XK0-006 Security — 50 Questions

Question 1

An administrator needs to add a new user named 'jdoe' with a home directory and default group. Which command should be used?

Accepted Answer

useradd jdoe. The useradd command creates a new user. On most Linux distributions, the default configuration (/etc/default/useradd) is set to create a home directory. The command 'useradd jdoe' will create a home directory /home/jdoe and assign the user's own group as the primary group. While the -m option explicitly enforces home directory creation, the default behavior is sufficient. The other options do not add a user: groupadd adds a group, passwd sets a password, and usermod modifies an existing user.

Answer

groupadd jdoe

Answer

passwd jdoe

Answer

usermod jdoe

Question 2

A Linux administrator is troubleshooting a service that fails to start. The audit.log shows an AVC denial related to the httpd_t domain. The administrator wants to see the full denial message and generate a policy to allow the access. Which two commands should be used in conjunction?

Accepted Answer

ausearch and audit2allow. `ausearch` retrieves the full AVC denial message from the audit log, and `audit2allow` generates a policy module to allow the denied access. Together, they enable the administrator to first identify the exact denial and then create a custom SELinux policy to permit the httpd_t domain's blocked action.

Answer

auditctl and ausearch

Answer

ausearch and restorecon

Answer

aureport and audit2why

Question 3

An administrator wants to ensure that the Apache web server can only listen on port 443 (HTTPS) and not on port 80, enforced by SELinux. Which SELinux boolean should be set to allow Apache to use port 443?

Accepted Answer

None of the above; port 443 is already permitted by default. SELinux already defines port 443 as an allowed port for the Apache web server under the port context 'http_port_t'. No boolean change is needed to enable Apache to listen on port 443. The other booleans are unrelated: httpd_use_nfs controls NFS access, httpd_can_network_connect controls outbound connections, and httpd_enable_homedirs controls user home directory access.

Answer

httpd_use_nfs

Answer

httpd_can_network_connect

Answer

httpd_enable_homedirs

Question 4

An administrator needs to generate a self-signed certificate and private key for a web server. Which openssl command accomplishes this?

Accepted Answer

openssl genrsa -out key.pem 2048 && openssl req -new -x509 -key key.pem -out cert.pem -days 365. It first generates a 2048-bit RSA private key using `openssl genrsa`, then uses `openssl req -new -x509` to create a self-signed X.509 certificate directly from that key, bypassing the need for a Certificate Signing Request (CSR). The `-x509` flag tells OpenSSL to output a self-signed certificate instead of a CSR, and `-days 365` sets the validity period. This two-step process produces both the private key (`key.pem`) and the self-signed certificate (`cert.pem`) required for a web server.

Answer

openssl req -new -key key.pem -out csr.pem

Answer

openssl ca -in csr.pem -out cert.pem

Answer

openssl x509 -req -in csr.pem -signkey key.pem -out cert.pem

Question 5

A Linux server fails to boot after an administrator edits /etc/selinux/config and sets SELINUX=disabled. What is the most likely reason for the boot failure?

Accepted Answer

The administrator forgot to set SELINUXTYPE=targeted. Setting SELINUX=disabled in /etc/selinux/config is syntactically correct, but the configuration file also requires the SELINUXTYPE parameter to specify the policy type (e.g., targeted). Without SELINUXTYPE set, the SELinux initialization code may fail to parse the configuration, leading to a boot failure. The other options either describe actions that contradict the stem or are not likely to cause a boot failure.

Answer

The administrator did not run restorecon on /etc/selinux/config

Answer

The administrator set SELINUX=0 instead of SELINUX=disabled

Answer

The administrator set SELINUX=permissive which requires a relabel

Question 6

A Linux administrator needs to add a new user named 'jdoe' with a home directory and a bash shell. Which command accomplishes this?

Accepted Answer

useradd -m -s /bin/bash jdoe. The useradd command with -m creates the home directory and -s sets the shell. useradd -m -s /bin/bash jdoe is correct.

Answer

usermod -m -s /bin/bash jdoe

Answer

adduser jdoe --home /home/jdoe --shell /bin/bash

Answer

passwd -m jdoe

Question 7

A security audit reveals that users can change their password without meeting complexity requirements. Which PAM module should be configured to enforce password complexity?

Accepted Answer

pam_pwquality. pam_pwquality is the module that enforces password quality rules like length, character classes, etc.

Answer

pam_faillock

Answer

pam_unix

Answer

pam_tally2

Question 8

An administrator wants to allow the user 'ops' to run only the command '/usr/bin/systemctl restart httpd' via sudo on a specific host 'webserver'. Which /etc/sudoers entry is correct?

Accepted Answer

ops webserver=(root) /usr/bin/systemctl restart httpd. The format is: username hostname=(runas) command. For host-specific, use the hostname. The correct entry is 'ops webserver=(root) /usr/bin/systemctl restart httpd'.

Answer

ops ALL=(root) /usr/bin/systemctl restart httpd

Answer

ops webserver=(ALL) /usr/bin/systemctl restart httpd

Answer

ops webserver=(root) ALL

Question 9

An administrator needs to allow incoming TCP traffic on port 8443 using firewalld. Which command should be used to make this change persistent?

Accepted Answer

firewall-cmd --add-port=8443/tcp --permanent && firewall-cmd --reload. To add a port, use firewall-cmd --add-port=8443/tcp --permanent and then reload.

Answer

firewall-cmd --zone=public --add-port=8443/tcp

Answer

firewall-cmd --add-service=8443/tcp --permanent

Answer

firewall-cmd --add-port=8443/tcp

Question 10

A system is running SELinux in enforcing mode. A custom application needs to write to /var/log/app.log. The log file shows the correct context, but access is denied. What is the most likely cause?

Accepted Answer

The SELinux boolean for the application is disabled.. SELinux policy may not allow the application's domain to write to that file; audit2allow can generate a policy. But the question implies a boolean or context issue. However, typical cause is missing policy rule. But among options, 'The application is running in an unconfined domain' is plausible but not best. Actually, the most common cause is that the file context is wrong. But given the file has correct context, the issue is likely a boolean or policy. However, the best answer is 'A transition to the wrong domain'? I'll go with 'The SELinux boolean for the application is disabled'.

Answer

The file context is incorrect.

Answer

The application is running in an unconfined domain.

Answer

SELinux is in permissive mode.

Question 11

Which command displays the current SELinux mode?

Accepted Answer

getenforce. The `getenforce` command displays the current SELinux mode as either Enforcing, Permissive, or Disabled. It directly queries the SELinux status from the kernel and returns the current enforcement state without requiring elevated privileges. This makes it the correct command for simply viewing the current mode.

Answer

selinuxenabled

Answer

sestatus

Answer

setenforce

Question 12

An administrator wants to audit all attempts to access the file /etc/shadow. Which auditctl command should be used?

Accepted Answer

auditctl -w /etc/shadow -p rwxa -k shadow. `auditctl -w /etc/shadow -p rwxa -k shadow` sets a watch on the file for all access types: read (r), write (w), execute (x), and attribute change (a). This captures all attempts to access the file, including reads, which matches the requirement. Option C uses `-F perm=wa`, which only logs write and attribute changes, excluding reads. Option A has invalid syntax (`-A` instead of `-a`). Option D uses `ausearch`, which is for searching audit logs, not setting rules.

Answer

auditctl -A exit,always -F path=/etc/shadow -k shadow

Answer

auditctl -a always,exit -F path=/etc/shadow -F perm=wa -k shadow

Answer

ausearch -w /etc/shadow

Question 13

An AppArmor profile for a web server is in complain mode. After testing, the administrator wants to enforce the profile. Which command accomplishes this?

Accepted Answer

aa-enforce /etc/apparmor.d/usr.sbin.httpd. The correct command to enforce an AppArmor profile that is currently in complain mode is `aa-enforce`. This command switches the profile from complain (log-only) to enforce (block violations) mode. The option `-r` in `apparmor_parser` reloads the profile but does not change its mode; `aa-complain` sets it to complain mode, and `aa-status` only displays status.

Answer

apparmor_parser -r /etc/apparmor.d/usr.sbin.httpd

Answer

aa-complain /etc/apparmor.d/usr.sbin.httpd

Answer

aa-status /etc/apparmor.d/usr.sbin.httpd

Question 14

An administrator is hardening SSH and wants to disable root login and only allow users in the 'sshusers' group. Which two directives should be set in /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin no and AllowGroups sshusers. The directive `PermitRootLogin no` explicitly disallows root login via SSH, and `AllowGroups sshusers` restricts SSH access to only members of the 'sshusers' group. This combination meets both requirements: disabling root login and limiting access to a specific group. The `AllowGroups` directive is group-based, unlike `AllowUsers`, which is user-based.

Answer

DenyRootLogin yes and AllowGroups sshusers

Answer

PermitRootLogin prohibit-password and AllowGroups sshusers

Answer

PermitRootLogin no and AllowUsers sshusers

Question 15

Which command displays the last successful login times for all users?

Accepted Answer

lastlog. lastlog displays the last login for each user.

Answer

who /var/log/wtmp

Answer

lastb

Answer

last

Question 16

A technician needs to generate a self-signed certificate for an internal web server. Which OpenSSL command creates a new private key and a certificate signing request (CSR) in one step?

Accepted Answer

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr. openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr creates both key and CSR.

Answer

openssl req -x509 -newkey rsa:2048 -nodes -keyout server.key -out server.crt

Answer

openssl genrsa -out server.key 2048 && openssl req -new -key server.key -out server.csr

Answer

openssl ca -new -key server.key -out server.csr

Question 17

An administrator notices that a process is running with the context 'unconfined_u:unconfined_r:unconfined_t:s0'. What does this indicate about SELinux?

Accepted Answer

The process is running in an unconfined domain.. The 'unconfined' domain means the process is not restricted by SELinux policy; it can run as if SELinux is disabled.

Answer

The process is running in permissive mode.

Answer

SELinux is disabled.

Answer

The process is confined by a targeted policy.

Question 18

A security policy requires that user passwords must be changed every 60 days, and users should be warned 7 days before expiration. Which two chage commands set these requirements for user 'jsmith'? (Choose TWO.)

Accepted Answer

chage -M 60 jsmith. chage -M 60 sets max days; chage -W 7 sets warning days.

Answer

chage -E 60 jsmith

Answer

chage -m 60 jsmith

Answer

chage -I 7 jsmith

Question 19

An administrator is configuring iptables on a server. The requirements are: allow incoming SSH (port 22) from the 192.168.1.0/24 network, drop all other incoming traffic, and allow all outgoing traffic. Which three iptables rules achieve this? (Choose THREE.)

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT. Default policies: INPUT DROP, OUTPUT ACCEPT. Then allow SSH from subnet.

Answer

iptables -P FORWARD ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Question 20

A Linux administrator is troubleshooting a firewall issue using nftables. The ruleset is complex. Which two commands are useful for listing the current ruleset and adding a new rule? (Choose TWO.)

Accepted Answer

nft list ruleset. `nft list ruleset` is the standard command to display the entire current nftables ruleset in a human-readable format, which is essential for troubleshooting complex firewall configurations. Option C is correct because `nft add rule inet filter input tcp dport 443 accept` is the proper syntax to append a new rule to the specified chain (here, the 'input' chain of the 'filter' table in the 'inet' family) that accepts TCP traffic on port 443.

Answer

nft insert rule

Answer

nft show ruleset

Answer

nft -a list ruleset