CompTIA Linux+ (XK0-006) — All Questions

Which special permission bit, when set on a directory, ensures that only a file's owner (or root) can delete or rename files within it?

• a.SUID
• b.Sticky bit✓
• c.SGID
• d.Read-only bit

The sticky bit (as on /tmp, shown as 't') restricts deletion so only the file owner, directory owner, or root can remove or rename entries. SUID and SGID affect execution identity and group inheritance, not deletion restrictions.

Which command reports the current SELinux enforcement mode?

• a.aa-status
• b.ufw status
• c.getenforce✓
• d.sestatus --relabel

'getenforce' prints the current SELinux mode: Enforcing, Permissive, or Disabled. 'aa-status' is for AppArmor, 'ufw status' checks a firewall, and 'sestatus --relabel' is not a valid option (sestatus alone gives detailed status).

In firewalld, which command permanently allows inbound HTTPS traffic in the default zone?

• a.firewall-cmd --permanent --add-service=https✓
• b.iptables -A INPUT -j DROP
• c.firewall-cmd --panic-on
• d.nft flush ruleset

'firewall-cmd --permanent --add-service=https' adds the https service to the zone's persistent configuration (apply with --reload). '--panic-on' blocks all traffic, 'iptables -A INPUT -j DROP' would drop packets, and 'nft flush ruleset' erases nftables rules.

Which sshd_config setting most effectively hardens SSH by preventing direct root logins?

• a.PasswordAuthentication yes
• b.X11Forwarding yes
• c.PermitEmptyPasswords yes
• d.PermitRootLogin no✓

Setting 'PermitRootLogin no' forces administrators to log in as a normal user and escalate with sudo, reducing brute-force and audit risk. Enabling password auth, empty passwords, or X11 forwarding weakens rather than strengthens the configuration.