mediumMultiple Select
XK0-006 Practice Question: Which THREE are best practices for securing a…
Which THREE are best practices for securing a Linux server? (Choose exactly three.)
⚠ Common exam trap
CompTIA often tests the misconception that a permissive umask (like 0777) is secure because it 'blocks everything,' but in reality, umask subtracts permissions, so 0777 actually removes all permissions, which is not a best practice and can cause operational issues; the trap is confusing umask subtraction with direct permission setting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a host-based firewall
Option A (Use a host-based firewall) is correct because tools like iptables/nftables or firewalld enforce least-privilege network access at the host level, blocking unneeded inbound ports even if a service is accidentally exposed. Option B (Keep software up to date) is correct because patching via the distribution's package manager (e.g., apt, dnf, yum) closes known CVEs in the kernel, libraries, and daemons that attackers actively exploit. Option D (Disable unnecessary services) is correct because every running daemon (e.g., telnet, rsh, unused web servers) expands the attack surface, so stopping and disabling them with systemctl reduces exploitable entry points. Option C is wrong because enabling root SSH login with a password invites brute-force and credential-stuffing attacks; best practice is PermitRootLogin no plus key-based authentication. Option E is wrong because umask 0777 removes all permissions from newly created files and directories, which is not a security best practice and would break normal system operation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a host-based firewall
Why this is correct
A host-based firewall filters inbound and outbound traffic per server, restricting which ports and services are reachable. This reduces the attack surface of the Linux host itself, satisfying the hardening requirement by blocking unnecessary network access even when other controls fail.
- ✓
Keep software up to date
Why this is correct
Patching closes known vulnerabilities before attackers can exploit them, removing flaws in the kernel, daemons and installed packages. Keeping software current directly reduces exploitable weaknesses on the server, satisfying the hardening requirement; unpatched services remain the most common initial access route.
- ✗
Enable root SSH login with password
Why it's wrong here
Permitting root SSH login with a password exposes the highest-privilege account to brute-force and credential-stuffing attacks. It is tempting for convenience during administration, but best practise is disabling direct root login and requiring key-based authentication through a named unprivileged account with sudo.
- ✓
Disable unnecessary services
Why this is correct
Disabling unnecessary services shrinks the attack surface by removing listening daemons and their open ports, eliminating exploitable code that no business function requires. This directly satisfies the stem's hardening goal, since each unused service is a potential entry point for attackers. Fewer running processes also simplify patch management and auditing.
- ✗
Set default umask to 0777
Why it's wrong here
A umask of 0777 strips all permission bits from newly created files and directories, leaving them inaccessible even to their owner and breaking normal operation. It is tempting as an apparent hardening measure, but umask 077 is the correct choice when new files must remain private to their creator while retaining owner access.
Visual reference
Go deeper
Related to this question
Learn chapter
Installing Linux and Package Management
Key term
apt
APT (Advanced Package Tool) is a command-line utility used in Debian-based Linux distributions to install, update, remove, and manage software packages from repositories.
Key term
Practice
Practice in IT service management refers to the repeated application of processes, procedures, and skills to improve efficiency, reduce errors, and maintain consistent service delivery.
About these practice questions
This XK0-006 question is part of Courseiva's 781-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.