SSCP Systems and Application Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Disable SELinux for better performance

  Why it's wrong here

  Disabling SELinux strips mandatory access control, letting a compromised process reach files and services beyond its policy, so it should stay enforcing. It is tempting because troubleshooting denials is faster with SELinux permissive or off, and that shortcut is defensible only on isolated lab systems.

• ✗

  Install all available packages to ensure compatibility

  Why it's wrong here

  Installing every available package adds unnecessary daemons, libraries and services, each carrying its own vulnerabilities, so only required software should be present. It is tempting because broad package installation is a quick way to guarantee dependency compatibility on development or build machines where convenience outweighs exposure.

• ✓

  Remove unnecessary services and software packages

  Why this is correct

  Removing unnecessary services and packages eliminates unused daemons, open ports and vulnerable libraries, shrinking the number of exploitable entry points on the host. This directly reduces the attack surface, which is the hardening goal stated in the scenario.

• ✓

  Set file permissions using chmod and chown to restrict access

  Why this is correct

  Applying chmod and chown enforces least privilege at the filesystem layer, so only authorised users and groups can read, write or execute sensitive files. This directly reduces the attack surface by removing world-readable and world-writable permissions that attackers exploit.

• ✗

  Enable the root account for direct login

  Why it's wrong here

  Direct root login removes accountability and gives attackers a known, privileged account to target, so administrators should use sudo from named accounts instead. It is tempting because root access is sometimes enabled for convenience during initial provisioning or break-glass recovery, where no alternative administrative path exists.

Go deeper

Related to this question