A security engineer is hardening a Linux server and wants to restrict which processes can bind to privileged ports (below 1024) without running as root. Which Linux capability allows this on a per-binary basis?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because CAP_NET_BIND_SERVICE is a Linux capability that grants a specific process the ability to bind to privileged ports without requiring it to run as root, following the principle of least privilege. B is wrong because SUID causes the binary to run as its file owner (often root), which grants excessive privileges beyond just port binding.
Full explanation below image
Full Explanation
A is correct because CAP_NET_BIND_SERVICE is a Linux capability that grants a specific process the ability to bind to privileged ports without requiring it to run as root, following the principle of least privilege. B is wrong because SUID causes the binary to run as its file owner (often root), which grants excessive privileges beyond just port binding. C is wrong because adding a user to sudoers grants broad administrative access via sudo, not a minimal port-binding capability. D is wrong because AppArmor profiles restrict what a process can do but do not grant the capability to bind to privileged ports; the kernel capability must still be assigned.