SY0-701 Question 251
Single answer4.1 Given a scenario, apply common security techniques to computing resources.A systems administrator is hardening a group of Linux-based web servers that host an internal business application. A recent audit found that several administrators routinely use shared root credentials for maintenance, and forensic investigations have been difficult because actions cannot be tied to a specific person. The organization wants to reduce the risk of credential misuse while still allowing administrators to perform privileged tasks when needed. Which of the following is the BEST solution?
- A
Require administrators to log in directly as root, but enforce longer passwords and rotate them weekly
- B
Create individual administrative accounts and require the use of sudo for privileged commands
- C
Disable all command-line access and require administrators to manage the servers only through a shared remote desktop session
- D
Use a single privileged account protected by multifactor authentication and store the password in a shared document repository
Show answer and explanation
Correct answer: B
Explanation
The best answer is to create individual administrative accounts and require the use of sudo for privileged commands. This approach applies common security techniques to computing resources by enforcing least privilege, improving accountability, and strengthening audit trails. In Linux environments, sudo is widely used to allow authorized users to perform specific administrative actions without sharing the root password or logging in directly as root. This supports forensic investigations because logs can associate privileged actions with a unique user account. Best practices from sources such as vendor hardening guides, CIS Benchmarks, and general administrative security guidance recommend named administrative accounts, limiting direct root access, and using privilege escalation tools with logging rather than shared privileged credentials.
- A. Incorrect.
This is incorrect because continuing to use direct root logins with a shared credential does not provide individual accountability. Although stronger passwords and frequent rotation improve password hygiene, they do not solve the auditability problem. Security best practices generally recommend limiting or disabling direct root login where possible and using named accounts for traceability.
- B. Correct.
This is correct because individual administrative accounts provide accountability, and sudo allows users to elevate privileges only for approved commands. This supports least privilege, improves logging, and makes it easier to attribute actions to specific administrators during auditing or incident response. This is a common hardening practice on Linux systems.
- C. Incorrect.
This is incorrect because removing command-line access does not inherently improve accountability or privileged access control. A shared remote desktop session would still create attribution problems if multiple administrators use the same environment or credentials. It also may hinder legitimate administration without addressing the root issue of shared privileged access.
- D. Incorrect.
This is incorrect because even with multifactor authentication, a single shared privileged account still weakens nonrepudiation and accountability. Storing the password in a shared document repository increases exposure risk and does not align with secure privileged access management practices. MFA strengthens authentication, but it does not compensate for the problems caused by shared administrative identities.