XK0-006 Practice Test 23 — 15 Questions

Question 1

A Linux administrator wants to monitor changes to the /etc/passwd file for security auditing. Which auditctl command should be used?

Accepted Answer

auditctl -w /etc/passwd -p wa -k passwd_change. auditctl -w /etc/passwd -p wa -k passwd_change watches for write and attribute changes.

Answer

auditctl -a always,exit -F path=/etc/passwd -F perm=wa

Answer

auditctl -w /etc/passwd -p r -k passwd_read

Answer

ausearch -f /etc/passwd

Question 2

A security audit reveals that an SELinux boolean 'httpd_can_network_connect' is currently off, but a web application requires Apache to connect to a database server. Which command should the administrator use to enable this boolean persistently?

Accepted Answer

setsebool -P httpd_can_network_connect on. setsebool -P makes the change persistent across reboots.

Answer

setenforce 1

Answer

setsebool httpd_can_network_connect 1

Answer

getsebool httpd_can_network_connect

Question 3

Which command displays the current SELinux mode (e.g., enforcing, permissive, disabled)?

Accepted Answer

getenforce. getenforce shows the current mode. getsebool shows boolean values. sestatus shows more detailed status including mode and policy. seinfo shows policy information.

Answer

getsebool -a

Answer

seinfo

Answer

sestatus

Question 4

A Linux administrator needs to configure a firewall to allow incoming SSH connections on the default port. Which firewalld command accomplishes this permanently?

Accepted Answer

firewall-cmd --add-service=ssh --permanent && firewall-cmd --reload. The correct command adds the ssh service to the default zone permanently and reloads the firewall.

Answer

firewall-cmd --add-port=22/tcp --permanent

Answer

firewall-cmd --add-service=ssh

Answer

firewall-cmd --zone=public --add-port=22/tcp

Question 5

A user reports being unable to log in because the password is locked. The administrator needs to unlock the account. Which command should be used?

Accepted Answer

passwd -u username. passwd -u unlocks a locked account. usermod -U also works. Among options, passwd -u is correct.

Answer

usermod -L username

Answer

passwd -l username

Answer

chage -E -1 username

Question 6

An administrator is troubleshooting an AppArmor profile that is blocking a custom application. They want to set the profile to complain mode to gather violations without enforcing. Which command should they use?

Accepted Answer

aa-complain /path/to/profile. aa-complain sets the profile to complain mode.

Answer

aa-status

Answer

apparmor_parser -r /etc/apparmor.d/profile

Answer

aa-enforce /path/to/profile

Question 7

A user named 'jdoe' needs to run commands as root without being given the root password. The administrator wants to grant jdoe the ability to run any command as root, but only after entering their own password. Which entry in /etc/sudoers accomplishes this?

Accepted Answer

jdoe ALL=(ALL) ALL. The format is 'user host=(runas) commands'. The correct entry grants jdoe full root access with password authentication.

Answer

jdoe ALL=(ALL) NOPASSWD: ALL

Answer

jdoe ALL=(root) /usr/bin/su

Answer

jdoe ALL= /bin/su -

Question 8

A web server running on port 8080 must be accessible from external networks. The system uses firewalld. Which command opens port 8080/tcp permanently in the default zone?

Accepted Answer

firewall-cmd --permanent --add-port=8080/tcp. The correct firewalld command is 'firewall-cmd --permanent --add-port=8080/tcp' followed by '--reload'.

Answer

firewall-cmd --zone=public --add-service=8080/tcp --permanent

Answer

iptables -A INPUT -p tcp --dport 8080 -j ACCEPT

Answer

firewall-cmd --add-port=8080/tcp

Question 9

A technician needs to ensure a service can listen on TCP port 8443 using firewalld. Which command permanently adds the port to the default zone?

Accepted Answer

firewall-cmd --add-port=8443/tcp --permanent. The correct syntax is firewall-cmd --add-port=8443/tcp --permanent. The other options either omit the protocol, use incorrect syntax, or forget --permanent.

Answer

firewall-cmd --add-port=8443 --permanent

Answer

firewall-cmd --add-port=8443/tcp

Answer

firewall-cmd --add-service=8443/tcp --permanent

Question 10

An administrator wants to harden SSH access by implementing the following: disallow root login, disable password authentication, and limit the number of authentication attempts. Which three configuration directives should be set in /etc/ssh/sshd_config? (Choose THREE.)

Accepted Answer

PermitRootLogin no. PermitRootLogin no, PasswordAuthentication no, and MaxAuthTries limit attempts.

Answer

Port 22

Answer

PermitEmptyPasswords no

Question 11

A Linux administrator needs to add a new user named 'jdoe' with a home directory and bash shell. Which command accomplishes this?

Accepted Answer

useradd -m -s /bin/bash jdoe. The useradd command creates a new user, and the -m flag creates the home directory, -s sets the shell. useradd -m -s /bin/bash jdoe is correct.

Answer

groupadd -u jdoe -s /bin/bash

Answer

adduser -h /home/jdoe -s bash jdoe

Answer

usermod -m -s /bin/bash jdoe

Question 12

An administrator notices that a custom application uses port 8443/TCP. To allow external access, which firewalld command permanently opens this port in the default zone?

Accepted Answer

firewall-cmd --add-port=8443/tcp --permanent. The correct command is firewall-cmd --permanent --add-port=8443/tcp. The --permanent flag makes it persistent, --add-port opens the port, and the syntax includes protocol. --add-service is for predefined services, not port numbers.

Answer

firewall-cmd --add-service=8443/tcp --zone=public --permanent

Answer

firewall-cmd --add-port=8443 --permanent

Answer

firewall-cmd --permanent --add-port=8443

Question 13

Which file contains the hashed passwords and password aging information for user accounts?

Accepted Answer

/etc/shadow. /etc/shadow stores password hashes and aging fields.

Answer

/etc/gshadow

Answer

/etc/group

Answer

/etc/passwd

Question 14

An administrator wants to allow user 'jane' to run all commands as root via sudo without a password. Which line should be added to /etc/sudoers?

Accepted Answer

jane ALL=(ALL) NOPASSWD: ALL. The format is 'username ALL=(ALL) NOPASSWD: ALL'. The other options either require a password, use incorrect syntax, or include unnecessary aliases.

Answer

jane ALL=NOPASSWD: ALL

Answer

jane ALL=(root) NOPASSWD: ALL

Answer

jane ALL=(ALL) ALL

Question 15

An administrator wants to ensure that only users in the 'wheel' group can use the sudo command. Which directive in /etc/sudoers enables this?

Accepted Answer

%wheel ALL=(ALL) ALL. %wheel ALL=(ALL) ALL grants sudo access to all members of the wheel group.

Answer

%wheel ALL=ALL

Answer

@wheel ALL=(ALL) ALL

Answer

wheel ALL=(ALL) ALL