nerdexam
CompTIA

XK0-005 · Question #1586

A Linux administrator provisioned a new web server with custom administrative permissions for certain users. The administrator receives a report that user1 is unable to restart the Apache web…

The correct answer is D. Webadmin should be listed as a group in the custom.conf file. To grant user1 permission to restart the Apache service while adhering to a least privilege model, the webadmin group, which user1 is presumably a member of, should be granted specific sudo permissions for the Apache service in the custom.conf file.

System Management

Question

A Linux administrator provisioned a new web server with custom administrative permissions for certain users. The administrator receives a report that user1 is unable to restart the Apache web service on this server. The administrator reviews the following output: Which of the following would most likely resolve the issue while maintaining a least privilege security model?

Exhibit

XK0-005 question #1586 exhibit

Options

  • AUser1 should be added to the wheel group to manage the service.
  • BUser1 should have "NOPASSWD:" after the "ALL=" in the custom.conf.
  • CThe wheel line in the custom.conf file should be uncommented.
  • DWebadmin should be listed as a group in the custom.conf file.

How the community answered

(33 responses)
  • A
    3% (1)
  • B
    6% (2)
  • C
    9% (3)
  • D
    82% (27)

Why each option

To grant `user1` permission to restart the Apache service while adhering to a least privilege model, the `webadmin` group, which `user1` is presumably a member of, should be granted specific sudo permissions for the Apache service in the `custom.conf` file.

AUser1 should be added to the wheel group to manage the service.

Adding `user1` to the `wheel` group typically grants broad administrative privileges, violating the principle of least privilege if only Apache service restarts are needed.

BUser1 should have "NOPASSWD:" after the "ALL=" in the custom.conf.

Adding `NOPASSWD:` for `user1` after `ALL=` gives passwordless execution for all commands, which is a security risk and violates least privilege by removing a security prompt for all actions.

CThe wheel line in the custom.conf file should be uncommented.

Uncommenting the `wheel` line in `custom.conf` would grant potentially broad `sudo` access to all members of the `wheel` group, which likely exceeds the required permissions for `user1` and violates least privilege.

DWebadmin should be listed as a group in the custom.conf file.Correct

Listing `webadmin` as a group in the `custom.conf` sudoers file with explicit permissions for restarting Apache (e.g., `%webadmin ALL=/usr/bin/systemctl restart apache2.service`) allows fine-grained control and maintains the principle of least privilege for members of that group.

Concept tested: Sudoers configuration, least privilege, group-based permissions

Source: https://manpages.ubuntu.com/manpages/jammy/man5/sudoers.5.html

Topics

#sudoers configuration#Least privilege#Linux permissions#Service management

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full XK0-005 Practice