XK0-005 Practice Test 28 — 15 Questions

Question 1

Based on the exhibit, what is the purpose of the audit rule?

Accepted Answer

Monitor all open syscalls by users with UID 1000 or higher.. The audit rule `-a always,exit -F arch=b64 -S open -F uid>=1000 -k monitor_open` uses the `uid>=1000` filter to match only system calls made by users with UID 1000 or higher. This is a common Linux auditd rule to track user-level activity while excluding system accounts (typically UIDs below 1000). Option C correctly identifies that the rule monitors all open syscalls by users with UID 1000 or higher.

Answer

Monitor open syscalls on a specific file.

Answer

Monitor all open syscalls by the root user.

Answer

Monitor all open syscalls except those by users with UID 1000 or higher.

Question 2

A system administrator wants to restrict SSH access to a specific group of users. Which two methods can achieve this? (Select TWO.)

Accepted Answer

Edit /etc/ssh/sshd_config and set AllowGroups engineers. Option B is correct because the `AllowGroups` directive in `/etc/ssh/sshd_config` explicitly restricts SSH access to members of specified groups. When set to `AllowGroups engineers`, only users belonging to the 'engineers' group can authenticate via SSH, providing a straightforward and secure method for group-based access control.

Answer

Use /etc/security/access.conf

Answer

Modify /etc/pam.d/sshd to use pam_listfile.so

Answer

Add users to the sshd group

Question 3

An administrator needs to ensure that the SSH service only allows key-based authentication and disables password authentication. Which configuration file and directive should be modified?

Accepted Answer

/etc/ssh/sshd_config; PasswordAuthentication no. Option D is correct because the SSH server configuration file is /etc/ssh/sshd_config, and setting 'PasswordAuthentication no' disables password-based logins, forcing key-based authentication. This directive must be set on the server side (sshd_config), not the client side (ssh_config), to enforce the policy for all incoming SSH connections.

Answer

/etc/ssh/sshd_config; PasswordAuthentication yes

Answer

/etc/ssh/sshd_config; PubkeyAuthentication no

Answer

/etc/ssh/ssh_config; PasswordAuthentication no

Question 4

A security policy requires that user passwords must expire after 90 days. The output in the exhibit shows the current configuration for the root user. Which command should the administrator run to enforce the policy for root?

Accepted Answer

sudo chage -M 90 root. The `chage -M 90 root` command sets the maximum number of days a password is valid for the root user to 90 days, which directly enforces the password expiration policy. The `-M` option modifies the `max_days` field in `/etc/shadow`, causing the password to expire after the specified period. This is the correct method to apply aging rules to the root account.

Answer

sudo passwd -x 90 root

Answer

sudo chage -E 90 root

Answer

sudo usermod -e 90 root

Question 5

An administrator wants to restrict SSH access to only users in the 'sshusers' group. Which configuration should be added to /etc/ssh/sshd_config?

Accepted Answer

AllowGroups sshusers. Option C is correct because the `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH login to users who are members of the specified group. By setting `AllowGroups sshusers`, only users belonging to the 'sshusers' group will be permitted to authenticate via SSH, while all others are denied. This matches the administrator's requirement precisely.

Answer

AllowUsers sshusers

Answer

DenyUsers sshusers

Answer

PermitRootLogin no

Question 6

A security audit identifies that the system's /etc/passwd file is world-readable. Which three security issues does this pose? (Select THREE.)

Accepted Answer

Attackers can obtain usernames easily.. Option B is correct because the /etc/passwd file contains a list of all system usernames. Since the file is world-readable, any user or attacker can easily read this file to enumerate valid usernames, which is a common first step in password guessing or brute-force attacks. Usernames are stored in the first colon-delimited field of each line, making them trivially extractable.

Answer

Attackers can read the encrypted passwords.

Answer

Attackers can read password hashes.

Question 7

A security policy requires that user passwords must expire every 60 days and users should be warned 7 days before expiration. Which two commands can be used to set these policies? (Select TWO).

Accepted Answer

passwd -x 60 -w 7 username. Option A is correct because the `passwd -x 60 -w 7 username` command sets the maximum password age to 60 days (`-x`) and the warning period to 7 days before expiration (`-w`). This directly satisfies the policy requirements for password expiration and advance warning.

Answer

chage -E 60 -W 7 username

Answer

usermod -e 60 -f 7 username

Answer

passwd -n 60 -m 7 username

Question 8

A Linux administrator needs to configure a firewall to allow incoming SSH connections only from the 192.168.1.0/24 subnet. The current iptables INPUT policy is ACCEPT. Which set of rules should be added?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP. Option B is correct because iptables processes rules in order, and the first matching rule determines the action. By placing the ACCEPT rule for the 192.168.1.0/24 subnet first, SSH traffic from that subnet is accepted. The subsequent DROP rule for port 22 then denies all other SSH traffic. This ensures that only the specified subnet can connect, while the default ACCEPT policy on the INPUT chain would otherwise allow all traffic if no rule matched.

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j DROP

Answer

iptables -I INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Question 9

A server is secured with SELinux in enforcing mode. A custom web application needs to write logs to /var/log/webapp. The SELinux type for httpd is httpd_t. Which command sets the correct context for the log directory?

Accepted Answer

semanage fcontext -a -t httpd_log_t "/var/log/webapp(/.*)?" && restorecon -Rv /var/log/webapp. Option A is correct because it uses `semanage fcontext` to add a persistent file context rule that assigns the `httpd_log_t` type to the `/var/log/webapp` directory and its contents, then applies it with `restorecon`. The `httpd_log_t` type is specifically designed for log files written by the httpd process, allowing Apache (running as `httpd_t`) to write logs while maintaining SELinux enforcement.

Answer

chcon -t httpd_sys_content_t /var/log/webapp

Answer

setsebool -P httpd_enable_homedirs on

Answer

chcon -t httpd_t /var/log/webapp

Question 10

An administrator notices that new SSH sessions fail for all users. Which line in the exhibit is most likely causing the failure?

Accepted Answer

account required pam_nologin.so. The line 'account required pam_nologin.so' causes new SSH sessions to fail because the pam_nologin module checks for the existence of /etc/nologin. If that file exists, it denies login to all non-root users. This is commonly used during maintenance to prevent new logins, and since the question states 'all users' (including root if root is not explicitly exempted), this PAM module is the direct cause of the failure.

Answer

session include password-auth

Answer

auth required pam_sepermit.so

Answer

session required pam_loginuid.so

Question 11

A technician notices that a user can execute a binary with elevated privileges even though the user is not in the sudoers file. The binary has the SUID bit set. Which command would remove the SUID bit from the binary?

Accepted Answer

chmod 0755 /path/to/binary. Option D is correct because `chmod 0755` sets the binary's permissions to read/write/execute for the owner, and read/execute for group and others, which explicitly clears the SUID bit (setuid) by not including the 4000 octal value. The SUID bit allows a binary to run with the privileges of its owner (often root), bypassing normal user permissions. Removing it with a numeric mode like 0755 is a definitive way to ensure the SUID bit is unset, addressing the security issue where a non-sudo user can execute the binary with elevated privileges.

Answer

chmod u-s /path/to/binary

Answer

chmod g-s /path/to/binary

Answer

chmod o-s /path/to/binary

Question 12

An administrator is investigating a system that may have been compromised. The 'aide' database was created six months ago. After running 'aide --check', many files in /usr/bin are reported as changed. Which action should the administrator take first to identify the cause?

Accepted Answer

Compare the checksums with the original package manager database (rpm -V).. Option C is correct because the AIDE database is six months old, so any changes to system binaries in /usr/bin since then would be flagged. The first step should be to verify whether these changes are legitimate (e.g., from package updates) or malicious by comparing the current file checksums against the RPM package manager's database using 'rpm -V'. This distinguishes expected updates from unauthorized modifications without relying on the outdated AIDE baseline.

Answer

Increase the verbosity of AIDE to see which attributes changed.

Answer

Update the AIDE database with 'aide --update'.

Answer

Restore the original files from backup.

Question 13

An administrator is configuring a chroot jail for an SFTP user. Which directive in /etc/ssh/sshd_config is used for this purpose?

Accepted Answer

ChrootDirectory /home/%u. The ChrootDirectory directive in /etc/ssh/sshd_config specifies the path to the directory that will be used as a chroot jail for the user. When set to /home/%u, %u is replaced by the username, confining the SFTP user to their home directory. This is the standard way to restrict an SFTP user's file system access to a specific directory tree.

Answer

Subsystem sftp internal-sftp

Answer

ForceCommand internal-sftp

Answer

Match Group sftpusers

Question 14

After a security audit, it is recommended to disable SSH password authentication in favor of key-based authentication. Which configuration line should be set in /etc/ssh/sshd_config?

Accepted Answer

PasswordAuthentication no. Option C is correct because disabling password authentication forces SSH to use key-based authentication, which is more secure against brute-force attacks. Setting `PasswordAuthentication no` in `/etc/ssh/sshd_config` prevents SSH from prompting for a password, requiring a valid SSH key pair for authentication. This aligns with the security audit's recommendation to disable password authentication in favor of key-based authentication.

Answer

PasswordAuthentication yes

Answer

PubkeyAuthentication no

Answer

ChallengeResponseAuthentication yes

Question 15

Which THREE of the following actions can help prevent unauthorized access to a Linux server via SSH?

Accepted Answer

Allow only specific users with AllowUsers.. Option A is correct because the `AllowUsers` directive in `/etc/ssh/sshd_config` restricts SSH logins to only the specified user accounts, blocking all others even if they have valid credentials. This reduces the attack surface by explicitly whitelisting authorized users, making it an effective access control measure.

Answer

Set MaxAuthTries to 6.

Answer

Use protocol version 1.

XK0-005 Practice Test 28 — 15 Questions

Exhibit

XK0-005 Practice Test 28 — 15 Questions

Exhibit