LPIC-2 System Security Practice Question
A system administrator wants to enforce key-based SSH authentication for all users on a server, disabling password authentication. Which two commands must be executed to achieve this? (Choose TWO.)
⚠ Common exam trap
A common mix-up: candidates think `chmod 600 ~/.ssh/authorized_keys` (Option D) directly enforces key-based authentication, but it only sets file permissions; the actual enforcement requires configuration changes in `sshd_config` and key generation/deployment via `ssh-keygen` and `ssh-copy-id`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ssh-keygen -t rsa -b 4096
`ssh-keygen -t rsa -b 4096` generates a 4096-bit RSA key pair, which is a prerequisite for key-based authentication. Option E is correct because `ssh-copy-id user@server` securely copies the public key to the server's `~/.ssh/authorized_keys` file, enabling key-based login. Together, these commands allow the administrator to then disable password authentication by editing `/etc/ssh/sshd_config` (setting `PasswordAuthentication no`) and restarting the SSH service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
sshd -T
Why it's wrong here
Tests the SSH daemon configuration but does not set up keys.
- ✗
visudo
Why it's wrong here
Edits the sudoers file, unrelated to SSH key authentication.
- ✓
ssh-keygen -t rsa -b 4096
Why this is correct
Generates the SSH key pair.
- ✗
chmod 600 ~/.ssh/authorized_keys
Why it's wrong here
Sets correct permissions but is not a command to achieve key-based auth; it's a post-step.
- ✓
ssh-copy-id user@server
Why this is correct
Copies the public key to the remote server's authorized_keys file.
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
This LPIC-2 question is part of Courseiva's 507-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.