The answer is a missing or mismatched SSH server host key in the known_hosts file. This is because Paramiko enforces host key verification by default before it even attempts client key authentication; if the server’s host key is not recognized or fails validation, Paramiko raises an AuthenticationException immediately, regardless of whether the private key is correct. On the CompTIA PenTest+ PT0-002 exam, this tests your understanding that SSH host key verification is a distinct, pre-authentication security layer—a common trap is assuming the error stems from the client key itself. Remember the order: host key check first, then client key. A useful memory tip is “Host before handshake”—the host key must be trusted before any key-based login proceeds.
PT0-002 Practice Question: Paramiko verifies SSH server host keys by default.
This PT0-002 practice question tests your understanding of tools and code analysis. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: paramiko verifies SSH server host keys by default.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A penetration tester is analyzing a Python script that uses the 'paramiko' library to automate SSH key-based authentication across multiple servers. The script fails with 'AuthenticationException' for some servers that the tester is certain have the correct private key configured. Which of the following is the most likely cause of this failure?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The SSH server host key is not in the known_hosts file.
The 'paramiko' library in Python handles SSH key-based authentication by first verifying the server's host key against the known_hosts file. If the host key is missing or mismatched, paramiko raises an AuthenticationException before even attempting client key authentication, even if the private key is correct. This is because paramiko enforces host key verification by default to prevent man-in-the-middle attacks, and a failure at this stage blocks the authentication process entirely.
Key principle: Paramiko verifies SSH server host keys by default.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The servers are running a different SSH version.
Why it's wrong here
Paramiko supports multiple SSH versions, so this is unlikely to cause the error.
✗
The public key is not in the server's authorized_keys file.
Why it's wrong here
The tester is certain the correct key is configured, so this is not the issue.
✓
The SSH server host key is not in the known_hosts file.
Why this is correct
Correct. Paramiko verifies host keys by default; if the host key is not known, it raises AuthenticationException to prevent man-in-the-middle attacks.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Paramiko verifies SSH server host keys by default.
✗
The username specified is incorrect.
Why it's wrong here
If username were incorrect, the error would be different, such as 'Authentication failed' after trying all methods.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume AuthenticationException always means a client credential problem (private key or username), but Cisco tests the nuance that paramiko's host key verification failure can raise this exception before client authentication even begins.
Detailed technical explanation
How to think about this question
Paramiko uses the 'MissingHostKeyPolicy' to handle unknown host keys; by default, it raises an SSHException (which can manifest as an AuthenticationException in some wrapper code) if the host key is not in known_hosts. The known_hosts file stores server host public keys (typically RSA or Ed25519) and is checked during the SSH key exchange phase (RFC 4253), before any user authentication occurs. In real-world scenarios, this often catches testers off guard when they add new servers to a test environment but forget to update known_hosts, leading to confusing authentication failures.
KKey Concepts to Remember
Paramiko verifies SSH server host keys by default.
Host keys are stored in the client's known_hosts file.
Unknown or changed host keys trigger AuthenticationException.
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Paramiko verifies SSH server host keys by default.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this PT0-002 question in full detail.
Tools and Code Analysis — This question tests Tools and Code Analysis — Paramiko verifies SSH server host keys by default..
What is the correct answer to this question?
The correct answer is: The SSH server host key is not in the known_hosts file. — The 'paramiko' library in Python handles SSH key-based authentication by first verifying the server's host key against the known_hosts file. If the host key is missing or mismatched, paramiko raises an AuthenticationException before even attempting client key authentication, even if the private key is correct. This is because paramiko enforces host key verification by default to prevent man-in-the-middle attacks, and a failure at this stage blocks the authentication process entirely.
What should I do if I get this PT0-002 question wrong?
Review paramiko verifies SSH server host keys by default., then practise related PT0-002 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Paramiko verifies SSH server host keys by default.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.