Least Privilege Automation Account for Linux Maintenance
A Linux operations team must run a nightly maintenance script on 70 servers to rotate logs and restart one service. Security will not allow interactive SSH logins, and the script should only have the permissions required for those two commands. Which two configuration choices best meet the requirement? Select two.
Quick Answer
The answer is to use SSH key authentication with a restricted shell or forced command for the automation account, combined with a sudoers entry limiting the account to only `/usr/sbin/logrotate` and `/usr/bin/systemctl restart <service>`. This configuration enforces least privilege by ensuring the automation account has no interactive login capability and can execute only the two specific commands required for the nightly maintenance script, preventing any lateral movement or privilege escalation. On the Security+ SY0-701 exam, this scenario tests your understanding of how to implement the principle of least privilege for automated tasks in Linux, often appearing as a distractor where candidates mistakenly choose a shared password or a full sudo access. A common trap is assuming a regular user account with a strong password is sufficient, but the key is restricting both authentication method (SSH keys) and command scope (sudoers). Memory tip: think “Keys and Commands, not Shells and Passwords” to remember that automation accounts need key-based authentication and command-level restrictions, not interactive shells.
⚠ Common exam trap
It's easy for candidates to assume placing an account in a privileged group (like root) is acceptable for automation, but CompTIA tests the principle of least privilege, requiring exact command restriction rather than broad group membership.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a dedicated automation account and restrict it in sudoers to the exact commands needed.
Option A is correct because a dedicated automation account scoped in sudoers to only the exact log-rotation and service-restart commands enforces least privilege, satisfying the requirement that the script have only the permissions needed for those two operations. Option C is correct because SSH key authentication with a forced command (via authorized_keys command=) or a restricted shell prevents interactive logins while still allowing the non-interactive nightly job to execute only the permitted action, directly meeting the security ban on interactive SSH. Option B is wrong because adding the account to the root group grants far broader privileges than the two required commands, violating least privilege. Option D is wrong because embedding an administrator's personal password in a script is a credential-exposure and non-repudiation violation and does not meet the no-interactive-login policy. Option E is wrong because one-time email approval followed by unrestricted permanent execution removes all ongoing access control and auditing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a dedicated automation account and restrict it in sudoers to the exact commands needed.
Why this is correct
A dedicated automation account with sudoers entries limited to the exact log-rotation and service-restart commands enforces least privilege, satisfying the requirement that the script hold only the permissions those two commands need, rather than broad root or unrestricted sudo access.
- ✗
Place the automation account in the root group so it can restart services everywhere.
Why it's wrong here
Root group membership grants unrestricted privilege across every command, violating the least-privilege requirement that the script hold only log-rotation and service-restart rights. It tempts because restarting services often needs elevated rights; scoped sudoers entries for those two commands would be correct instead.
- ✓
Use SSH key authentication with a restricted shell or forced command for the automation account.
Why this is correct
Key-based authentication removes interactive password prompts, and a restricted shell or forced command pins the session to the maintenance script, satisfying the ban on interactive SSH logins while preventing the automation account from running arbitrary commands on the 70 servers.
- ✗
Copy the administrator's personal password into the script so the job can log in unattended.
Why it's wrong here
Embedding a personal administrator password in the script exposes reusable credentials and breaks non-repudiation, and interactive-login restrictions remain unmet. It tempts because unattended jobs need non-interactive authentication; a dedicated automation key or certificate with command restrictions would be the correct mechanism.
- ✗
Approve the job through email one time, then allow the script to run with no restrictions forever.
Why it's wrong here
Approving once then running unrestricted forever grants standing privileges, so the script gains far more than the two required commands and no per-run authorisation remains. It is tempting because one-time approval workflows exist for scheduled jobs, but those still scope each execution to defined commands rather than removing all restrictions permanently.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
This SY0-701 question is part of Courseiva's 1,030-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A Linux operations team must run a nightly maintenance workflow on 60 servers to rotate logs and restart one service. Security does not allow interactive root logins, and every execution must be auditable. Which two practices best support secure administration? Select two.
hard- ✓ A.Use a dedicated service account with sudo rights limited to the exact commands in the workflow.
- ✓ B.Run the workflow through a centralized automation platform that records execution time and output.
- C.Hardcode the root password in the script so the same job works everywhere.
- D.Share one privileged SSH key among all administrators for convenience.
- E.Disable command logging so the maintenance output is easier to review.
Why A: Using a dedicated service account with sudo rights limited to the exact commands in the workflow enforces the principle of least privilege. This ensures that even if the account is compromised, an attacker can only execute the specific log rotation and service restart commands, not arbitrary root-level operations. It also eliminates the need for interactive root logins, satisfying the security policy while maintaining auditability through sudo logs. Running the workflow through a centralized automation platform that records execution time and output complements this by providing a tamper-evident audit trail, ensuring that all actions are logged and attributable, which is essential for non-repudiation and secure administration.
Variation 2. A Linux operations team needs to run a nightly script that restarts one service and archives its logs on 60 servers. Security does not want an administrator to log in interactively, and the script should have only the permissions needed for that job. What is the best approach?
medium- A.Use the root account so the job never fails.
- ✓ B.Create a dedicated service account with only the delegated rights needed, and run the script as a scheduled job.
- C.Store an administrator's SSH key inside the script.
- D.Have an operator log in and run the commands manually each night.
Why B: It follows the principle of least privilege by creating a dedicated service account with only the specific rights needed to restart the service and archive logs. Running the script as a scheduled job (e.g., via cron) eliminates the need for interactive login, satisfying the security requirement. This approach minimizes the attack surface and ensures the job runs automatically without exposing administrative credentials.
Variation 3. A nightly patch script restarts services on 40 Linux servers. Security does not want an administrator to log in interactively, and the script should only have the permissions needed to install approved patches and restart those services. What is the best design?
medium- ✓ A.Run the script with a dedicated automation account that has only the required sudo permissions
- B.Use the root account for every scheduled execution to avoid permission errors
- C.Hard-code the administrator password in the script so it never prompts
- D.Ask each server owner to manually patch their system during the maintenance window
Why A: It follows the principle of least privilege by using a dedicated automation account with only the specific sudo permissions needed to install approved patches and restart services. This prevents interactive login (as the account is configured for non-interactive use) and ensures the script cannot perform unauthorized actions, aligning with security best practices for automated tasks.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.