mediumMultiple SelectObjective-mapped
XK0-006 Practice Question: Which THREE are best practices for securing a…
Which THREE are best practices for securing a Linux server? (Choose exactly three.)
⚠ Common exam trap
CompTIA often tests the misconception that a permissive umask (like 0777) is secure because it 'blocks everything,' but in reality, umask subtracts permissions, so 0777 actually removes all permissions, which is not a best practice and can cause operational issues; the trap is confusing umask subtraction with direct permission setting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a host-based firewall
A host-based firewall (e.g., iptables, nftables, or firewalld) controls incoming and outgoing traffic at the server level, enforcing least-privilege network access. By default, it can block all traffic except explicitly allowed services (e.g., SSH on port 22, HTTPS on port 443), reducing the attack surface. This is a fundamental security control to prevent unauthorized network connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a host-based firewall
Why this is correct
Controls network access to the server.
- ✓
Keep software up to date
Why this is correct
Patches vulnerabilities.
- ✗
Enable root SSH login with password
Why it's wrong here
Root SSH login with password is insecure; it should be disabled or use key-only.
- ✓
Disable unnecessary services
Why this is correct
Reduces attack surface.
- ✗
Set default umask to 0777
Why it's wrong here
umask 0777 results in insecure permissions (000 for new files), it should be restrictive like 0022.
Go deeper
Related to this question
Learn chapter
Linux Fundamentals and History
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
nftables
nftables is a modern Linux kernel packet classification framework that replaces the older iptables, ip6tables, arptables, and ebtables tools for configuring network packet filtering, NAT, and firewall rules.
About these practice questions
This XK0-006 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.