Least Privilege Automation Account for Linux Maintenance
A Linux operations team must run a nightly maintenance script on 70 servers to rotate logs and restart one service. Security will not allow interactive SSH logins, and the script should only have the permissions required for those two commands. Which two configuration choices best meet the requirement? Select two.
Quick Answer
The answer is to use SSH key authentication with a restricted shell or forced command for the automation account, combined with a sudoers entry limiting the account to only `/usr/sbin/logrotate` and `/usr/bin/systemctl restart <service>`. This configuration enforces least privilege by ensuring the automation account has no interactive login capability and can execute only the two specific commands required for the nightly maintenance script, preventing any lateral movement or privilege escalation. On the Security+ SY0-701 exam, this scenario tests your understanding of how to implement the principle of least privilege for automated tasks in Linux, often appearing as a distractor where candidates mistakenly choose a shared password or a full sudo access. A common trap is assuming a regular user account with a strong password is sufficient, but the key is restricting both authentication method (SSH keys) and command scope (sudoers). Memory tip: think “Keys and Commands, not Shells and Passwords” to remember that automation accounts need key-based authentication and command-level restrictions, not interactive shells.
⚠ Common exam trap
It's easy for candidates to assume placing an account in a privileged group (like root) is acceptable for automation, but CompTIA tests the principle of least privilege, requiring exact command restriction rather than broad group membership.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a dedicated automation account and restrict it in sudoers to the exact commands needed.
Creating a dedicated automation account and restricting it in sudoers to the exact commands needed (e.g., `/usr/sbin/logrotate` and `/usr/bin/systemctl restart <service>`) enforces the principle of least privilege. This ensures the account can only execute the specific maintenance tasks without granting interactive SSH access or unnecessary permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a dedicated automation account and restrict it in sudoers to the exact commands needed.
Why this is correct
A dedicated account makes auditing clear, and sudoers restrictions enforce least privilege for only the approved commands.
- ✗
Place the automation account in the root group so it can restart services everywhere.
Why it's wrong here
Root-group membership gives far more access than needed and defeats the requirement for limited, auditable privileges.
- ✓
Use SSH key authentication with a restricted shell or forced command for the automation account.
Why this is correct
Key-based access supports unattended logins, and a restricted shell or forced command limits what the account can do.
- ✗
Copy the administrator's personal password into the script so the job can log in unattended.
Why it's wrong here
Embedding a personal password is insecure, hard to audit, and violates good privileged access management practice.
- ✗
Approve the job through email one time, then allow the script to run with no restrictions forever.
Why it's wrong here
An email approval does not enforce technical controls and does not limit future privilege or command scope.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A Linux operations team must run a nightly maintenance workflow on 60 servers to rotate logs and restart one service. Security does not allow interactive root logins, and every execution must be auditable. Which two practices best support secure administration? Select two.
hard- ✓ A.Use a dedicated service account with sudo rights limited to the exact commands in the workflow.
- ✓ B.Run the workflow through a centralized automation platform that records execution time and output.
- C.Hardcode the root password in the script so the same job works everywhere.
- D.Share one privileged SSH key among all administrators for convenience.
- E.Disable command logging so the maintenance output is easier to review.
Why A: Using a dedicated service account with sudo rights limited to the exact commands in the workflow enforces the principle of least privilege. This ensures that even if the account is compromised, an attacker can only execute the specific log rotation and service restart commands, not arbitrary root-level operations. It also eliminates the need for interactive root logins, satisfying the security policy while maintaining auditability through sudo logs. Running the workflow through a centralized automation platform that records execution time and output complements this by providing a tamper-evident audit trail, ensuring that all actions are logged and attributable, which is essential for non-repudiation and secure administration.
Variation 2. A Linux operations team needs to run a nightly script that restarts one service and archives its logs on 60 servers. Security does not want an administrator to log in interactively, and the script should have only the permissions needed for that job. What is the best approach?
medium- A.Use the root account so the job never fails.
- ✓ B.Create a dedicated service account with only the delegated rights needed, and run the script as a scheduled job.
- C.Store an administrator's SSH key inside the script.
- D.Have an operator log in and run the commands manually each night.
Why B: It follows the principle of least privilege by creating a dedicated service account with only the specific rights needed to restart the service and archive logs. Running the script as a scheduled job (e.g., via cron) eliminates the need for interactive login, satisfying the security requirement. This approach minimizes the attack surface and ensures the job runs automatically without exposing administrative credentials.
Variation 3. A nightly patch script restarts services on 40 Linux servers. Security does not want an administrator to log in interactively, and the script should only have the permissions needed to install approved patches and restart those services. What is the best design?
medium- ✓ A.Run the script with a dedicated automation account that has only the required sudo permissions
- B.Use the root account for every scheduled execution to avoid permission errors
- C.Hard-code the administrator password in the script so it never prompts
- D.Ask each server owner to manually patch their system during the maintenance window
Why A: It follows the principle of least privilege by using a dedicated automation account with only the specific sudo permissions needed to install approved patches and restart services. This prevents interactive login (as the account is configured for non-interactive use) and ensures the script cannot perform unauthorized actions, aligning with security best practices for automated tasks.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.