XK0-005 Security Practice Test 6 — 15 Questions

Question 1

A Linux administrator is troubleshooting login issues. Users can log in using SSH but not through the local console or graphical display manager. The /etc/pam.d/system-auth file was recently modified. Which PAM module is likely misconfigured?

Accepted Answer

pam_securetty.so. The pam_securetty.so module restricts root login to terminals listed in /etc/securetty. If this file was misconfigured or the module is incorrectly set to 'required' for all users, local console and graphical display manager logins (which use virtual terminals like tty1) would be denied, while SSH (which uses pseudo-terminals like pts/0) would still succeed because pam_securetty.so typically does not apply to SSH sessions.

Answer

pam_limits.so

Answer

pam_deny.so

Answer

pam_unix.so

Question 2

An administrator is investigating a system that may have been compromised. The 'aide' database was created six months ago. After running 'aide --check', many files in /usr/bin are reported as changed. Which action should the administrator take first to identify the cause?

Accepted Answer

Compare the checksums with the original package manager database (rpm -V).. Option C is correct because the AIDE database is six months old, so any changes to system binaries in /usr/bin since then would be flagged. The first step should be to verify whether these changes are legitimate (e.g., from package updates) or malicious by comparing the current file checksums against the RPM package manager's database using 'rpm -V'. This distinguishes expected updates from unauthorized modifications without relying on the outdated AIDE baseline.

Answer

Increase the verbosity of AIDE to see which attributes changed.

Answer

Update the AIDE database with 'aide --update'.

Answer

Restore the original files from backup.

Question 3

A server running Ubuntu 22.04 has AppArmor enabled. After installing a new application, the application is denied access to certain files even though the permissions are correct. The administrator checks the AppArmor profile and finds it is in enforce mode. Which command can be used to temporarily set the profile to complain mode to generate log entries for needed accesses?

Accepted Answer

aa-complain /usr/bin/application. Option C, `aa-complain /usr/bin/application`, is correct because it sets the specified AppArmor profile to complain mode, which logs policy violations without blocking access. This allows the administrator to identify which accesses the application needs by reviewing the generated log entries, typically in `/var/log/syslog` or via `ausearch`, while the application continues to run.

Answer

systemctl restart apparmor

Answer

aa-enforce /usr/bin/application

Answer

apparmor_parser -r /etc/apparmor.d/usr.bin.application

Question 4

A Red Hat Enterprise Linux 8 system is configured with SELinux in enforcing mode. A custom application needs to write to a file in /var/log. The audit log shows an AVC denial for httpd_t attempting to write to var_log_t. Which of the following is the most appropriate persistent solution?

Accepted Answer

Use semanage fcontext to define the default context for the file and then restorecon.. Option D is correct because semanage fcontext defines a persistent default SELinux file context rule, which survives file system relabeling. After defining the rule, restorecon applies the context to the file. This ensures the custom application's log file is labeled httpd_log_t, allowing httpd_t to write to it, while chcon (option C) only makes a temporary change that can be overwritten by restorecon or a relabel.

Answer

Set the SELinux boolean httpd_can_network_connect to on.

Answer

Change the ownership of the file to apache.

Answer

Use chcon to set the file context to httpd_log_t.

Question 5

Which TWO of the following are best practices for securing the GRUB boot loader?

Accepted Answer

Encrypt the boot partition.. Setting a GRUB password (option C) prevents unauthorized users from editing boot parameters or booting into single-user mode, which could otherwise bypass system authentication. Encrypting the boot partition (option B) protects the integrity and confidentiality of the kernel and initramfs, ensuring that tampered or malicious code cannot be loaded during boot. Both measures are recommended in security baselines to enforce boot‑level access control.

Answer

Enable Secure Boot.

Answer

Set the boot timeout to 0.

Answer

Disable USB boot.

Question 6

Which THREE of the following actions can help prevent unauthorized access to a Linux server via SSH?

Accepted Answer

Allow only specific users with AllowUsers.. Option A is correct because the `AllowUsers` directive in `/etc/ssh/sshd_config` restricts SSH logins to only the specified user accounts, blocking all others even if they have valid credentials. This reduces the attack surface by explicitly whitelisting authorized users, making it an effective access control measure.

Answer

Set MaxAuthTries to 6.

Answer

Use protocol version 1.

Question 7

Which TWO tools are specifically designed to detect rootkits on a Linux system?

Accepted Answer

rkhunter. B is correct because rkhunter (Rootkit Hunter) is a Unix-based tool that scans for rootkits, backdoors, and possible local exploits by comparing file hashes, checking for hidden processes, and analyzing system binaries for known rootkit signatures. It is specifically designed to detect rootkits on Linux systems.

Answer

lsof

Answer

netstat

Answer

clamav

Question 8

Refer to the exhibit. After adding a firewall rule, the web server becomes unreachable from the internal network 192.168.1.0/24. Which line is the cause?

Accepted Answer

Line: -A INPUT -p tcp --dport 80 -j DROP. Option C is correct because the firewall rule `-A INPUT -p tcp --dport 80 -j DROP` explicitly drops all incoming TCP traffic destined for port 80, regardless of source. Since the web server listens on port 80, this rule blocks all HTTP requests, including those from the internal network 192.168.1.0/24. The rule is placed before any ACCEPT rule for the same port, so the DROP action takes precedence, making the server unreachable.

Answer

Default policy (INPUT ACCEPT)

Answer

Missing rule for RELATED traffic

Answer

Line: -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT

Question 9

Refer to the exhibit. A web application running under Apache cannot write to /var/log/app.log. The file has permissions 664 and is owned by apache. What is the correct action to allow writes while maintaining SELinux policies?

Accepted Answer

Change the SELinux context of the file to httpd_log_t.. The file /var/log/app.log has permissions 664 and is owned by apache, so the web server should be able to write to it. However, SELinux is blocking the write because the file's SELinux context does not match the type expected for files that Apache (httpd) is allowed to write to. Changing the SELinux context to httpd_log_t tells SELinux that this file is a log file that httpd can write to, which resolves the denial while keeping SELinux enforcing.

Answer

Change the ownership to root.

Answer

Set the httpd_can_network_connect boolean.

Answer

Disable SELinux for the httpd daemon.

Question 10

A company uses a Linux server running Ubuntu 22.04 LTS as a file server to share documents via Samba. The server has been in operation for over a year without issues. Following a routine system update that included kernel patches and updated Samba packages, users began reporting that they could no longer access any shared folders. The administrator verifies that the smbd and nmbd services are running and have not failed. The Samba configuration has not been changed recently. The server uses ufw as its firewall. When the administrator runs 'ufw status', the output shows that only SSH (port 22) is allowed. The administrator checks for SELinux but finds it is not installed; however, AppArmor is active and the smbd profile is in enforce mode. The administrator examines the AppArmor logs and finds no denials related to smbd. Which of the following is the most likely reason for the connectivity failure?

Accepted Answer

The firewall is blocking Samba ports 137, 138, 139, and 445.. The firewall (ufw) is only allowing SSH (port 22), which means Samba ports 137/138 (NetBIOS), 139 (SMB over NetBIOS), and 445 (SMB over TCP) are blocked. Since the smbd and nmbd services are running and AppArmor shows no denials, the most likely cause is that the firewall rules were reset or not updated after the system update, preventing Samba traffic from reaching the server.

Answer

The Samba configuration file was corrupted during the update.

Answer

The kernel update changed the default file system mount options, restricting access.

Answer

The AppArmor profile is preventing smbd from binding to network interfaces.

Question 11

A systems administrator notices that users can successfully authenticate via SSH using their password, but cannot log in via the console. The /etc/securetty file exists and contains only the default entries. Which configuration change is most likely to resolve the issue?

Accepted Answer

Add 'console' to the /etc/securetty file. The /etc/securetty file lists TTY devices from which root is allowed to log in via console or terminal. By default, it often includes entries like 'tty1' through 'tty6' but not 'console'. Adding 'console' to this file permits root login from the system console, resolving the issue where console authentication fails while SSH (which bypasses /etc/securetty) succeeds.

Answer

Add the denyhosts service to block non-console logins

Answer

Set PermitRootLogin yes in /etc/ssh/sshd_config

Answer

Set SELinux to permissive mode

Question 12

An administrator needs to ensure that /var/log/secure is only readable by members of the 'adm' group and is not accessible by any other user. Additionally, new files created in /var/log should inherit the group ownership 'adm'. Which set of commands achieves this?

Accepted Answer

chgrp adm /var/log; chmod g+s /var/log; setfacl -m g:adm:rx /var/log/secure. Option B correctly sets the group ownership of /var/log to 'adm' with `chgrp adm /var/log`, enables the setgid bit on the directory with `chmod g+s /var/log` so new files inherit the 'adm' group, and uses `setfacl -m g:adm:rx /var/log/secure` to grant only the 'adm' group read and execute access to the secure log file, while removing permissions for others via the default ACL mask.

Answer

setfacl -m u::rwx,g::rwx,o::--- /var/log/secure; chmod g+s /var/log

Answer

chown :adm /var/log/secure; chmod 640 /var/log/secure

Answer

usermod -aG adm $(whoami); chmod 640 /var/log/secure

Question 13

A security team wants to implement mandatory access control (MAC) on a Linux server to confine a potentially vulnerable daemon. Which TWO of the following technologies can be used for this purpose?

Accepted Answer

AppArmor. AppArmor is a Linux Security Module (LSM) that implements mandatory access control (MAC) by confining programs to a set of listed files and capabilities defined in profiles. It operates on a path-based model, allowing the security team to restrict the daemon's access to only necessary resources, effectively containing a potential vulnerability.

Answer

sudo

Answer

TCP wrappers

Answer

iptables

Question 14

An administrator needs to restrict SSH access to the server so that only a specific IP range (192.168.1.0/24) can connect, and password authentication is disabled. Which THREE steps must be taken?

Accepted Answer

Add a firewall rule: iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP. Option B is correct because it uses iptables to create a firewall rule that accepts SSH traffic (TCP port 22) only from the 192.168.1.0/24 subnet, followed by a catch-all rule that drops all other SSH traffic. This enforces network-level access control. Option D is correct because 'AllowUsers *@192.168.1.*' in sshd_config restricts SSH logins to users connecting from IP addresses matching that pattern, providing application-level filtering. Option E is correct because 'PasswordAuthentication no' disables password-based authentication, forcing the use of key-based or other non-password methods.

Answer

Set 'UsePAM yes' in sshd_config

Answer

Set 'PermitRootLogin without-password' in sshd_config

Question 15

A company's web server running Apache on CentOS 7 has been compromised. The attacker exploited a vulnerability in the web application and gained access to the system as the 'apache' user. The administrator wants to prevent similar attacks in the future by hardening the server. Currently, the Apache process runs as the 'apache' user and can execute arbitrary code. The administrator considers enabling SELinux with targeted policy to confine the httpd daemon. However, after setting SELinux to enforcing and installing the 'httpd' SELinux package, the web server fails to serve pages over HTTPS. The administrator checks the audit log (/var/log/audit/audit.log) and sees denials related to port binding. What is the most likely cause of the issue?

Accepted Answer

The port 443 is not labeled with the http_port_t type; use semanage port -a -t http_port_t -p tcp 443. The issue is that SELinux is blocking Apache from binding to port 443 because that port is not labeled with the http_port_t type. By default, SELinux only allows httpd to bind to ports that have the http_port_t context (e.g., 80, 443, 8080). If port 443 lacks this label, the httpd process will be denied permission to bind, even though the firewall may allow it. The administrator must use `semanage port -a -t http_port_t -p tcp 443` to assign the correct SELinux port type.

Answer

The SSL certificate files have incorrect SELinux context (e.g., httpd_sys_content_t instead of cert_t)

Answer

The httpd binary must have the httpd_exec_t context

Answer

The boolean httpd_enable_homedirs must be enabled to allow HTTPS