SSCP Systems and Application Security Practice Question
A security engineer is hardening a Linux server. Which TWO actions are recommended to reduce the attack surface? (Select TWO.)
⚠ Common exam trap
The trap is that some options sound like security measures (installing a management web server, enabling IPv6) but actually expand the attack surface—candidates must distinguish between adding functionality and reducing exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove unnecessary services and daemons
Option A is correct because removing unnecessary services and daemons eliminates listening ports, binaries, and potential vulnerabilities that attackers could exploit, directly shrinking the attack surface. Option B is correct because disabling unused user accounts removes dormant credentials and login paths that could be abused for unauthorized access or privilege escalation. Option C is wrong because installing a web server for management adds a new network-facing service and increases, rather than reduces, the attack surface. Option D is wrong because setting umask to 000 makes newly created files world-readable and world-writable, weakening permissions instead of hardening them. Option E is wrong because enabling IPv6 routing adds network functionality and exposure that is unnecessary on a hardened server and can introduce additional attack vectors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Remove unnecessary services and daemons
Why this is correct
Removing unnecessary services and daemons eliminates listening ports and executable code that attackers could exploit, directly shrinking the server's attack surface. This satisfies the hardening constraint by reducing the number of potential entry points requiring patching and monitoring.
- ✓
Disable unused user accounts
Why this is correct
Disabling unused user accounts removes dormant credentials that attackers could exploit for initial access or privilege escalation. Eliminating these accounts directly shrinks the server's attack surface, satisfying the hardening scenario's requirement to reduce exploitable entry points.
- ✗
Install a web server for management
Why it's wrong here
Installing a web server adds listening services, ports and potential vulnerabilities, enlarging the attack surface rather than reducing it. It is tempting because browser-based administration is convenient, and would suit a dedicated management host isolated on a separate hardened network.
- ✗
Set umask to 000
Why it's wrong here
Setting umask to 000 makes newly created files world-readable and world-writable, weakening permissions and expanding exposure. It is tempting because permissive masks avoid access-denied errors during troubleshooting, and would be acceptable only on an isolated, disposable test system.
- ✗
Enable IPv6 routing
Why it's wrong here
Enabling IPv6 routing turns the host into a router, opening forwarding and additional protocol attack paths that hardening seeks to close. It is tempting because IPv6 connectivity is desirable, and would be correct on a designated gateway or router performing that forwarding role.
Visual reference
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.