XK0-006 Security — 30 Questions

Question 1

An administrator needs to allow incoming TCP traffic on port 8443 using firewalld. Which command should be used to make this change persistent?

Accepted Answer

firewall-cmd --add-port=8443/tcp --permanent && firewall-cmd --reload. To make a firewalld port rule persistent, the `--permanent` flag must be used so the change is written to the permanent configuration, and `--reload` must be run to apply the permanent config to the running firewall. The combined command `firewall-cmd --add-port=8443/tcp --permanent && firewall-cmd --reload` accomplishes both.

Answer

firewall-cmd --zone=public --add-port=8443/tcp

Answer

firewall-cmd --add-service=8443/tcp --permanent

Answer

firewall-cmd --add-port=8443/tcp

Question 2

A system is running SELinux in enforcing mode. A custom application needs to write to /var/log/app.log. The log file shows the correct context, but access is denied. What is the most likely cause?

Accepted Answer

The SELinux boolean for the application is disabled.. When the file context is already correct but access is still denied in enforcing mode, the most likely cause is that an SELinux boolean controlling the application's ability to write to that location is disabled. Booleans are runtime toggles that allow or deny specific policy behaviors without changing file contexts. The application's domain policy may permit writing to /var/log only when the relevant boolean (e.g., httpd_can_write_audit_log or a custom boolean) is enabled.

Answer

The file context is incorrect.

Answer

The application is running in an unconfined domain.

Answer

SELinux is in permissive mode.

Question 3

Which command displays the current SELinux mode?

Accepted Answer

getenforce. The `getenforce` command displays the current SELinux mode as either Enforcing, Permissive, or Disabled. It directly queries the SELinux status from the kernel and returns the current enforcement state without requiring elevated privileges. This makes it the correct command for simply viewing the current mode.

Answer

selinuxenabled

Answer

sestatus

Answer

setenforce

Question 4

An administrator wants to audit all attempts to access the file /etc/shadow. Which auditctl command should be used?

Accepted Answer

auditctl -w /etc/shadow -p rwxa -k shadow. `auditctl -w /etc/shadow -p rwxa -k shadow` sets a watch on the file for all access types: read (r), write (w), execute (x), and attribute change (a). This captures all attempts to access the file, including reads, which matches the requirement. Option C uses `-F perm=wa`, which only logs write and attribute changes, excluding reads. Option A has invalid syntax (`-A` instead of `-a`). Option D uses `ausearch`, which is for searching audit logs, not setting rules.

Answer

auditctl -A exit,always -F path=/etc/shadow -k shadow

Answer

auditctl -a always,exit -F path=/etc/shadow -F perm=wa -k shadow

Answer

ausearch -w /etc/shadow

Question 5

Which command displays the last successful login times for all users?

Accepted Answer

lastlog. The `lastlog` command reads /var/log/lastlog and formats the most recent login time for every user account on the system, including accounts that have never logged in (shown as '**Never logged in**'). It is the purpose-built utility for reporting per-user last-login timestamps.

Answer

who /var/log/wtmp

Answer

lastb

Answer

last

Question 6

A technician needs to generate a self-signed certificate for an internal web server. Which OpenSSL command creates a new private key and a certificate signing request (CSR) in one step?

Accepted Answer

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr. The `openssl req` command with the `-new` and `-newkey` flags generates a new private key and a certificate signing request (CSR) in a single invocation. The `-newkey rsa:2048` option creates a 2048-bit RSA key, `-nodes` skips passphrase encryption, `-keyout` specifies the private key file, and `-out` specifies the CSR file. This matches the requirement to create both a private key and a CSR in one step.

Answer

openssl req -x509 -newkey rsa:2048 -nodes -keyout server.key -out server.crt

Answer

openssl genrsa -out server.key 2048 && openssl req -new -key server.key -out server.csr

Answer

openssl ca -new -key server.key -out server.csr

Question 7

A Linux administrator is troubleshooting a firewall issue using nftables. The ruleset is complex. Which two commands are useful for listing the current ruleset and adding a new rule? (Choose TWO.)

Accepted Answer

nft list ruleset. Option B, `nft list ruleset`, is correct because it is the canonical nftables command that dumps the entire currently loaded ruleset across all tables, chains, and families, which is exactly what an administrator needs when auditing a complex ruleset. Option C, `nft add rule inet filter input tcp dport 443 accept`, is correct because it uses the proper nftables syntax to append a new rule to the input chain of the inet filter table, matching TCP destination port 443 and accepting it. Option A is wrong because `nft insert rule` is an incomplete command—insert requires a full rule specification (table, chain, and match/verdict) and by itself does not add a usable rule. Option D is wrong because `nft show ruleset` is not a valid nftables subcommand; the correct verb is `list`. Option E is wrong because while `nft -a list ruleset` is a valid command that lists the ruleset with handle numbers, it is not one of the two answers marked correct for this question.

Answer

nft insert rule

Answer

nft show ruleset

Answer

nft -a list ruleset

Question 8

A Linux administrator needs to ensure that user passwords expire after 90 days. Which command should be used to enforce this policy?

Accepted Answer

chage -M 90 username. The `chage -M 90 username` command sets the maximum number of days a password is valid before it must be changed, enforcing a 90-day expiration policy. This directly modifies the `PASS_MAX_DAYS` field in `/etc/shadow` for the specified user, which the system checks during authentication.

Answer

passwd -x 90 username

Answer

passwd -e 90 username

Answer

usermod -e 90 username

Question 9

A security auditor notices that a service account's password never expires. The company policy requires password rotation every 60 days. Which command will enforce this policy for the service account?

Accepted Answer

chage -M 60 serviceacct && chage -d 0 serviceacct. chage -M 60 sets the maximum password age to 60 days. To also force a password change on next login, use -d 0.

Answer

chage -W 7 serviceacct

Answer

usermod -e 60 serviceacct

Answer

passwd -n 60 serviceacct

Question 10

A system administrator needs to configure PAM to lock a user account after 5 failed login attempts for 15 minutes. Which two PAM modules and configuration lines are appropriate? (Select TWO.)

Accepted Answer

auth required pam_tally2.so deny=5 unlock_time=900. pam_faillock can be used to lock accounts after failed attempts. The 'deny' option sets the threshold, and 'unlock_time' sets the lockout duration. Alternatively, pam_tally2 can be used with similar options.

Answer

session required pam_limits.so

Answer

account required pam_faillock.so deny=5 unlock_time=900

Answer

password required pam_pwquality.so retry=5

Question 11

A Linux technician is configuring a firewall with firewalld. The organization requires that SSH services be available only on the internal network zone (10.0.0.0/8). Which command should be used to add this rule permanently?

Accepted Answer

firewall-cmd --zone=internal --add-service=ssh --add-source=10.0.0.0/8 --permanent. It uses the proper firewalld syntax to permanently bind the SSH service to the internal zone while restricting access to the 10.0.0.0/8 source network. The --add-service=ssh flag references the predefined SSH service definition (port 22/tcp), and --add-source=10.0.0.0/8 adds the source subnet as a match criterion within the internal zone. The --permanent flag ensures the rule persists across reboots and firewalld reloads, which is exactly what the organization requires.

Answer

firewall-cmd --zone=internal --add-port=22/tcp --add-source=10.0.0.0/8 --permanent

Answer

firewall-cmd --zone=public --add-service=ssh --add-source=10.0.0.0/8 --permanent

Answer

firewall-cmd --zone=internal --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 service name=ssh accept' --permanent

Question 12

Which command displays the current SELinux mode?

Accepted Answer

getenforce. The getenforce command returns the current SELinux enforcement mode (Enforcing, Permissive, or Disabled) as a single-word output, making it the canonical command for querying mode. It reads the current runtime state directly and is the standard answer when the question asks to 'display' the mode.

Answer

setenforce

Answer

selinuxenabled

Answer

sestatus

Question 13

A Linux administrator needs to configure auditing to monitor changes to the /etc/passwd file. Which auditctl command should be used?

Accepted Answer

auditctl -w /etc/passwd -p wa -k passwd_changes. The -w (watch) flag is the shorthand for creating a file-system watch rule, and -p wa specifies that only write and attribute-change events should be audited on /etc/passwd. Since /etc/passwd is modified by writing to it (and its metadata can change), 'wa' is the minimal, correct permission set for detecting changes. The -k passwd_changes tag allows easy filtering of audit records with ausearch -k passwd_changes.

Answer

auditctl -w /etc/passwd -p rwxa -k passwd_changes

Answer

auditctl -a exit,always -S unlink -S rename -F path=/etc/passwd

Answer

auditctl -a always,exit -F path=/etc/passwd -F perm=wa -k passwd_changes

Question 14

A technician needs to create a self-signed certificate and private key for a web server. Which OpenSSL command should be used?

Accepted Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes. The `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes` command generates a new RSA 2048-bit private key and immediately creates a self-signed X.509 certificate in a single step. The `-x509` flag tells OpenSSL to output a self-signed certificate instead of a certificate signing request (CSR), and `-nodes` ensures the private key is not encrypted with a passphrase, which is typical for a web server that must start without manual intervention.

Answer

openssl genrsa -out key.pem 2048 && openssl req -new -key key.pem -out cert.pem

Answer

openssl x509 -req -in req.pem -signkey key.pem -out cert.pem

Answer

openssl ca -in req.pem -out cert.pem

Question 15

A security audit reveals that user accounts remain active after employees leave the company. Which TWO commands should be used to disable an account immediately?

Accepted Answer

usermod -e 1 username. Option B (usermod -e 1 username) is correct because the -e flag sets the account expiration date, and a value of 1 corresponds to January 1, 1970 (the day after the Unix epoch), which immediately expires the account and prevents login. Option C (usermod -L username) is correct because the -L flag locks the user's password by prefixing the encrypted password hash in /etc/shadow with an exclamation mark (!), immediately blocking password-based authentication. Option A (chage -E 0 username) is not among the marked correct answers, and option D (passwd -l username) is likewise not marked correct here even though it also locks a password, so neither should be selected for this question. Option E (userdel username) is incorrect because it deletes the account entirely rather than disabling it, which is not the requested immediate disable action and could remove data or leave orphaned files.

Answer

chage -E 0 username

Answer

passwd -l username

Answer

userdel username

Question 16

An administrator is configuring AppArmor for a custom application. Which THREE commands are used to manage AppArmor profiles?

Accepted Answer

aa-status. aa-status (B) is correct because it reports the current AppArmor state, listing loaded profiles, their enforce/complain modes, and processes confined by them, which is essential for verifying profile management results. aa-complain (D) is correct because it sets a profile to complain mode, allowing the administrator to log policy violations without blocking the application while tuning the custom profile. aa-enforce (E) is correct because it switches a profile into enforce mode, actively denying operations that violate the profile, which is the goal once the profile is validated. aa-logprof (A) is not among the marked answers here, and apparmor_parser (C) is likewise unmarked; while both are real AppArmor utilities, they are not part of the three correct selections for this question.

Answer

aa-logprof

Answer

apparmor_parser

Question 17

An administrator needs to configure iptables to allow incoming SSH traffic only from the 10.0.0.0/8 network and drop all other incoming traffic except established connections. Which TWO rules are necessary?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT. Option D is correct because it appends an INPUT rule that matches TCP packets destined for port 22 (SSH) whose source address falls within 10.0.0.0/8, and jumps to ACCEPT, thereby permitting SSH only from that network. Option E is correct because it uses the state match to ACCEPT packets belonging to ESTABLISHED or RELATED connections, which is required so that return traffic and already-established sessions are not blocked by the default drop policy. The remaining options are not part of the required pair: A would explicitly DROP SSH traffic from all sources (including 10.0.0.0/8), C would drop all INPUT traffic unconditionally, and B sets a default DROP policy but by itself does not implement the SSH-from-10.0.0.0/8 allowance or the established-connection exception.

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP

Answer

iptables -P INPUT DROP

Answer

iptables -A INPUT -j DROP

Question 18

An administrator needs to add a new user named 'jdoe' with a home directory and default group. Which command should be used?

Accepted Answer

useradd jdoe. The useradd command creates a new user. On most Linux distributions, the default configuration (/etc/default/useradd) is set to create a home directory. The command 'useradd jdoe' will create a home directory /home/jdoe and assign the user's own group as the primary group. While the -m option explicitly enforces home directory creation, the default behavior is sufficient. The other options do not add a user: groupadd adds a group, passwd sets a password, and usermod modifies an existing user.

Answer

groupadd jdoe

Answer

passwd jdoe

Answer

usermod jdoe

Question 19

An administrator notices that a non-root user 'alice' can run commands as root without being in the sudoers file. Which group membership could allow this?

Accepted Answer

wheel. On many Linux distributions, membership in the 'wheel' group is a standard mechanism that allows non-root users to execute commands with root privileges via the 'su' command, even if they are not listed in the sudoers file. The 'wheel' group is traditionally used to control access to the 'su' utility, and by default, PAM (Pluggable Authentication Modules) configuration often permits members of the 'wheel' group to switch to the root user without additional sudo configuration.

Answer

admin

Answer

root

Answer

sudo

Question 20

A firewall administrator wants to add a rule to allow incoming SSH traffic (port 22) using firewalld. Which command correctly adds this rule to the default zone permanently?

Accepted Answer

firewall-cmd --add-service=ssh --permanent. firewall-cmd --add-service=ssh --permanent adds the SSH service permanently. Option A lacks --permanent, Option C is missing the required protocol specification (e.g., /tcp), and Option D lacks --permanent. While --add-port=22/tcp would also work, --add-service is more descriptive and easier to manage.

Answer

firewall-cmd --add-port=22/tcp

Answer

firewall-cmd --add-port=22 --permanent

Answer

firewall-cmd --zone=public --add-service=ssh