SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A vulnerability scan finds that an administrative SSH service on a Linux server is listening on 0.0.0.0 and is reachable from the internet. The server is meant to be managed only from the internal admin subnet. What is the best remediation?
⚠ Common exam trap
Candidates often think patching the client (Option A) or adding authentication (Option C) solves the exposure, but the core issue is network-level access control—no amount of client-side patching or portal authentication can prevent an attacker from reaching the open SSH port from the internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict SSH to the management network and block public access with firewall or host-based rules.
The vulnerability is that SSH is exposed to the internet on 0.0.0.0, which violates the principle of least privilege and exposes the administrative interface to unauthorized access. The best remediation is to restrict SSH to the internal management subnet using firewall rules (e.g., iptables, security group ACLs) or host-based rules (e.g., tcpwrappers, /etc/hosts.allow), ensuring only trusted internal IPs can reach the service. This directly addresses the exposure without changing the protocol or client configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Patch the SSH client on administrator laptops so the server cannot be reached externally.
Why it's wrong here
Patching the SSH client on administrator laptops only addresses client-side vulnerabilities and does not alter the server's network exposure. The administrative SSH service remains accessible from the public internet, allowing attackers to target it directly. The correct remediation is to restrict network access to the management network, not to patch the clients.
- ✓
Restrict SSH to the management network and block public access with firewall or host-based rules.
Why this is correct
Restricting SSH to the management network and blocking public access at the firewall or with host-based rules is the appropriate least-exposure control. This ensures only trusted administrative workstations can reach the SSH service, reducing the attack surface and preventing external brute-force or exploitation attempts. This approach aligns with secure administrative practices by providing network-level access control.
- ✗
Enable a captive portal on the public interface so only authenticated users see the service.
Why it's wrong here
A captive portal on the public interface is designed to control web browsing by presenting an authentication page, and it does not intercept or protect SSH traffic. SSH operates on a separate protocol that is not subject to HTTP-based portal controls, so attackers can bypass it completely. Moreover, this would not restrict network-level access to the SSH port; it merely adds an ineffective, unrelated layer.
- ✗
Replace SSH with FTP because FTP can be configured to allow administrative access more easily.
Why it's wrong here
Replacing SSH with FTP would be a significant security regression because FTP transmits credentials and data in cleartext, making them susceptible to sniffing and man-in-the-middle attacks. FTP also lacks strong authentication and integrity mechanisms, which are essential for administrative access. This change would expose the service to interception and compromise, directly undermining security.
Visual reference
Go deeper
Related to this question
Learn chapter
Network-Based Attacks
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.