ISC2 CC Security Operations Practice Question
A security administrator is configuring a Linux web server and wants to ensure that only encrypted administrative sessions are allowed, while also preventing direct root logins over the network. Which of the following should the administrator implement?
⚠ Common exam trap
The trap here is assuming that any remote access method with strong passwords is sufficient, while overlooking that Telnet is unencrypted and thus fails the encryption requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable SSH with PermitRootLogin set to no and restrict access to the management subnet.
The requirement is to allow only encrypted administrative sessions and prevent direct root logins. SSH is the standard encrypted remote administration protocol on Linux. Setting PermitRootLogin to no blocks direct root access over SSH, and restricting access to a management subnet adds defense in depth. Together, these measures meet both conditions without disrupting necessary administration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Telnet with strong password policies and disable the root account.
Why it's wrong here
Telnet transmits data, including credentials, in cleartext, so it does not provide encrypted administrative sessions. Disabling the root account entirely would also hinder necessary administrative tasks. This option fails to meet the encryption requirement and introduces operational issues, making it incorrect for this scenario.
- ✗
Implement a VPN for all server traffic and allow root logins only from the local console.
Why it's wrong here
While a VPN adds encryption, it does not inherently prevent direct root logins over the network if SSH is still enabled with root access. Allowing root logins from the local console only is a good practice, but the VPN alone does not enforce that. This option does not fully address the requirement to prevent direct root logins over the network.
- ✗
Configure a host-based firewall to allow only HTTP and HTTPS traffic and disable SSH.
Why it's wrong here
Allowing only HTTP and HTTPS traffic and disabling SSH would prevent any remote administrative access, including encrypted sessions. This does not satisfy the need for encrypted administrative sessions; it eliminates them entirely. Therefore, this option is not appropriate for the stated goal of enabling secure management access.
- ✓
Enable SSH with PermitRootLogin set to no and restrict access to the management subnet.
Why this is correct
SSH provides encrypted administrative sessions, and setting PermitRootLogin to no prevents direct root logins over the network. Restricting access to the management subnet further reduces the attack surface. This combination directly addresses the requirements of encrypted management and no direct root access, making it the correct choice for securing the Linux web server.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Security Components and Controls
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Standard
A standard is an agreed-upon set of rules, guidelines, or specifications that ensure consistency, compatibility, and quality across IT products, services, and processes.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.