SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A vulnerability scan finds an administrative SSH service listening on 0.0.0.0 on a server that should be managed only from the internal network. What is the main security issue?
⚠ Common exam trap
The trap here is that candidates may focus on the SSH service itself (e.g., thinking of weak passwords or outdated versions) rather than recognizing that the binding to 0.0.0.0 is a network exposure misconfiguration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exposed management service
The SSH service binding to 0.0.0.0 means it is listening on all network interfaces, including external-facing ones. This exposes the administrative management interface to potentially untrusted networks, violating the principle of least privilege and increasing the attack surface. The main security issue is that a service intended for internal management only is accessible from outside the trusted internal network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Exposed management service
Why this is correct
This is the correct answer because the admin SSH service is reachable on all interfaces instead of being limited to the internal management network. That increases attack surface and allows unauthorized internet exposure if firewall rules are weak or missing. The problem is the service placement and exposure, not the SSH protocol itself.
- ✗
Default credentials
Why it's wrong here
Default credentials are a distinct authentication flaw (e.g., unchanged vendor accounts like admin:admin). This scan result only indicates that the administrative SSH service is reachable on all interfaces; it provides no evidence about the passwords or usernames configured. Exposed management service would remain a risk even with strong credentials, because the attack surface is the network reachability itself.
- ✗
Outdated component
Why it's wrong here
An outdated component finding requires version or patch-level information, typically from banner grabbing or CVE correlation. The scan clue here is the service's network exposure (listening on all interfaces) rather than an end-of-life or unpatched software version. Overstating the issue as outdated would misattribute the root cause, which is improper network segmentation of the management service.
- ✗
Weak permissions
Why it's wrong here
Weak permissions usually concern file, folder, or object access controls, such as world-writable SSH private keys or lax configuration file modes. The vulnerability scan's finding about an exposed administrative SSH service points to a network boundary issue, not a filesystem permission problem. The correct remediation is restricting the service to a management VLAN or jump host, not modifying ACLs on files.
Go deeper
Related to this question
Learn chapter
Network-Based Attacks
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.