While performing a security review you discover that tftp.service is active on a RHEL 9 server that should not expose any insecure file-transfer services. You must stop the service immediately and guarantee that it cannot be started again-either at boot or through a manual systemctl start-until an administrator explicitly re-enables it. Which single systemctl command satisfies this hardening requirement?
systemctl mask --now tftp.service first stops the running unit (because of the --now flag) and then creates a symbolic link from its unit file to /dev/null. This masks the unit, making any automatic or manual activation impossible until it is un-masked, fully meeting the requirement to eliminate the insecure TFTP service.
systemctl disable --now tftp.service stops the service and prevents it from starting at the next boot, but an administrator (or dependency) could still start it manually.
systemctl stop tftp.service only halts the service for the current session; it can start again on the next boot or if triggered by a socket unit.
systemctl mask --runtime tftp.service masks the unit only for the current boot cycle; after a reboot the mask disappears, so it does not provide the permanent protection required.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What does masking a service with `systemctl mask` do?
Open an interactive chat with Bash
What is the difference between `mask` and `disable` in systemctl?
Open an interactive chat with Bash
What does the `--now` flag do in systemctl commands?
Open an interactive chat with Bash
CompTIA Linux+ XK0-006 (V8)
Security
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
IT & Cybersecurity Package Join Premium for Full Access