nerdexam
CompTIA

XK0-004 · Question #429

An administrator tries to log m to a Linux host with the root account but receives the following error: permission denied. A colleague confirms the password being used is correct. Which of the…

The correct answer is D. PermitRootLogin IS Set to no in /etc/sah/sshd/config. SSH can be configured to deny root login attempts via the PermitRootLogin directive in sshd_config, which would cause a 'permission denied' error even with a correct password.

Security

Question

An administrator tries to log m to a Linux host with the root account but receives the following error:

permission denied. A colleague confirms the password being used is correct. Which of the following is the MOST likely cause..

Options

  • AThe administrator must first run ssh-copy-id
  • BThe Linux host cannot connect to the LDAP server
  • CThe root account is locked out from too many failed password attempts
  • DPermitRootLogin IS Set to no in /etc/sah/sshd/config
  • EThe root account was removed from the system for security purposes

How the community answered

(23 responses)
  • A
    4% (1)
  • D
    87% (20)
  • E
    9% (2)

Why each option

SSH can be configured to deny root login attempts via the PermitRootLogin directive in sshd_config, which would cause a 'permission denied' error even with a correct password.

AThe administrator must first run ssh-copy-id

ssh-copy-id is used to install public keys for key-based authentication; it is not required for password-based root login and would not produce a permission denied error.

BThe Linux host cannot connect to the LDAP server

LDAP connectivity issues affect domain/directory accounts, not the local root account which is authenticated locally via /etc/shadow.

CThe root account is locked out from too many failed password attempts

Account lockout from failed attempts would typically produce a different error message such as 'account locked' and the colleague confirmed the password is correct implying no prior failures.

DPermitRootLogin IS Set to no in /etc/sah/sshd/configCorrect

The /etc/ssh/sshd_config file controls SSH daemon behavior, and setting PermitRootLogin to 'no' explicitly blocks all SSH login attempts by the root user regardless of password validity. This is a common security hardening measure on Linux systems and directly explains receiving 'permission denied' despite using the correct credentials.

EThe root account was removed from the system for security purposes

Removing the root account entirely would produce a different error indicating the user does not exist, not a generic permission denied message.

Concept tested: SSH PermitRootLogin directive in sshd_config

Source: https://man.openbsd.org/sshd_config#PermitRootLogin

Topics

#SSH configuration#PermitRootLogin#sshd_config#root access

Community Discussion

No community discussion yet for this question.

Full XK0-004 Practice