick Answer
The answer is to set PasswordAuthentication no and use SSH keys, as disabling password authentication forces the use of key-based authentication, which is far more resistant to brute-force attacks than passwords. This works because SSH keys use asymmetric cryptography, where a private key remains on the client and a public key is stored on the server, making it computationally infeasible for an attacker to authenticate without possession of the private key. On the CompTIA Linux+ XK0-005 exam, this concept tests your understanding of the sshd_config directives, and a common trap is confusing PermitRootLogin no with PasswordAuthentication no—remember that disabling root login is a separate, complementary control that prevents direct root access, not password-based logins. A useful memory tip is “keys over passwords, root over sudo,” reinforcing that both settings together create layered defense.
⚠ Common exam trap
A common mix-up: candidates think disabling the SSH service (Option C) is a valid hardening step, but the question asks for actions that prevent unauthorized access *via SSH* while still allowing legitimate remote administration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set PermitRootLogin no in /etc/ssh/sshd_config
Setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents direct root login via SSH, forcing administrators to log in as a regular user and then use `su` or `sudo` for privilege escalation. This reduces the attack surface by eliminating the ability to brute-force the root password directly over SSH.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set PermitRootLogin yes
Why it's wrong here
Allows root login.
- ✗
Set PasswordAuthentication yes
Why it's wrong here
Allows password authentication.
- ✗
Disable the SSH service
Why it's wrong here
Prevents all SSH access, which may be too restrictive.
- ✓
Set PermitRootLogin no in /etc/ssh/sshd_config
Why this is correct
Prevents direct root login.
- ✓
Set PasswordAuthentication no and use SSH keys
Why this is correct
Eliminates password-based attacks.
Go deeper
Related to this question
Learn chapter
Linux Fundamentals and History
Key term
sudo
sudo is a command-line utility in Unix-like operating systems that allows a permitted user to execute a program as another user, typically the superuser (root), based on security policy settings.
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on XK0-006
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator needs to ensure that the SSH service only allows key-based authentication and disables password authentication. Which configuration file and directive should be modified?
medium- A./etc/ssh/sshd_config; PasswordAuthentication yes
- B./etc/ssh/sshd_config; PubkeyAuthentication no
- C./etc/ssh/ssh_config; PasswordAuthentication no
- ✓ D./etc/ssh/sshd_config; PasswordAuthentication no
Why D: The SSH server configuration file is /etc/ssh/sshd_config, and setting 'PasswordAuthentication no' disables password-based logins, forcing key-based authentication. This directive must be set on the server side (sshd_config), not the client side (ssh_config), to enforce the policy for all incoming SSH connections.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.