Which option of the openvpn command should be used to ensure that ephemeral keys are not written to the swap space?

Question

Options

• A--mlock
• B--no-swap
• C--root-swap
• D--keys-no-swap

• A
  95% (21)
• C
  5% (1)

Explanation

--mlock is correct because it calls the POSIX mlockall() system call, which locks all current and future process memory pages into RAM, preventing the operating system from swapping them to disk. This is critical for protecting ephemeral (session) keys, since swap space is often unencrypted and could expose sensitive cryptographic material.

Why the distractors are wrong:

• B. --no-swap - Not a real OpenVPN option; sounds plausible but doesn't exist in the OpenVPN command set.
• C. --root-swap - Fabricated option; "root" here is misleading and has no meaning in OpenVPN's flag vocabulary.
• D. --keys-no-swap - Also fabricated; OpenVPN doesn't use this compound naming pattern for key protection.

Memory tip: Think of "mlock" as putting a lock on memory - it locks memory in place so nothing can escape to swap. The mlock name comes directly from the underlying Linux system call, so if you remember the syscall, you remember the flag.

No community discussion yet for this question.