XK0-005 Security Practice Test 3 — 15 Questions

Question 1

An Apache web server (httpd) is serving content from a custom directory /webapps/company. The root directory is labeled with the default_t context, causing httpd to be denied access. Which command should the administrator use to persistently relabel the directory for httpd access?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t '/webapps/company(/.*)?'. Option D is correct because `semanage fcontext` modifies the SELinux file context policy persistently, and the regex `/webapps/company(/.*)?` ensures the rule applies to the directory and all its contents. This is necessary because `restorecon` (option A) only applies the default context from the policy, which is `default_t` for this custom path, and `chcon` (option B) is non-persistent and will be overwritten by a file system relabel. The `setsebool` (option C) controls a boolean for user content, not the file context of a custom directory.

Answer

restorecon -v /webapps/company

Answer

chcon -t httpd_sys_content_t /webapps/company

Answer

setsebool -P httpd_read_user_content on

Question 2

The company password policy requires minimum length, complexity, and that passwords cannot be based on dictionary words. Which file should be edited to configure these settings via pam_pwquality?

Accepted Answer

/etc/security/pwquality.conf. The pam_pwquality module enforces password quality rules such as minimum length, complexity, and dictionary checks. Its configuration file is /etc/security/pwquality.conf, where parameters like minlen, dcredit, ucredit, lcredit, ocredit, and dictcheck are set. Editing this file directly controls the PAM module's behavior without modifying PAM service files.

Answer

/etc/login.defs

Answer

/etc/pam.d/system-auth

Answer

/etc/pam.d/password-auth

Question 3

A security engineer needs to verify the authenticity of a downloaded file using its detached GPG signature (file.sig). Which command should be used?

Accepted Answer

gpg --verify file.sig. The `gpg --verify file.sig` command is used to verify the authenticity of a file using its detached GPG signature. The detached signature file (file.sig) contains the cryptographic signature, and GPG checks it against the original file (which must be present in the same directory with the same base name) using the signer's public key from the local keyring. This confirms that the file was signed by the holder of the corresponding private key and has not been tampered with.

Answer

gpg --sign file

Answer

gpg --list-keys

Answer

gpg --decrypt file.gpg

Question 4

An application running under an AppArmor profile is being denied access to log files. The administrator wants to troubleshoot by allowing all actions and logging denials. Which command will switch the profile to complain mode?

Accepted Answer

aa-complain /path/to/profile. The `aa-complain` command places an AppArmor profile into complain mode, which allows all actions but logs denials to the system log. This is the correct tool for troubleshooting because it lets the administrator see what the application is trying to do without actually blocking it.

Answer

aa-enforce /path/to/profile

Answer

aa-disable /path/to/profile

Answer

aa-status

Question 5

Which TWO commands can be used to change the group ownership of a file? (Choose exactly two.)

Accepted Answer

chgrp. The `chgrp` command is specifically designed to change the group ownership of a file or directory. The `chown` command can also change group ownership when used with the colon syntax (e.g., `chown :groupname file`). Both commands modify the file's group ID (GID) in the inode metadata.

Answer

chmod

Answer

groupmod

Answer

usermod

Question 6

Which THREE are best practices for securing a Linux server? (Choose exactly three.)

Accepted Answer

Use a host-based firewall. A host-based firewall (e.g., iptables, nftables, or firewalld) controls incoming and outgoing traffic at the server level, enforcing least-privilege network access. By default, it can block all traffic except explicitly allowed services (e.g., SSH on port 22, HTTPS on port 443), reducing the attack surface. This is a fundamental security control to prevent unauthorized network connections.

Answer

Enable root SSH login with password

Answer

Set default umask to 0777

Question 7

Which TWO commands are used to manage SSH key-based authentication processes? (Choose exactly two.)

Accepted Answer

ssh-keygen. The `ssh-keygen` command generates the public and private key pair used for SSH key-based authentication, while `ssh-copy-id` installs the public key on a remote server's `~/.ssh/authorized_keys` file, enabling passwordless login. Together, they form the core workflow for setting up SSH key authentication.

Answer

ssh-add

Answer

ssh-keyscan

Answer

ssh-agent

Question 8

A user on a workstation with IP 192.168.1.100 reports being unable to SSH to the server with IP 10.0.0.5. Based on the exhibit, what is the most likely cause?

Accepted Answer

The SSH rule only accepts connections from the 10.0.0.0/8 subnet.. The exhibit shows an iptables ruleset where the SSH rule (port 22) explicitly matches the source address 10.0.0.0/8. The workstation has IP 192.168.1.100, which does not fall within the 10.0.0.0/8 range, so the SSH rule will not match. Since no other rule allows SSH, the packet will be evaluated against the default INPUT policy, which is ACCEPT (not shown as DROP), but the SSH rule itself restricts the source, making it unreachable for this client.

Answer

The default INPUT policy is DROP and there is no SSH rule.

Answer

The SSH rule appears after a LOG rule, causing it to be unreachable.

Answer

The SSH port is not allowed in any rule.

Question 9

A security audit reveals a misconfiguration. Which file has insecure permissions that could allow unauthorized users to read password hashes?

Accepted Answer

/etc/shadow. The /etc/shadow file stores password hashes and should be readable only by the root user (typically permissions 640 or 600). If its permissions are too permissive (e.g., world-readable), any local user could read the hashes and attempt offline cracking. This is the misconfiguration the audit would flag.

Answer

Both files are misconfigured

Answer

Neither file has a misconfiguration

Answer

/etc/passwd

Question 10

Based on the exhibit, what is the purpose of the audit rule?

Accepted Answer

Monitor all open syscalls by users with UID 1000 or higher.. The audit rule `-a always,exit -F arch=b64 -S open -F uid>=1000 -k monitor_open` uses the `uid>=1000` filter to match only system calls made by users with UID 1000 or higher. This is a common Linux auditd rule to track user-level activity while excluding system accounts (typically UIDs below 1000). Option C correctly identifies that the rule monitors all open syscalls by users with UID 1000 or higher.

Answer

Monitor open syscalls on a specific file.

Answer

Monitor all open syscalls by the root user.

Answer

Monitor all open syscalls except those by users with UID 1000 or higher.

Question 11

A system administrator needs to ensure that only specific users can execute the 'sudo' command. Which configuration file should be modified?

Accepted Answer

/etc/sudoers. The /etc/sudoers file controls which users and groups can execute commands with elevated privileges via the sudo utility. It uses a specific syntax to define user privileges, such as 'username ALL=(ALL) ALL', and must be edited with the visudo command to prevent syntax errors that could lock out administrative access. Modifying this file is the standard method for granting or restricting sudo access on Linux systems.

Answer

/etc/shadow

Answer

/etc/passwd

Answer

/etc/group

Question 12

Which tool is used for encrypting files with public-key cryptography on Linux systems?

Accepted Answer

GnuPG. GnuPG (GNU Privacy Guard) is the correct tool because it implements the OpenPGP standard (RFC 4880) for encrypting and signing files using public-key cryptography. It allows users to generate a key pair, encrypt a file with the recipient's public key, and decrypt it with the corresponding private key, making it the standard Linux utility for asymmetric file encryption.

Answer

bcrypt

Answer

LUKS

Answer

OpenSSL

Question 13

Which command can be used to display the current user's effective user ID and group memberships?

Accepted Answer

id. The `id` command displays the current user's real and effective user ID (UID), group ID (GID), and supplementary group memberships. It provides a comprehensive view of identity and group associations, which is essential for understanding access rights in Linux security contexts.

Answer

who

Answer

groups

Answer

whoami

Question 14

A security policy requires that user passwords must expire every 90 days. Which command can enforce this policy for user 'jsmith'?

Accepted Answer

chage -M 90 jsmith. The `chage -M 90 jsmith` command sets the maximum number of days a password is valid for user 'jsmith' to 90, which enforces the 90-day expiration policy. The `-M` option directly modifies the `PASS_MAX_DAYS` field in `/etc/shadow`, and `chage` is the standard tool for managing password aging on Linux systems.

Answer

usermod -e 90 jsmith

Answer

passwd -x 90 jsmith

Answer

chfn -f 90 jsmith

Question 15

An administrator needs to ensure that the SSH service only allows key-based authentication and disables password authentication. Which configuration file and directive should be modified?

Accepted Answer

/etc/ssh/sshd_config; PasswordAuthentication no. Option D is correct because the SSH server configuration file is /etc/ssh/sshd_config, and setting 'PasswordAuthentication no' disables password-based logins, forcing key-based authentication. This directive must be set on the server side (sshd_config), not the client side (ssh_config), to enforce the policy for all incoming SSH connections.

Answer

/etc/ssh/sshd_config; PasswordAuthentication yes

Answer

/etc/ssh/sshd_config; PubkeyAuthentication no

Answer

/etc/ssh/ssh_config; PasswordAuthentication no