mediumMultiple Choice
SSCP Practice Question: A system administrator needs to ensure that a…
A system administrator needs to ensure that a Linux server is hardened against common attacks. Which configuration change is MOST effective in preventing privilege escalation via SUID binaries?
⚠ Common exam trap
Many exam-takers think logging (auditd) or removing all SUID binaries is a viable solution, but the exam tests the understanding that 'nosuid' is a practical, targeted control that prevents exploitation without breaking legitimate system functionality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mount the /tmp and /var partitions with the 'nosuid' option.
Mounting partitions like /tmp and /var with the 'nosuid' option prevents SUID and SGID bits from taking effect on files stored there. Since attackers often place malicious SUID binaries in world-writable directories to escalate privileges, this configuration blocks the execution of such binaries regardless of their permissions. This is more effective than logging or removing all SUID binaries, as it proactively neutralizes a common attack vector without breaking system functionality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable auditd to log all SUID executions.
Why it's wrong here
Auditd records SUID executions after the fact but leaves the binaries executable, so escalation still succeeds. Logging is tempting because auditing supports detection and forensics, yet the requirement is prevention; removing the SUID bit or mounting with nosuid actually blocks the escalation path.
- ✗
Set the umask to 077 for all users.
Why it's wrong here
A umask governs default permission bits on newly created files and directories; it cannot strip the SUID bit from existing binaries, so privilege escalation through those binaries continues. Umask hardening is the right control when the goal is restricting default file permissions for newly created content, not remediating pre-existing SUID executables.
- ✓
Mount the /tmp and /var partitions with the 'nosuid' option.
Why this is correct
Mounting /tmp and /var with nosuid blocks setuid execution on world-writable and service-writable filesystems, directly preventing attackers from dropping SUID binaries there to escalate privileges. This satisfies the hardening constraint by removing an entire privilege-escalation vector rather than merely restricting individual binaries.
- ✗
Remove all SUID binaries from the system.
Why it's wrong here
Deleting every SUID binary breaks legitimate functions such as passwd, sudo and mount, causing system failure; the goal is to audit and remove only unnecessary SUID bits, not all of them. Blanket removal would be the correct approach only on a disposable system where no privileged local operations are required.
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.