XK0-006 Practice Test 20 — 15 Questions

Question 1

Which file contains the password aging information such as minimum and maximum days between password changes?

Accepted Answer

/etc/shadow. /etc/shadow stores password hashes and aging fields like min, max, warn, and inactive days. /etc/passwd has basic user info, /etc/login.defs has system defaults, and /etc/security/limits.conf sets resource limits.

Answer

/etc/security/limits.conf

Answer

/etc/passwd

Answer

/etc/login.defs

Question 2

Which command displays the current SELinux mode?

Accepted Answer

getenforce. getenforce displays the current SELinux mode (Enforcing, Permissive, Disabled). sestatus provides more detail including mode and policy version. setenforce changes mode, getsebool shows booleans.

Answer

sestatus

Answer

setenforce

Answer

getsebool -a

Question 3

An administrator notices that an AppArmor profile is in complain mode for a service that should be enforcing. Which command changes the profile to enforce mode?

Accepted Answer

aa-enforce /etc/apparmor.d/profile. aa-enforce sets a profile to enforce mode. aa-complain sets to complain, aa-status shows status, and apparmor_parser loads profiles.

Answer

apparmor_parser -r /etc/apparmor.d/profile

Answer

aa-status --enforce /etc/apparmor.d/profile

Answer

aa-complain /etc/apparmor.d/profile

Question 4

A security audit has identified that several users have excessive sudo privileges. The administrator needs to review and modify sudo access. Which two files or commands would be used? (Choose TWO.)

Accepted Answer

visudo. visudo is the recommended way to edit /etc/sudoers safely. The file /etc/sudoers contains the rules. /etc/sudoers.d/ is a directory for drop-in files. The other options are unrelated.

Answer

chage

Answer

usermod -G

Answer

/etc/group

Question 5

A Linux server has SELinux enforcing and a custom application needs to write to /var/log/app.log. The audit log shows 'avc: denied { write } for pid=1234'. After verifying that the application runs in the correct domain, which command should be used to allow the write access by generating a policy module?

Accepted Answer

ausearch -m avc | audit2allow -M myapp. audit2allow reads audit messages and generates SELinux policy allow rules. ausearch can retrieve the specific denial, then audit2allow creates the module.

Answer

chcon -t var_log_t /var/log/app.log

Answer

setsebool -P httpd_unified 1

Answer

restorecon -v /var/log/app.log

Question 6

A security policy requires that users cannot reuse any of their last 5 passwords. Which PAM module and configuration directive enforces this?

Accepted Answer

pam_pwhistory with remember=5. The pam_pwhistory module with the remember directive tracks password history and prevents reuse. pam_pwquality enforces complexity, pam_faillock handles lockout, and pam_tally2 is an older lockout module.

Answer

pam_faillock with deny=5

Answer

pam_tally2 with deny=5

Answer

pam_pwquality with remember=5

Question 7

After a kernel upgrade, the system fails to boot. Which file should be edited to configure GRUB2 to boot into the previous kernel version by default?

Accepted Answer

/etc/default/grub. /etc/default/grub, because this file contains the GRUB2 configuration variables (such as GRUB_DEFAULT) that control which kernel is booted by default. After editing this file, you must run 'grub2-mkconfig -o /boot/grub2/grub.cfg' to regenerate the boot configuration, which sets the previous kernel as the default entry.

Answer

/etc/grub.d/40_custom

Answer

/boot/grub/grub.conf

Answer

/boot/grub2/grub.cfg

Question 8

An administrator needs to generate a self-signed certificate valid for 365 days with a 2048-bit RSA key. Which OpenSSL command correctly creates both the private key and certificate in one step?

Accepted Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes. The 'req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes' generates a self-signed certificate with a key. Other commands either miss -x509, -newkey, or use wrong options.

Answer

openssl x509 -req -in req.pem -signkey key.pem -out cert.pem -days 365

Answer

openssl ca -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

Answer

openssl genrsa -out key.pem 2048 && openssl req -new -x509 -key key.pem -out cert.pem -days 365

Question 9

A system is experiencing high memory usage. The administrator wants to see a brief summary of memory usage in human-readable format, including buffers and cache. Which command is most appropriate?

Accepted Answer

free -h. free -h displays memory usage in human-readable format, including buffers and cache.

Answer

iostat -m

Answer

cat /proc/meminfo

Answer

vmstat -s

Question 10

A system administrator notices that a process with PID 1234 is consuming excessive CPU. The administrator wants to terminate this process gracefully. Which command should be used?

Accepted Answer

kill 1234. kill sends a signal; by default it sends SIGTERM (15), which asks the process to terminate gracefully. SIGKILL (9) is forceful.

Answer

killall 1234

Answer

pkill -9 1234

Answer

kill -9 1234

Question 11

A user reports that they cannot access a file because permission is denied. The file's permissions are -rwsr-xr-x. What special permission is set?

Accepted Answer

SUID. The 's' in the owner execute position indicates SUID (Set User ID) is set.

Answer

No special permission

Answer

Sticky bit

Answer

SGID

Question 12

An administrator needs to replace all occurrences of '192.168.1.1' with '10.0.0.1' in a configuration file named config.txt. Which sed command should be used to perform an in-place edit?

Accepted Answer

sed -i 's/192.168.1.1/10.0.0.1/g' config.txt. sed -i 's/192.168.1.1/10.0.0.1/g' config.txt performs global replacement in-place.

Answer

sed -i 's/192.168.1.1/10.0.0.1/' config.txt

Answer

sed -e 's/192.168.1.1/10.0.0.1/g' config.txt

Answer

sed 's/192.168.1.1/10.0.0.1/g' config.txt > config.txt

Question 13

A system administrator wants to find all files in /var/log that have been modified in the last 7 days and are larger than 10MB, then delete them interactively. Which command accomplishes this?

Accepted Answer

find /var/log -mtime -7 -size +10M -ok rm {} \;. find with -mtime -7 (modified within 7 days) and -size +10M (larger than 10MB) and -ok rm {} \; (prompt before deletion) matches the requirement.

Answer

find /var/log -mtime -7 -size 10M -exec rm -i {} \;

Answer

find /var/log -mtime -7 -size +10M -delete

Answer

find /var/log -mtime +7 -size +10M -ok rm {} \;

Question 14

A process is consuming excessive CPU and needs to be stopped immediately. The process ID is 4582. Which command should be used?

Accepted Answer

kill -9 4582. kill -9 sends SIGKILL, which forcefully terminates the process immediately.

Answer

kill -1 4582

Answer

kill -STOP 4582

Answer

kill -15 4582

Question 15

An administrator wants to grant a specific user, 'jdoe', read and write access to a file that is owned by root:root with permissions 640. The administrator does not want to change the file's owner or group. Which approach should be used?

Accepted Answer

Use setfacl -m u:jdoe:rw file. ACLs allow granting permissions to a specific user without changing the file's owner or group. setfacl -m u:jdoe:rw file sets read-write ACL for user jdoe.

Answer

Change file owner to jdoe

Answer

Use chmod o+rw file

Answer

Add jdoe to the root group