Fogo Server Certification Practice Test 2026 - Free Practice Questions and Study Guide

These mount options are security-hardening flags you apply to a filesystem to limit what can happen from that mount. The noexec flag blocks the execution of binaries located on that filesystem; if someone tries to run a program from there, the attempt will fail. The nodev flag prevents device files from being interpreted or created on that filesystem, so normal /dev-style devices can’t be accessed through it. The nosuid flag makes the system ignore the set-user-ID and set-group-ID bits on files on that filesystem, so privilege escalation via those binaries can’t occur from that mount. Used together, they reduce the risk posed by untrusted or user-writable mounts by preventing execution, device access, and privilege escalation on that mount. You’d typically apply them to untrusted mounts such as /tmp or other directories that users can write to.

Other statements misstate what these options do—none of them cause services to start, log device usage, or grant privileges, and they aren’t tied to network mounts, USB devices, or system partitions.