XK0-005 Security — Timed 20 Questions

Question 1

A system administrator notices that an unauthorized user gained access to a server via SSH using a compromised user account. Which security measure should be implemented to prevent such attacks in the future?

Accepted Answer

Configure SSH to use key-based authentication only. Option A is correct because configuring SSH to use key-based authentication only eliminates the risk of password-based attacks, such as brute-force or credential theft. Since the compromised user account was accessed via SSH using a password, disabling password authentication and requiring a private key ensures that an attacker cannot log in even if they obtain the user's password hash. This aligns with the principle of least privilege and strong authentication, as SSH keys are cryptographically bound to the client and are not transmitted over the network.

Answer

Disable SSH and use Telnet

Answer

Enforce a complex password policy

Answer

Allow all users to use sudo without passwords

Question 2

A Linux administrator needs to ensure that only the root user can run commands in the /usr/local/bin/scripts directory. Which command should be used to set the appropriate permissions?

Accepted Answer

chmod 700 /usr/local/bin/scripts. The requirement is that only the root user can run commands in the directory. Permission 700 (owner: rwx, group: ---, others: ---) grants full access exclusively to the owner (root), while denying all access to the group and others. This matches the requirement precisely.

Answer

chmod 750 /usr/local/bin/scripts

Answer

chmod 755 /usr/local/bin/scripts

Answer

chmod 770 /usr/local/bin/scripts

Question 3

A security audit reveals that the /etc/shadow file has permissions 777. Which command should be used to correct this vulnerability?

Accepted Answer

chmod 600 /etc/shadow. The /etc/shadow file stores hashed user passwords and must be readable only by root to prevent unauthorized access. Permissions 777 allow any user to read, write, and execute the file, which is a critical security vulnerability. The correct command is `chmod 600 /etc/shadow`, which sets read and write permissions for the owner (root) only, denying all access to group and others.

Answer

chmod 660 /etc/shadow

Answer

chmod 644 /etc/shadow

Answer

chmod 640 /etc/shadow

Question 4

A Linux server is configured to allow SSH access for remote administration. The security team wants to limit SSH access to only users in the 'ssh-users' group. Which configuration should be added to /etc/ssh/sshd_config?

Accepted Answer

AllowGroups ssh-users. Option B is correct because the AllowGroups directive in /etc/ssh/sshd_config restricts SSH logins to only those users who are members of the specified group. By setting 'AllowGroups ssh-users', only users belonging to the 'ssh-users' group will be permitted to authenticate via SSH, directly fulfilling the security team's requirement.

Answer

AllowUsers ssh-users

Answer

DenyUsers root

Answer

PermitRootLogin yes

Question 5

A Linux administrator is configuring a firewall using iptables to allow incoming HTTP and HTTPS traffic but block all other incoming traffic. Which set of rules should be applied?

Accepted Answer

iptables -P INPUT DROP; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT. Option C is correct because it sets the default policy for the INPUT chain to DROP, which blocks all incoming traffic by default, and then explicitly adds rules to ACCEPT TCP traffic on ports 80 (HTTP) and 443 (HTTPS). This implements a whitelist approach: only the specified services are allowed, and all other incoming packets are dropped by the default policy. The order is critical — the ACCEPT rules must be evaluated before the default DROP policy takes effect for unmatched traffic.

Answer

iptables -P INPUT DROP; iptables -A INPUT -p tcp -j ACCEPT

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -j DROP

Answer

iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Question 6

A Linux administrator is hardening a server. Which TWO actions are effective in preventing unauthorized access via SSH? (Select TWO.)

Accepted Answer

Set PermitRootLogin no in /etc/ssh/sshd_config. Option D is correct because setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents direct root login via SSH, forcing administrators to log in as a regular user and then use `su` or `sudo` for privilege escalation. This reduces the attack surface by eliminating the ability to brute-force the root password directly over SSH.

Answer

Set PermitRootLogin yes

Answer

Set PasswordAuthentication yes

Answer

Disable the SSH service

Question 7

A security audit identified that the /tmp directory is world-writable. Which THREE steps should be taken to secure /tmp on a Linux system? (Select THREE.)

Accepted Answer

Set the sticky bit on /tmp. Option A is correct because setting the sticky bit on /tmp prevents users from deleting or renaming files owned by other users, even though the directory is world-writable. This is a standard security hardening measure for shared temporary directories.

Answer

Remove world-writable permission from /tmp

Answer

Mount /tmp with the exec option

Question 8

Refer to the exhibit. The system administrator runs the command 'auditctl -l' and sees the above rules. What is the purpose of these audit rules?

Accepted Answer

To log any changes (write or attribute) to the password, shadow, and group files. The audit rules use the `-w` flag to watch the files `/etc/passwd`, `/etc/shadow`, and `/etc/group` for `wa` (write and attribute change) syscalls. This logs any modification to these critical authentication and authorization files, such as user additions, password changes, or permission changes, which is essential for security monitoring.

Answer

To log all successful login attempts on the system

Answer

To log any modifications to the audit configuration itself

Answer

To log all read accesses to /etc/passwd, /etc/shadow, and /etc/group

Question 9

Refer to the exhibit. Alice is the owner of file.txt. Bob is a member of the staff group. What permissions does Bob have on file.txt?

Accepted Answer

Read only. Bob is a member of the staff group, and the file.txt permissions are shown as -rw-r-----. The group permissions are r--, meaning members of the staff group (including Bob) have read-only access. The owner (Alice) has read and write, but group permissions do not include write, so Bob cannot modify the file.

Answer

Read and write

Answer

No access

Answer

Write only

Question 10

A system administrator needs to restrict SSH access to a Linux server to only users in the 'sshusers' group. Which configuration change achieves this?

Accepted Answer

Add 'AllowGroups sshusers' to /etc/ssh/sshd_config. Option C is correct because the 'AllowGroups' directive in /etc/ssh/sshd_config restricts SSH access to only users who are members of the specified group. When set to 'AllowGroups sshusers', only users belonging to the 'sshusers' group will be permitted to log in via SSH, effectively blocking all others. This is the standard method for group-based access control in OpenSSH.

Answer

Add 'DenyUsers *' to /etc/ssh/sshd_config

Answer

Set 'PermitRootLogin no' in /etc/ssh/sshd_config

Answer

Add 'AllowUsers sshusers' to /etc/ssh/sshd_config

Question 11

A security audit reveals that the /var/log directory has permissions 777. The administrator needs to ensure that only root can write to log files, while still allowing users to read system log files. Which command should the administrator run?

Accepted Answer

chmod 755 /var/log. Option B is correct because chmod 755 sets the /var/log directory to rwxr-xr-x, meaning root (owner) has full write access, while group and others have read and execute permissions. This allows users to read log files (via execute to traverse the directory) but prevents them from writing, satisfying the audit requirement.

Answer

chmod 644 /var/log

Answer

chmod 700 /var/log

Answer

chmod 750 /var/log

Question 12

A company's security policy requires that all user passwords must expire every 90 days. The administrator runs 'chage -M 90 jdoe' for user jdoe. Which additional step ensures that the password expiration policy is enforced for all new users?

Accepted Answer

Set PASS_MAX_DAYS 90 in /etc/login.defs. Option A is correct because /etc/login.defs contains default values used by useradd and other tools when creating new users. Setting PASS_MAX_DAYS 90 in this file ensures that every new user account created will automatically have a 90-day password expiration, enforcing the policy globally without manual intervention.

Answer

Add 'password required pam_unix.so remember=5' to /etc/pam.d/system-auth

Answer

Set EXPIRE=90 in /etc/default/useradd

Answer

Modify /etc/shadow to set max days for each user

Question 13

A Linux administrator discovers that a user's home directory contains a file with setuid bit set, owned by root. The file is not part of any authorized software. What is the most appropriate immediate action?

Accepted Answer

Remove the setuid bit with 'chmod u-s <file>'. Option D is correct because the immediate priority is to neutralize the unauthorized setuid root binary, which poses a privilege escalation risk. Removing the setuid bit with 'chmod u-s' disables the ability for any user to execute the file with root privileges, containing the threat without destroying evidence that may be needed for forensic analysis. This aligns with security best practices of preserving artifacts while mitigating active risks.

Answer

Move the file to /tmp for further analysis

Answer

Delete the file immediately to remove the threat

Answer

Change the file owner to the user with 'chown user:user <file>'

Question 14

Which TWO of the following are valid methods to enforce disk quota limits on a Linux filesystem? (Select TWO.)

Accepted Answer

Using 'edquota' to set soft and hard limits for users. Option A is correct because 'edquota' is the standard interactive command used to set soft and hard disk quota limits for users or groups on a Linux filesystem. It opens the user's quota settings in a text editor, allowing precise configuration of block and inode limits. Option E is correct because 'quotaon' is the command that enables quota enforcement on a specified filesystem, activating the quota subsystem after limits have been defined.

Answer

Using 'setquota' to set limits in a script

Answer

Running 'repquota' to generate reports

Answer

Running 'quotacheck' to update quota files

Question 15

Scenario: A financial services company runs a critical application on a Linux server that stores sensitive customer data. The server is configured with a firewall (iptables) that only allows SSH (port 22) and HTTPS (port 443) from the internal network (10.0.0.0/8). Recently, the security team detected unauthorized access attempts from an external IP address (203.0.113.5) targeting port 22. The administrator needs to block this specific IP while maintaining current access rules. The existing iptables rules are: 
- INPUT chain policy ACCEPT 
- Rule 1: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 
- Rule 2: -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT 
- Rule 3: -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT 
- Rule 4: -A INPUT -j DROP 
The administrator wants to block 203.0.113.5 from any access. Which command should be added?

Accepted Answer

iptables -I INPUT 1 -s 203.0.113.5 -j DROP. Option A is correct because inserting the DROP rule at position 1 with `-I INPUT 1` ensures it is evaluated before the existing ESTABLISHED,RELATED rule (Rule 1). Since iptables processes rules sequentially, placing the block early prevents the malicious IP from being matched by the ESTABLISHED,RELATED rule, which would otherwise accept its packets if a related connection existed. This maintains the existing SSH and HTTPS access rules for the internal network while explicitly dropping all traffic from 203.0.113.5.

Answer

iptables -I INPUT 5 -s 203.0.113.5 -j DROP

Answer

iptables -A INPUT -s 203.0.113.5 -j DROP

Answer

iptables -I INPUT 1 -s 203.0.113.5 -j ACCEPT

Question 16

Scenario: A cloud hosting company uses SELinux in enforcing mode on all Linux servers. A developer reports that a custom web application running under Apache (httpd) is unable to write log files to /var/log/myapp/. The directory /var/log/myapp/ has permissions 755 and is owned by root:root. The httpd process runs as the 'apache' user. The administrator checks SELinux context: /var/log/myapp is labeled with default_t type. The administrator wants to allow httpd to write to this directory while maintaining security. Which command should the administrator run?

Accepted Answer

Run 'semanage fcontext -a -t httpd_log_t "/var/log/myapp(/.*)?"' and then 'restorecon -Rv /var/log/myapp'. Option D is correct because it permanently relabels the directory with the httpd_log_t SELinux type, which is specifically designed to allow Apache (httpd) to write log files. The semanage fcontext command adds a file context mapping to the SELinux policy database, and restorecon applies that mapping to the filesystem. This approach maintains SELinux enforcing mode and does not rely on temporary changes like chcon or insecure workarounds like disabling SELinux.

Answer

Change ownership with 'chown apache:apache /var/log/myapp'

Answer

Run 'setenforce 0' to disable SELinux

Answer

Run 'chcon -t httpd_log_t /var/log/myapp'

Question 17

A systems administrator needs to restrict SSH access to a Linux server so that only users in the 'sshusers' group can log in. Which configuration change should be made in /etc/ssh/sshd_config?

Accepted Answer

Add 'AllowGroups sshusers'. Option C is correct because the 'AllowGroups' directive in /etc/ssh/sshd_config restricts SSH login to only users who are members of the specified group. By adding 'AllowGroups sshusers', only users in the 'sshusers' group will be permitted to authenticate via SSH, while all others are denied. This is the standard OpenSSH mechanism for group-based access control.

Answer

Add 'AllowUsers sshusers'

Answer

Add 'DenyGroups all'

Answer

Add 'PermitRootLogin no' and add users to sshusers

Question 18

An administrator runs auditctl -l and ausearch -k auth_log -ts today as shown in the exhibit. The administrator expects to see audit events for /var/log/auth.log but gets no matches. Which TWO actions should the administrator take to resolve this issue?

Accepted Answer

Verify that auditd is running with 'systemctl status auditd'. Option B is correct because the audit daemon (auditd) must be running to process audit rules and generate events. If auditd is not active, rules loaded via auditctl will have no effect, and commands like ausearch will return no results. The administrator should verify the service status with 'systemctl status auditd' and start it if necessary.

Answer

Change '-p wa' to '-p rwxa' in the rule for /var/log/auth.log

Answer

Add '-a always,exit -S all -F path=/var/log/auth.log' to capture all syscalls

Answer

Run 'auditctl -R /etc/audit/rules.d/audit.rules' to reload rules

Question 19

You are a systems administrator for a small company. The company uses a Linux server running Ubuntu 22.04 LTS that hosts a web application and a PostgreSQL database. The server has two network interfaces: eth0 (public IP) and eth1 (private IP). The web application listens on port 443 (HTTPS) on eth0, and the PostgreSQL database listens on port 5432 on eth1. The company security policy requires that only the web application should be accessible from the internet; all other ports must be blocked on the public interface. Additionally, SSH access should be allowed only from the internal network (192.168.1.0/24). The current iptables rules are as follows:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

There are no other rules. You need to implement the security policy using iptables. Which of the following sets of commands will achieve the required security policy?

Accepted Answer

iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT. Option A is correct because it sets the default policy to DROP, allows established/related connections, permits HTTPS (port 443) on eth0, restricts SSH (port 22) to the internal network (192.168.1.0/24) on eth1, and then allows all traffic on eth1. This ensures that only the web application is accessible from the internet, SSH is limited to the internal network, and all internal traffic on eth1 is permitted, including PostgreSQL on port 5432.

Answer

iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT

Answer

iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT

Answer

iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT

Question 20

Drag and drop the steps to configure a static IP address using the command line in the correct order.