XK0-005 Security — Timed 15 Questions

Question 1

A system administrator notices that an unauthorized user gained access to a server via SSH using a compromised user account. Which security measure should be implemented to prevent such attacks in the future?

Accepted Answer

Configure SSH to use key-based authentication only. Option A is correct because configuring SSH to use key-based authentication only eliminates the risk of password-based attacks, such as brute-force or credential theft. Since the compromised user account was accessed via SSH using a password, disabling password authentication and requiring a private key ensures that an attacker cannot log in even if they obtain the user's password hash. This aligns with the principle of least privilege and strong authentication, as SSH keys are cryptographically bound to the client and are not transmitted over the network.

Answer

Disable SSH and use Telnet

Answer

Enforce a complex password policy

Answer

Allow all users to use sudo without passwords

Question 2

A Linux administrator needs to ensure that only the root user can run commands in the /usr/local/bin/scripts directory. Which command should be used to set the appropriate permissions?

Accepted Answer

chmod 700 /usr/local/bin/scripts. The requirement is that only the root user can run commands in the directory. Permission 700 (owner: rwx, group: ---, others: ---) grants full access exclusively to the owner (root), while denying all access to the group and others. This matches the requirement precisely.

Answer

chmod 750 /usr/local/bin/scripts

Answer

chmod 755 /usr/local/bin/scripts

Answer

chmod 770 /usr/local/bin/scripts

Question 3

A security audit reveals that the /etc/shadow file has permissions 777. Which command should be used to correct this vulnerability?

Accepted Answer

chmod 600 /etc/shadow. The /etc/shadow file stores hashed user passwords and must be readable only by root to prevent unauthorized access. Permissions 777 allow any user to read, write, and execute the file, which is a critical security vulnerability. The correct command is `chmod 600 /etc/shadow`, which sets read and write permissions for the owner (root) only, denying all access to group and others.

Answer

chmod 660 /etc/shadow

Answer

chmod 644 /etc/shadow

Answer

chmod 640 /etc/shadow

Question 4

A Linux server is configured to allow SSH access for remote administration. The security team wants to limit SSH access to only users in the 'ssh-users' group. Which configuration should be added to /etc/ssh/sshd_config?

Accepted Answer

AllowGroups ssh-users. Option B is correct because the AllowGroups directive in /etc/ssh/sshd_config restricts SSH logins to only those users who are members of the specified group. By setting 'AllowGroups ssh-users', only users belonging to the 'ssh-users' group will be permitted to authenticate via SSH, directly fulfilling the security team's requirement.

Answer

AllowUsers ssh-users

Answer

DenyUsers root

Answer

PermitRootLogin yes

Question 5

A Linux administrator is configuring a firewall using iptables to allow incoming HTTP and HTTPS traffic but block all other incoming traffic. Which set of rules should be applied?

Accepted Answer

iptables -P INPUT DROP; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT. Option C is correct because it sets the default policy for the INPUT chain to DROP, which blocks all incoming traffic by default, and then explicitly adds rules to ACCEPT TCP traffic on ports 80 (HTTP) and 443 (HTTPS). This implements a whitelist approach: only the specified services are allowed, and all other incoming packets are dropped by the default policy. The order is critical — the ACCEPT rules must be evaluated before the default DROP policy takes effect for unmatched traffic.

Answer

iptables -P INPUT DROP; iptables -A INPUT -p tcp -j ACCEPT

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -j DROP

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Question 6

A Linux administrator is hardening a server. Which TWO actions are effective in preventing unauthorized access via SSH? (Select TWO.)

Accepted Answer

Set PermitRootLogin no in /etc/ssh/sshd_config. Option D is correct because setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents direct root login via SSH, forcing administrators to log in as a regular user and then use `su` or `sudo` for privilege escalation. This reduces the attack surface by eliminating the ability to brute-force the root password directly over SSH.

Answer

Set PermitRootLogin yes

Answer

Set PasswordAuthentication yes

Answer

Disable the SSH service

Question 7

A security audit identified that the /tmp directory is world-writable. Which THREE steps should be taken to secure /tmp on a Linux system? (Select THREE.)

Accepted Answer

Set the sticky bit on /tmp. Option A is correct because setting the sticky bit on /tmp prevents users from deleting or renaming files owned by other users, even though the directory is world-writable. This is a standard security hardening measure for shared temporary directories.

Answer

Remove world-writable permission from /tmp

Answer

Mount /tmp with the exec option

Question 8

Refer to the exhibit. The system administrator runs the command 'auditctl -l' and sees the above rules. What is the purpose of these audit rules?

Accepted Answer

To log any changes (write or attribute) to the password, shadow, and group files. The audit rules use the `-w` flag to watch the files `/etc/passwd`, `/etc/shadow`, and `/etc/group` for `wa` (write and attribute change) syscalls. This logs any modification to these critical authentication and authorization files, such as user additions, password changes, or permission changes, which is essential for security monitoring.

Answer

To log all successful login attempts on the system

Answer

To log any modifications to the audit configuration itself

Answer

To log all read accesses to /etc/passwd, /etc/shadow, and /etc/group

Question 9

Refer to the exhibit. Alice is the owner of file.txt. Bob is a member of the staff group. What permissions does Bob have on file.txt?

Accepted Answer

Read only. Bob is a member of the staff group, and the file.txt permissions are shown as -rw-r-----. The group permissions are r--, meaning members of the staff group (including Bob) have read-only access. The owner (Alice) has read and write, but group permissions do not include write, so Bob cannot modify the file.

Answer

Read and write

Answer

No access

Answer

Write only

Question 10

A system administrator needs to restrict SSH access to a Linux server to only users in the 'sshusers' group. Which configuration change achieves this?

Accepted Answer

Add 'AllowGroups sshusers' to /etc/ssh/sshd_config. Option C is correct because the 'AllowGroups' directive in /etc/ssh/sshd_config restricts SSH access to only users who are members of the specified group. When set to 'AllowGroups sshusers', only users belonging to the 'sshusers' group will be permitted to log in via SSH, effectively blocking all others. This is the standard method for group-based access control in OpenSSH.

Answer

Add 'DenyUsers *' to /etc/ssh/sshd_config

Answer

Set 'PermitRootLogin no' in /etc/ssh/sshd_config

Answer

Add 'AllowUsers sshusers' to /etc/ssh/sshd_config

Question 11

A security audit reveals that the /var/log directory has permissions 777. The administrator needs to ensure that only root can write to log files, while still allowing users to read system log files. Which command should the administrator run?

Accepted Answer

chmod 755 /var/log. Option B is correct because chmod 755 sets the /var/log directory to rwxr-xr-x, meaning root (owner) has full write access, while group and others have read and execute permissions. This allows users to read log files (via execute to traverse the directory) but prevents them from writing, satisfying the audit requirement.

Answer

chmod 644 /var/log

Answer

chmod 700 /var/log

Answer

chmod 750 /var/log

Question 12

A company's security policy requires that all user passwords must expire every 90 days. The administrator runs 'chage -M 90 jdoe' for user jdoe. Which additional step ensures that the password expiration policy is enforced for all new users?

Accepted Answer

Set PASS_MAX_DAYS 90 in /etc/login.defs. Option A is correct because /etc/login.defs contains default values used by useradd and other tools when creating new users. Setting PASS_MAX_DAYS 90 in this file ensures that every new user account created will automatically have a 90-day password expiration, enforcing the policy globally without manual intervention.

Answer

Add 'password required pam_unix.so remember=5' to /etc/pam.d/system-auth

Answer

Set EXPIRE=90 in /etc/default/useradd

Answer

Modify /etc/shadow to set max days for each user

Question 13

A Linux administrator discovers that a user's home directory contains a file with setuid bit set, owned by root. The file is not part of any authorized software. What is the most appropriate immediate action?

Accepted Answer

Remove the setuid bit with 'chmod u-s <file>'. Option D is correct because the immediate priority is to neutralize the unauthorized setuid root binary, which poses a privilege escalation risk. Removing the setuid bit with 'chmod u-s' disables the ability for any user to execute the file with root privileges, containing the threat without destroying evidence that may be needed for forensic analysis. This aligns with security best practices of preserving artifacts while mitigating active risks.

Answer

Move the file to /tmp for further analysis

Answer

Delete the file immediately to remove the threat

Answer

Change the file owner to the user with 'chown user:user <file>'

Question 14

Which TWO of the following are valid methods to enforce disk quota limits on a Linux filesystem? (Select TWO.)

Accepted Answer

Using 'edquota' to set soft and hard limits for users. Option A is correct because 'edquota' is the standard interactive command used to set soft and hard disk quota limits for users or groups on a Linux filesystem. It opens the user's quota settings in a text editor, allowing precise configuration of block and inode limits. Option E is correct because 'quotaon' is the command that enables quota enforcement on a specified filesystem, activating the quota subsystem after limits have been defined.

Answer

Using 'setquota' to set limits in a script

Answer

Running 'repquota' to generate reports

Answer

Running 'quotacheck' to update quota files

Question 15

Scenario: A financial services company runs a critical application on a Linux server that stores sensitive customer data. The server is configured with a firewall (iptables) that only allows SSH (port 22) and HTTPS (port 443) from the internal network (10.0.0.0/8). Recently, the security team detected unauthorized access attempts from an external IP address (203.0.113.5) targeting port 22. The administrator needs to block this specific IP while maintaining current access rules. The existing iptables rules are: 
- INPUT chain policy ACCEPT 
- Rule 1: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 
- Rule 2: -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT 
- Rule 3: -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT 
- Rule 4: -A INPUT -j DROP 
The administrator wants to block 203.0.113.5 from any access. Which command should be added?

Accepted Answer

iptables -I INPUT 1 -s 203.0.113.5 -j DROP. Option A is correct because inserting the DROP rule at position 1 with `-I INPUT 1` ensures it is evaluated before the existing ESTABLISHED,RELATED rule (Rule 1). Since iptables processes rules sequentially, placing the block early prevents the malicious IP from being matched by the ESTABLISHED,RELATED rule, which would otherwise accept its packets if a related connection existed. This maintains the existing SSH and HTTPS access rules for the internal network while explicitly dropping all traffic from 203.0.113.5.

Answer

iptables -I INPUT 5 -s 203.0.113.5 -j DROP

Answer

iptables -A INPUT -s 203.0.113.5 -j DROP

Answer

iptables -I INPUT 1 -s 203.0.113.5 -j ACCEPT