XK0-005 Security — All Questions With Answers

Question 1easymultiple choice

Read the full Security explanation →

A Linux administrator needs to add a new user named 'jdoe' with a home directory and a bash shell. Which command accomplishes this?

Question 2mediummultiple choice

Read the full Security explanation →

A security audit reveals that users can change their password without meeting complexity requirements. Which PAM module should be configured to enforce password complexity?

Question 3hardmultiple choice

Read the full Security explanation →

An administrator wants to allow the user 'ops' to run only the command '/usr/bin/systemctl restart httpd' via sudo on a specific host 'webserver'. Which /etc/sudoers entry is correct?

Question 4mediummultiple choice

Read the full Security explanation →

An administrator needs to allow incoming TCP traffic on port 8443 using firewalld. Which command should be used to make this change persistent?

Question 5mediummultiple choice

Read the full Security explanation →

A system is running SELinux in enforcing mode. A custom application needs to write to /var/log/app.log. The log file shows the correct context, but access is denied. What is the most likely cause?

Question 6easymultiple choice

Read the full Security explanation →

Which command displays the current SELinux mode?

Question 7mediummultiple choice

Read the full Security explanation →

An administrator wants to audit all attempts to access the file /etc/shadow. Which auditctl command should be used?

Question 8hardmultiple choice

Read the full Security explanation →

An AppArmor profile for a web server is in complain mode. After testing, the administrator wants to enforce the profile. Which command accomplishes this?

Question 9mediummultiple choice

Read the full Security explanation →

An administrator is hardening SSH and wants to disable root login and only allow users in the 'sshusers' group. Which two directives should be set in /etc/ssh/sshd_config?

Question 10easymultiple choice

Read the full Security explanation →

Which command displays the last successful login times for all users?

Question 11mediummultiple choice

Read the full Security explanation →

A technician needs to generate a self-signed certificate for an internal web server. Which OpenSSL command creates a new private key and a certificate signing request (CSR) in one step?

Question 12hardmultiple choice

Read the full Security explanation →

An administrator notices that a process is running with the context 'unconfined_u:unconfined_r:unconfined_t:s0'. What does this indicate about SELinux?

Question 13mediummulti select

Read the full Security explanation →

A security policy requires that user passwords must be changed every 60 days, and users should be warned 7 days before expiration. Which two chage commands set these requirements for user 'jsmith'? (Choose TWO.)

Question 14hardmulti select

Read the full Security explanation →

An administrator is configuring iptables on a server. The requirements are: allow incoming SSH (port 22) from the 192.168.1.0/24 network, drop all other incoming traffic, and allow all outgoing traffic. Which three iptables rules achieve this? (Choose THREE.)

Question 15mediummulti select

Read the full Security explanation →

A Linux administrator is troubleshooting a firewall issue using nftables. The ruleset is complex. Which two commands are useful for listing the current ruleset and adding a new rule? (Choose TWO.)

Question 16easymultiple choice

Read the full Security explanation →

A Linux administrator needs to ensure that user passwords expire after 90 days. Which command should be used to enforce this policy?

Question 17mediummultiple choice

Read the full Security explanation →

A security auditor notices that a service account's password never expires. The company policy requires password rotation every 60 days. Which command will enforce this policy for the service account?

Question 18mediummultiple choice

Read the full Security explanation →

An administrator wants to restrict SSH access to only users in the 'sshusers' group. Which configuration directive should be added to /etc/ssh/sshd_config?

Question 19hardmultiple choice

Read the full Security explanation →

A system administrator needs to configure PAM to lock a user account after 5 failed login attempts for 15 minutes. Which two PAM modules and configuration lines are appropriate? (Select TWO.)

Question 20mediummultiple choice

Read the full Security explanation →

A security policy requires that all users must have passwords with at least one uppercase letter, one digit, and a minimum length of 12 characters. Which PAM configuration file and module should be used to enforce this?

Question 21mediummultiple choice

Read the full Security explanation →

A Linux technician is configuring a firewall with firewalld. The organization requires that SSH services be available only on the internal network zone (10.0.0.0/8). Which command should be used to add this rule permanently?

Question 22hardmultiple choice

Read the full Security explanation →

A server running nftables has a rule set that allows incoming SSH from the management network (192.168.1.0/24). An administrator needs to insert a rule to drop SSH from all other sources. Which nft command accomplishes this? Assume the input chain is 'input' and the table is 'inet filter'.

Question 23mediummultiple choice

Read the full Security explanation →

An administrator needs to configure SELinux to allow the Apache HTTP server to connect to a database server. Which SELinux boolean should be enabled?

Question 24hardmultiple choice

Read the full Security explanation →

A file named 'webapp.conf' is being served by Apache but users get a 'Permission denied' error. The SELinux context of the file is 'unconfined_u:object_r:admin_home_t:s0'. What is the most appropriate command to fix the SELinux context?

Question 25mediummultiple choice

Read the full Security explanation →

An administrator notices repeated failed login attempts in /var/log/secure. The company policy requires account lockout after 5 failed attempts within 15 minutes. Which PAM module and configuration can enforce this?

Question 26easymultiple choice

Read the full Security explanation →

Which command displays the current SELinux mode?

Question 27mediummultiple choice

Read the full Security explanation →

A system administrator is hardening SSH and needs to disable root login and password authentication. Which two directives should be set in /etc/ssh/sshd_config?

Question 28hardmultiple choice

Read the full Security explanation →

A Linux administrator needs to configure auditing to monitor changes to the /etc/passwd file. Which auditctl command should be used?

Question 29easymultiple choice

Read the full Security explanation →

Which command can be used to generate an SSH key pair for user authentication?

Question 30mediummultiple choice

Read the full Security explanation →

A technician needs to create a self-signed certificate and private key for a web server. Which OpenSSL command should be used?

Question 31mediummulti select

Read the full Security explanation →

A security audit reveals that user accounts remain active after employees leave the company. Which TWO commands should be used to disable an account immediately?

Question 32hardmulti select

Read the full Security explanation →

An administrator is configuring AppArmor for a custom application. Which THREE commands are used to manage AppArmor profiles?

Question 33mediummulti select

Read the full Security explanation →

A Linux engineer needs to restrict resource usage for users in the 'developers' group. Which TWO files or commands can be used to set ulimit values?

Question 34mediummulti select

Read the full Security explanation →

Which THREE are valid SELinux modes?

Question 35hardmulti select

Read the full Security explanation →

An administrator needs to configure iptables to allow incoming SSH traffic only from the 10.0.0.0/8 network and drop all other incoming traffic except established connections. Which TWO rules are necessary?

Question 36easymultiple choice

Read the full Security explanation →

An administrator needs to add a new user named 'jdoe' with a home directory and default group. Which command should be used?

Question 37easymultiple choice

Read the full Security explanation →

Which file contains user password hashes and aging information on a Linux system?

Question 38mediummultiple choice

Read the full Security explanation →

A security analyst wants to ensure that users cannot change their password more than once every 7 days. Which command and option should be used to enforce this policy for user 'jsmith'?

Question 39mediummultiple choice

Read the full Security explanation →

An administrator notices that a non-root user 'alice' can run commands as root without being in the sudoers file. Which group membership could allow this?

Question 40hardmultiple choice

Read the full Security explanation →

A system administrator configures PAM to enforce account lockout after 3 failed login attempts. Which PAM module should be used?

Question 41mediummultiple choice

Read the full Security explanation →

To limit the number of processes a user can create, which file should be configured?

Question 42mediummultiple choice

Read the full Security explanation →

A firewall administrator wants to add a rule to allow incoming SSH traffic (port 22) using firewalld. Which command correctly adds this rule to the default zone permanently?

Question 43hardmultiple choice

Read the full Security explanation →

An administrator needs to view all current nftables rules. Which command should be used?

Question 44mediummultiple choice

Read the full Security explanation →

SELinux is currently in enforcing mode. A service is being blocked by SELinux. Which command can analyze the audit log and suggest the minimum policy changes to allow the service?

Question 45hardmultiple choice

Read the full Security explanation →

An administrator wants to set an SELinux boolean that allows Apache to connect to databases. After setting the boolean, which option ensures the change persists across reboots?

Question 46mediummultiple choice

Read the full Security explanation →

To harden SSH, an administrator needs to disable root login over SSH. Which directive should be set in /etc/ssh/sshd_config?

Question 47easymultiple choice

Read the full Security explanation →

Which log file typically records authentication failures and successes on a Debian-based system?

Question 48mediummultiple choice

Read the full Security explanation →

An administrator wants to generate a self-signed certificate and private key for testing. Which command creates both in one step?

Question 49mediummulti select

Read the full Security explanation →

A security administrator is reviewing SSH configuration. Which TWO settings enhance security by limiting authentication attempts and preventing password-based logins? (Choose two.)

Question 50hardmulti select

Read the full Security explanation →

After configuring AppArmor, an administrator wants to verify the status of all profiles and switch a profile from complain to enforce mode. Which THREE commands are appropriate? (Choose three.)

Question 51easymultiple choice

Read the full Security explanation →

A Linux administrator needs to prevent the root user from logging in via SSH. Which directive should be set in /etc/ssh/sshd_config to accomplish this?

Question 52mediummultiple choice

Read the full Security explanation →

A security auditor notices that users can set weak passwords on a Linux system. The administrator wants to enforce password complexity requiring a minimum of 12 characters, at least one uppercase letter, and at least one digit. Which PAM module should be configured in /etc/pam.d/common-password?

Question 53hardmultiple choice

Read the full Security explanation →

A system administrator is configuring firewalld on a Linux server. They want to allow incoming HTTPS traffic permanently for the public zone. Which command should be used?

Question 54mediummultiple choice

Read the full Security explanation →

A Linux administrator is troubleshooting a service that fails to start. The audit.log shows an AVC denial related to the httpd_t domain. The administrator wants to see the full denial message and generate a policy to allow the access. Which two commands should be used in conjunction?

Question 55easymultiple choice

Read the full Security explanation →

An administrator wants to view the current SELinux mode on a system. Which command displays whether SELinux is enforcing, permissive, or disabled?

Question 56mediummultiple choice

Read the full Security explanation →

A user named 'jdoe' needs to run commands as root without being given the root password. The administrator wants to grant jdoe the ability to run any command as root, but only after entering their own password. Which entry in /etc/sudoers accomplishes this?

Question 57hardmultiple choice

Read the full Security explanation →

A Linux security administrator needs to generate a self-signed certificate for a web server. They want to create a private key and a certificate signing request (CSR) in one step. Which OpenSSL command should be used?

Question 58easymultiple choice

Read the full Security explanation →

An administrator wants to enforce an account lockout policy after five failed login attempts on a Linux system. Which PAM module should be added to the authentication stack?

Question 59mediummultiple choice

Read the full Security explanation →

A system administrator needs to add an iptables rule to drop incoming TCP traffic on port 22 (SSH) from the IP address 10.0.0.100. Which command should be used?

Question 60hardmultiple choice

Read the full Security explanation →

An administrator is configuring log rotation for /var/log/auth.log. They want logs to be rotated weekly, compressed, and kept for 12 weeks. Which logrotate configuration directive achieves this?

Question 61mediummultiple choice

Read the full Security explanation →

A security analyst needs to see a list of failed login attempts on a Linux system. Which command displays this information from the /var/log/secure log?

Question 62easymultiple choice

Read the full Security explanation →

An administrator wants to ensure that only users in the 'wheel' group can use the sudo command. Which directive in /etc/sudoers enables this?

Question 63mediummulti select

Read the full Security explanation →

A Linux administrator is hardening an SSH server. Which two of the following settings should be applied to /etc/ssh/sshd_config to improve security?

Question 64mediummulti select

Read the full Security explanation →

A security administrator is reviewing file permissions on a Linux system. They want to ensure that the /etc/shadow file is only readable by the root user. Which two commands can be used to set the correct permissions?

Question 65hardmulti select

Read the full Security explanation →

An administrator is configuring auditd to monitor changes to the /etc/passwd file. Which three commands are part of the auditd toolset for setting up and reviewing audit rules?

Question 66mediummultiple choice

Read the full Security explanation →

A Linux administrator needs to configure a firewall to allow incoming SSH connections on the default port. Which firewalld command accomplishes this permanently?

Question 67easymultiple choice

Read the full Security explanation →

A system administrator wants to enforce a password policy requiring a minimum length of 12 characters, at least one uppercase letter, and one digit. Which PAM module should be configured?

Question 68hardmultiple choice

Read the full Security explanation →

A security audit reveals that an SELinux boolean 'httpd_can_network_connect' is currently off, but a web application requires Apache to connect to a database server. Which command should the administrator use to enable this boolean persistently?

Question 69mediummultiple choice

Read the full Security explanation →

An administrator needs to prevent a specific user 'bob' from logging in via SSH while allowing other users. Which configuration directive should be added to /etc/ssh/sshd_config?

Question 70mediummultiple choice

Read the full Security explanation →

A Linux administrator wants to monitor changes to the /etc/passwd file for security auditing. Which auditctl command should be used?

Question 71easymultiple choice

Read the full Security explanation →

Which command displays the current SELinux mode?

Question 72mediummultiple choice

Read the full Security explanation →

A user reports they cannot log in after three failed password attempts. The system uses PAM with pam_faillock. Which command can the administrator use to view the number of failed attempts for the user?

Question 73hardmultiple choice

Read the full Security explanation →

An administrator wants to ensure that the Apache web server can only listen on port 443 (HTTPS) and not on port 80, enforced by SELinux. Which SELinux boolean should be set to allow Apache to use port 443?

Question 74mediummultiple choice

Read the full Security explanation →

An administrator needs to generate a self-signed certificate and private key for a web server. Which openssl command accomplishes this?

Question 75easymultiple choice

Read the full Security explanation →

Which file contains the hashed passwords and password aging information for user accounts?

Question 76mediummultiple choice

Read the full network assurance explanation →

A security policy requires that system logs be rotated weekly and kept for 4 weeks. Which configuration file should be modified to achieve this for /var/log/syslog?

Question 77hardmultiple choice

Read the full Security explanation →

An administrator is troubleshooting an AppArmor profile that is blocking a custom application. They want to set the profile to complain mode to gather violations without enforcing. Which command should they use?

Question 78mediummulti select

Read the full Security explanation →

A Linux administrator needs to configure sudo access for members of the 'wheel' group to run any command. Which two steps are required? (Choose TWO.)

Question 79mediummulti select

Read the full Security explanation →

An administrator wants to harden SSH access by implementing the following: disallow root login, disable password authentication, and limit the number of authentication attempts. Which three configuration directives should be set in /etc/ssh/sshd_config? (Choose THREE.)

Question 80hardmulti select

Read the full Security explanation →

A security audit reveals that a service is running with an incorrect SELinux context. Which two commands can be used to relabel the file or directory to the correct context? (Choose TWO.)

Question 81easymultiple choice

Read the full Security explanation →

A Linux administrator needs to add a new user named 'jdoe' with a home directory and bash shell. Which command accomplishes this?

Question 82easymultiple choice

Read the full Security explanation →

An administrator wants to force a password change for user 'alice' on next login. Which command is appropriate?

Question 83mediummultiple choice

Read the full Security explanation →

A system administrator needs to configure sudo so that members of the 'wheel' group can execute any command without a password. Which line should be added to /etc/sudoers (using visudo)?

Question 84mediummultiple choice

Read the full Security explanation →

A security analyst notices repeated failed login attempts on a Linux server. They want to lock the account after 3 failed attempts using PAM. Which PAM module should be configured in /etc/pam.d/sshd or /etc/pam.d/system-auth?

Question 85mediummultiple choice

Read the full Security explanation →

A web server running on port 8080 must be accessible from external networks. The system uses firewalld. Which command opens port 8080/tcp permanently in the default zone?

Question 86hardmultiple choice

Read the full Security explanation →

A Linux server has SELinux enforcing and a custom application needs to write to /var/log/app.log. The audit log shows 'avc: denied { write } for pid=1234'. After verifying that the application runs in the correct domain, which command should be used to allow the write access by generating a policy module?

Question 87hardmultiple choice

Read the full Security explanation →

An administrator needs to ensure that only users from the 'ops' group can SSH into a server. Which configuration in /etc/ssh/sshd_config accomplishes this?

Question 88mediummultiple choice

Read the full Security explanation →

A system administrator wants to monitor changes to the /etc/passwd file using auditd. Which auditctl command sets up a watch on this file?

Question 89mediummultiple choice

Read the full Security explanation →

A user reports being unable to log in because the password is locked. The administrator needs to unlock the account. Which command should be used?

Question 90easymultiple choice

Read the full Security explanation →

Which command displays the current SELinux mode?

Question 91hardmultiple choice

Read the full Security explanation →

An administrator needs to generate a self-signed certificate and private key for an internal web server. Which OpenSSL command creates both in one step?

Question 92mediummultiple choice

Read the full Security explanation →

A system administrator wants to limit the number of simultaneous logins for a user to 2. Which file and parameter should be configured?

Question 93easymulti select

Read the full Security explanation →

Which TWO commands can be used to lock a user account? (Choose two.)

Question 94mediummulti select

Read the full Security explanation →

An administrator needs to harden SSH access. Which TWO settings in /etc/ssh/sshd_config are recommended to improve security? (Choose two.)

Question 95hardmulti select

Read the full Security explanation →

A security audit reveals that a Linux system allows password-based SSH logins and has weak password policies. Which THREE actions should the administrator take to improve security? (Choose three.)

Question 96easymultiple choice

Read the full Security explanation →

A Linux administrator wants to prevent users from reusing their last five passwords. Which PAM module should be configured?

Question 97easymultiple choice

Read the full Security explanation →

A technician needs to ensure a service can listen on TCP port 8443 using firewalld. Which command permanently adds the port to the default zone?

Question 98mediummultiple choice

Read the full Security explanation →

A security audit reveals that the /etc/shadow file is readable by all users. What is the most appropriate immediate action?

Question 99mediummultiple choice

Read the full Security explanation →

An administrator wants to allow user 'jane' to run all commands as root via sudo without a password. Which line should be added to /etc/sudoers?

Question 100mediummultiple choice

Read the full Security explanation →

A file on an SELinux-enabled system has the security context 'unconfined_u:object_r:httpd_sys_content_t:s0'. A web server needs to read it, but it is being denied. Which command changes the context to allow access?

Question 101mediummultiple choice

Read the full Security explanation →

A system administrator needs to monitor file access attempts to /etc/shadow using auditd. Which auditctl command sets up the watch?

Question 102hardmultiple choice

Read the full Security explanation →

After modifying a PAM configuration file for sshd, a user reports they cannot log in. Which command can be used to verify the syntax of the PAM configuration without affecting running services?

Question 103hardmultiple choice

Read the full Security explanation →

An administrator needs to generate a self-signed certificate valid for 365 days with a 2048-bit RSA key. Which OpenSSL command correctly creates both the private key and certificate in one step?

Question 104easymultiple choice

Read the full Security explanation →

Which file contains the password aging information such as minimum and maximum days between password changes?

Question 105mediummultiple choice

Read the full Security explanation →

A security team wants to restrict SSH access to only users in the 'sshusers' group. Which configuration line in /etc/ssh/sshd_config achieves this?

Question 106hardmultiple choice

Read the full Security explanation →

An administrator notices that an AppArmor profile is in complain mode for a service that should be enforcing. Which command changes the profile to enforce mode?

Question 107easymultiple choice

Read the full Security explanation →

Which command displays the current SELinux mode?

Question 108mediummulti select

Read the full Security explanation →

A security audit has identified that several users have excessive sudo privileges. The administrator needs to review and modify sudo access. Which two files or commands would be used? (Choose TWO.)

Question 109hardmulti select

Read the full Security explanation →

An administrator is configuring a firewall using iptables to block all incoming traffic except SSH on port 22. Which three rules correctly implement this? (Choose THREE.)

Question 110mediummulti select

Read the full Security explanation →

A Linux administrator needs to implement password complexity rules requiring at least one uppercase letter, one digit, and a minimum length of 10 characters. Which two PAM configuration entries would be used? (Choose TWO.)

Question 111easymultiple choice

Read the full Security explanation →

A Linux administrator needs to add a new user named 'jdoe' with a home directory and default shell /bin/bash. Which command should be used?

Question 112mediummultiple choice

Read the full Security explanation →

A security policy requires that users cannot reuse any of their last 5 passwords. Which PAM module and configuration directive enforces this?

Question 113hardmultiple choice

Read the full Security explanation →

An administrator notices that a custom application uses port 8443/TCP. To allow external access, which firewalld command permanently opens this port in the default zone?

Question 114mediummultiple choice

Read the full Security explanation →

A Linux server fails to boot after an administrator edits /etc/selinux/config and sets SELINUX=disabled. What is the most likely reason for the boot failure?

Question 115mediummultiple choice

Read the full Security explanation →

A system administrator needs to ensure that the Apache web server can read files in /var/www/html, which has the SELinux context httpd_sys_content_t. However, Apache is unable to access the files. What command should be used to apply the correct context to the directory and its contents?

Question 116easymultiple choice

Read the full Security explanation →

Which of the following correctly describes the purpose of the /etc/shadow file?

Question 117hardmultiple choice

Read the full Security explanation →

An administrator configures /etc/ssh/sshd_config with the following settings: PermitRootLogin no, PasswordAuthentication no, AllowUsers alice bob, MaxAuthTries 2. After restarting sshd, which of the following is true?

Question 118mediummultiple choice

Read the full Security explanation →

A security audit reveals that the system's PAM configuration does not enforce password complexity. Which PAM module and configuration line should be added to /etc/pam.d/common-password to require at least one uppercase letter, one digit, and a minimum length of 12 characters?

Question 119easymultiple choice

Read the full Security explanation →

Which command displays the current SELinux mode (e.g., enforcing, permissive, disabled)?

Question 120hardmultiple choice

Read the full Security explanation →

An administrator runs 'auditctl -w /etc/passwd -p wa -k passwd_changes' to monitor changes to /etc/passwd. Which command should be used to search the audit log for all events related to this watch?

Question 121mediummulti select

Read the full Security explanation →

A Linux engineer needs to harden SSH access. Which TWO of the following settings should be configured in /etc/ssh/sshd_config to enhance security? (Select TWO.)

Question 122hardmulti select

Read the full Security explanation →

A system administrator is configuring PAM to lock out users after 3 failed login attempts for 15 minutes. Which TWO PAM modules can be used together to achieve this? (Select TWO.)

Question 123easymulti select

Read the full Security explanation →

Which THREE of the following commands are used to manage iptables rules? (Select THREE.)

Question 124mediummulti select

Read the full Security explanation →

A security analyst is investigating a potential breach and needs to examine user login history. Which THREE commands or log files provide information about user logins? (Select THREE.)

Question 125hardmulti select

Read the full Security explanation →

An administrator is configuring sudo access for a group of developers. They should be able to run any command as root, but only after authenticating with their own password. Which TWO configuration lines in /etc/sudoers would achieve this? (Select TWO.)

Question 1easymultiple choice

Read the full Security explanation →

A Linux administrator needs to add a new user named 'jdoe' with a home directory and a bash shell. Which command accomplishes this?

Question 2mediummultiple choice

Read the full Security explanation →

A security audit reveals that users can change their password without meeting complexity requirements. Which PAM module should be configured to enforce password complexity?

Question 3hardmultiple choice

Read the full Security explanation →

An administrator wants to allow the user 'ops' to run only the command '/usr/bin/systemctl restart httpd' via sudo on a specific host 'webserver'. Which /etc/sudoers entry is correct?

Question 4mediummultiple choice

Read the full Security explanation →

An administrator needs to allow incoming TCP traffic on port 8443 using firewalld. Which command should be used to make this change persistent?

Question 5mediummultiple choice

Read the full Security explanation →

A system is running SELinux in enforcing mode. A custom application needs to write to /var/log/app.log. The log file shows the correct context, but access is denied. What is the most likely cause?

Question 6easymultiple choice

Read the full Security explanation →

Which command displays the current SELinux mode?

Question 7mediummultiple choice

Read the full Security explanation →

An administrator wants to audit all attempts to access the file /etc/shadow. Which auditctl command should be used?

Question 8hardmultiple choice

Read the full Security explanation →

An AppArmor profile for a web server is in complain mode. After testing, the administrator wants to enforce the profile. Which command accomplishes this?

Question 9mediummultiple choice

Read the full Security explanation →

An administrator is hardening SSH and wants to disable root login and only allow users in the 'sshusers' group. Which two directives should be set in /etc/ssh/sshd_config?

Question 10easymultiple choice

Read the full Security explanation →

Which command displays the last successful login times for all users?

Question 11mediummultiple choice

Read the full Security explanation →

A technician needs to generate a self-signed certificate for an internal web server. Which OpenSSL command creates a new private key and a certificate signing request (CSR) in one step?

Question 12hardmultiple choice

Read the full Security explanation →

An administrator notices that a process is running with the context 'unconfined_u:unconfined_r:unconfined_t:s0'. What does this indicate about SELinux?

Question 13mediummulti select

Read the full Security explanation →

A security policy requires that user passwords must be changed every 60 days, and users should be warned 7 days before expiration. Which two chage commands set these requirements for user 'jsmith'? (Choose TWO.)

Question 14hardmulti select

Read the full Security explanation →

An administrator is configuring iptables on a server. The requirements are: allow incoming SSH (port 22) from the 192.168.1.0/24 network, drop all other incoming traffic, and allow all outgoing traffic. Which three iptables rules achieve this? (Choose THREE.)

Question 15mediummulti select

Read the full Security explanation →

A Linux administrator is troubleshooting a firewall issue using nftables. The ruleset is complex. Which two commands are useful for listing the current ruleset and adding a new rule? (Choose TWO.)

Question 16easymultiple choice

Read the full Security explanation →

A Linux administrator needs to ensure that user passwords expire after 90 days. Which command should be used to enforce this policy?

Question 17mediummultiple choice

Read the full Security explanation →

A security auditor notices that a service account's password never expires. The company policy requires password rotation every 60 days. Which command will enforce this policy for the service account?

Question 18mediummultiple choice

Read the full Security explanation →

An administrator wants to restrict SSH access to only users in the 'sshusers' group. Which configuration directive should be added to /etc/ssh/sshd_config?

Question 19hardmultiple choice

Read the full Security explanation →

A system administrator needs to configure PAM to lock a user account after 5 failed login attempts for 15 minutes. Which two PAM modules and configuration lines are appropriate? (Select TWO.)

Question 20mediummultiple choice

Read the full Security explanation →

A security policy requires that all users must have passwords with at least one uppercase letter, one digit, and a minimum length of 12 characters. Which PAM configuration file and module should be used to enforce this?

Question 21mediummultiple choice

Read the full Security explanation →

A Linux technician is configuring a firewall with firewalld. The organization requires that SSH services be available only on the internal network zone (10.0.0.0/8). Which command should be used to add this rule permanently?

Question 22hardmultiple choice

Read the full Security explanation →

A server running nftables has a rule set that allows incoming SSH from the management network (192.168.1.0/24). An administrator needs to insert a rule to drop SSH from all other sources. Which nft command accomplishes this? Assume the input chain is 'input' and the table is 'inet filter'.

Question 23mediummultiple choice

Read the full Security explanation →

An administrator needs to configure SELinux to allow the Apache HTTP server to connect to a database server. Which SELinux boolean should be enabled?

Question 24hardmultiple choice

Read the full Security explanation →

A file named 'webapp.conf' is being served by Apache but users get a 'Permission denied' error. The SELinux context of the file is 'unconfined_u:object_r:admin_home_t:s0'. What is the most appropriate command to fix the SELinux context?

Question 25mediummultiple choice

Read the full Security explanation →

An administrator notices repeated failed login attempts in /var/log/secure. The company policy requires account lockout after 5 failed attempts within 15 minutes. Which PAM module and configuration can enforce this?

Question 26easymultiple choice

Read the full Security explanation →

Which command displays the current SELinux mode?

Question 27mediummultiple choice

Read the full Security explanation →

A system administrator is hardening SSH and needs to disable root login and password authentication. Which two directives should be set in /etc/ssh/sshd_config?

Question 28hardmultiple choice

Read the full Security explanation →

A Linux administrator needs to configure auditing to monitor changes to the /etc/passwd file. Which auditctl command should be used?

Question 29easymultiple choice

Read the full Security explanation →

Which command can be used to generate an SSH key pair for user authentication?

Question 30mediummultiple choice

Read the full Security explanation →

A technician needs to create a self-signed certificate and private key for a web server. Which OpenSSL command should be used?

Question 31mediummulti select

Read the full Security explanation →

A security audit reveals that user accounts remain active after employees leave the company. Which TWO commands should be used to disable an account immediately?

Question 32hardmulti select

Read the full Security explanation →

An administrator is configuring AppArmor for a custom application. Which THREE commands are used to manage AppArmor profiles?

Question 33mediummulti select

Read the full Security explanation →

A Linux engineer needs to restrict resource usage for users in the 'developers' group. Which TWO files or commands can be used to set ulimit values?

Question 34mediummulti select

Read the full Security explanation →

Which THREE are valid SELinux modes?

Question 35hardmulti select

Read the full Security explanation →

An administrator needs to configure iptables to allow incoming SSH traffic only from the 10.0.0.0/8 network and drop all other incoming traffic except established connections. Which TWO rules are necessary?

Question 36easymultiple choice

Read the full Security explanation →

An administrator needs to add a new user named 'jdoe' with a home directory and default group. Which command should be used?

Question 37easymultiple choice

Read the full Security explanation →

Which file contains user password hashes and aging information on a Linux system?

Question 38mediummultiple choice

Read the full Security explanation →

A security analyst wants to ensure that users cannot change their password more than once every 7 days. Which command and option should be used to enforce this policy for user 'jsmith'?

Question 39mediummultiple choice

Read the full Security explanation →

An administrator notices that a non-root user 'alice' can run commands as root without being in the sudoers file. Which group membership could allow this?

Question 40hardmultiple choice

Read the full Security explanation →

A system administrator configures PAM to enforce account lockout after 3 failed login attempts. Which PAM module should be used?

Question 41mediummultiple choice

Read the full Security explanation →

To limit the number of processes a user can create, which file should be configured?

Question 42mediummultiple choice

Read the full Security explanation →

A firewall administrator wants to add a rule to allow incoming SSH traffic (port 22) using firewalld. Which command correctly adds this rule to the default zone permanently?

Question 43hardmultiple choice

Read the full Security explanation →

An administrator needs to view all current nftables rules. Which command should be used?

Question 44mediummultiple choice

Read the full Security explanation →

SELinux is currently in enforcing mode. A service is being blocked by SELinux. Which command can analyze the audit log and suggest the minimum policy changes to allow the service?

Question 45hardmultiple choice

Read the full Security explanation →

An administrator wants to set an SELinux boolean that allows Apache to connect to databases. After setting the boolean, which option ensures the change persists across reboots?

Question 46mediummultiple choice

Read the full Security explanation →

To harden SSH, an administrator needs to disable root login over SSH. Which directive should be set in /etc/ssh/sshd_config?

Question 47easymultiple choice

Read the full Security explanation →

Which log file typically records authentication failures and successes on a Debian-based system?

Question 48mediummultiple choice

Read the full Security explanation →

An administrator wants to generate a self-signed certificate and private key for testing. Which command creates both in one step?

Question 49mediummulti select

Read the full Security explanation →

A security administrator is reviewing SSH configuration. Which TWO settings enhance security by limiting authentication attempts and preventing password-based logins? (Choose two.)

Question 50hardmulti select

Read the full Security explanation →

After configuring AppArmor, an administrator wants to verify the status of all profiles and switch a profile from complain to enforce mode. Which THREE commands are appropriate? (Choose three.)

Question 51easymultiple choice

Read the full Security explanation →

A Linux administrator needs to prevent the root user from logging in via SSH. Which directive should be set in /etc/ssh/sshd_config to accomplish this?

Question 52mediummultiple choice

Read the full Security explanation →

A security auditor notices that users can set weak passwords on a Linux system. The administrator wants to enforce password complexity requiring a minimum of 12 characters, at least one uppercase letter, and at least one digit. Which PAM module should be configured in /etc/pam.d/common-password?

Question 53hardmultiple choice

Read the full Security explanation →

A system administrator is configuring firewalld on a Linux server. They want to allow incoming HTTPS traffic permanently for the public zone. Which command should be used?

Question 54mediummultiple choice

Read the full Security explanation →

A Linux administrator is troubleshooting a service that fails to start. The audit.log shows an AVC denial related to the httpd_t domain. The administrator wants to see the full denial message and generate a policy to allow the access. Which two commands should be used in conjunction?

Question 55easymultiple choice

Read the full Security explanation →

An administrator wants to view the current SELinux mode on a system. Which command displays whether SELinux is enforcing, permissive, or disabled?

Question 56mediummultiple choice

Read the full Security explanation →

A user named 'jdoe' needs to run commands as root without being given the root password. The administrator wants to grant jdoe the ability to run any command as root, but only after entering their own password. Which entry in /etc/sudoers accomplishes this?

Question 57hardmultiple choice

Read the full Security explanation →

A Linux security administrator needs to generate a self-signed certificate for a web server. They want to create a private key and a certificate signing request (CSR) in one step. Which OpenSSL command should be used?

Question 58easymultiple choice

Read the full Security explanation →

An administrator wants to enforce an account lockout policy after five failed login attempts on a Linux system. Which PAM module should be added to the authentication stack?

Question 59mediummultiple choice

Read the full Security explanation →

A system administrator needs to add an iptables rule to drop incoming TCP traffic on port 22 (SSH) from the IP address 10.0.0.100. Which command should be used?

Question 60hardmultiple choice

Read the full Security explanation →

An administrator is configuring log rotation for /var/log/auth.log. They want logs to be rotated weekly, compressed, and kept for 12 weeks. Which logrotate configuration directive achieves this?

Question 61mediummultiple choice

Read the full Security explanation →

A security analyst needs to see a list of failed login attempts on a Linux system. Which command displays this information from the /var/log/secure log?

Question 62easymultiple choice

Read the full Security explanation →

An administrator wants to ensure that only users in the 'wheel' group can use the sudo command. Which directive in /etc/sudoers enables this?

Question 63mediummulti select

Read the full Security explanation →

A Linux administrator is hardening an SSH server. Which two of the following settings should be applied to /etc/ssh/sshd_config to improve security?

Question 64mediummulti select

Read the full Security explanation →

A security administrator is reviewing file permissions on a Linux system. They want to ensure that the /etc/shadow file is only readable by the root user. Which two commands can be used to set the correct permissions?

Question 65hardmulti select

Read the full Security explanation →

An administrator is configuring auditd to monitor changes to the /etc/passwd file. Which three commands are part of the auditd toolset for setting up and reviewing audit rules?

Question 66mediummultiple choice

Read the full Security explanation →

A Linux administrator needs to configure a firewall to allow incoming SSH connections on the default port. Which firewalld command accomplishes this permanently?

Question 67easymultiple choice

Read the full Security explanation →

A system administrator wants to enforce a password policy requiring a minimum length of 12 characters, at least one uppercase letter, and one digit. Which PAM module should be configured?

Question 68hardmultiple choice

Read the full Security explanation →

A security audit reveals that an SELinux boolean 'httpd_can_network_connect' is currently off, but a web application requires Apache to connect to a database server. Which command should the administrator use to enable this boolean persistently?

Question 69mediummultiple choice

Read the full Security explanation →

An administrator needs to prevent a specific user 'bob' from logging in via SSH while allowing other users. Which configuration directive should be added to /etc/ssh/sshd_config?

Question 70mediummultiple choice

Read the full Security explanation →

A Linux administrator wants to monitor changes to the /etc/passwd file for security auditing. Which auditctl command should be used?

Question 71easymultiple choice

Read the full Security explanation →

Which command displays the current SELinux mode?

Question 72mediummultiple choice

Read the full Security explanation →

A user reports they cannot log in after three failed password attempts. The system uses PAM with pam_faillock. Which command can the administrator use to view the number of failed attempts for the user?

Question 73hardmultiple choice

Read the full Security explanation →

An administrator wants to ensure that the Apache web server can only listen on port 443 (HTTPS) and not on port 80, enforced by SELinux. Which SELinux boolean should be set to allow Apache to use port 443?

Question 74mediummultiple choice

Read the full Security explanation →

An administrator needs to generate a self-signed certificate and private key for a web server. Which openssl command accomplishes this?

Question 75easymultiple choice

Read the full Security explanation →

Which file contains the hashed passwords and password aging information for user accounts?

Question 76mediummultiple choice

Read the full network assurance explanation →

A security policy requires that system logs be rotated weekly and kept for 4 weeks. Which configuration file should be modified to achieve this for /var/log/syslog?

Question 77hardmultiple choice

Read the full Security explanation →

An administrator is troubleshooting an AppArmor profile that is blocking a custom application. They want to set the profile to complain mode to gather violations without enforcing. Which command should they use?

Question 78mediummulti select

Read the full Security explanation →

A Linux administrator needs to configure sudo access for members of the 'wheel' group to run any command. Which two steps are required? (Choose TWO.)

Question 79mediummulti select

Read the full Security explanation →

An administrator wants to harden SSH access by implementing the following: disallow root login, disable password authentication, and limit the number of authentication attempts. Which three configuration directives should be set in /etc/ssh/sshd_config? (Choose THREE.)

Question 80hardmulti select

Read the full Security explanation →

A security audit reveals that a service is running with an incorrect SELinux context. Which two commands can be used to relabel the file or directory to the correct context? (Choose TWO.)

Question 81easymultiple choice

Read the full Security explanation →

A Linux administrator needs to add a new user named 'jdoe' with a home directory and bash shell. Which command accomplishes this?

Question 82easymultiple choice

Read the full Security explanation →

An administrator wants to force a password change for user 'alice' on next login. Which command is appropriate?

Question 83mediummultiple choice

Read the full Security explanation →

A system administrator needs to configure sudo so that members of the 'wheel' group can execute any command without a password. Which line should be added to /etc/sudoers (using visudo)?

Question 84mediummultiple choice

Read the full Security explanation →

A security analyst notices repeated failed login attempts on a Linux server. They want to lock the account after 3 failed attempts using PAM. Which PAM module should be configured in /etc/pam.d/sshd or /etc/pam.d/system-auth?

Question 85mediummultiple choice

Read the full Security explanation →

A web server running on port 8080 must be accessible from external networks. The system uses firewalld. Which command opens port 8080/tcp permanently in the default zone?

Question 86hardmultiple choice

Read the full Security explanation →

A Linux server has SELinux enforcing and a custom application needs to write to /var/log/app.log. The audit log shows 'avc: denied { write } for pid=1234'. After verifying that the application runs in the correct domain, which command should be used to allow the write access by generating a policy module?

Question 87hardmultiple choice

Read the full Security explanation →

An administrator needs to ensure that only users from the 'ops' group can SSH into a server. Which configuration in /etc/ssh/sshd_config accomplishes this?

Question 88mediummultiple choice

Read the full Security explanation →

A system administrator wants to monitor changes to the /etc/passwd file using auditd. Which auditctl command sets up a watch on this file?

Question 89mediummultiple choice

Read the full Security explanation →

A user reports being unable to log in because the password is locked. The administrator needs to unlock the account. Which command should be used?

Question 90easymultiple choice

Read the full Security explanation →

Which command displays the current SELinux mode?

Question 91hardmultiple choice

Read the full Security explanation →

An administrator needs to generate a self-signed certificate and private key for an internal web server. Which OpenSSL command creates both in one step?

Question 92mediummultiple choice

Read the full Security explanation →

A system administrator wants to limit the number of simultaneous logins for a user to 2. Which file and parameter should be configured?

Question 93easymulti select

Read the full Security explanation →

Which TWO commands can be used to lock a user account? (Choose two.)

Question 94mediummulti select

Read the full Security explanation →

An administrator needs to harden SSH access. Which TWO settings in /etc/ssh/sshd_config are recommended to improve security? (Choose two.)

Question 95hardmulti select

Read the full Security explanation →

A security audit reveals that a Linux system allows password-based SSH logins and has weak password policies. Which THREE actions should the administrator take to improve security? (Choose three.)

Question 96easymultiple choice

Read the full Security explanation →

A Linux administrator wants to prevent users from reusing their last five passwords. Which PAM module should be configured?

Question 97easymultiple choice

Read the full Security explanation →

A technician needs to ensure a service can listen on TCP port 8443 using firewalld. Which command permanently adds the port to the default zone?

Question 98mediummultiple choice

Read the full Security explanation →

A security audit reveals that the /etc/shadow file is readable by all users. What is the most appropriate immediate action?

Question 99mediummultiple choice

Read the full Security explanation →

An administrator wants to allow user 'jane' to run all commands as root via sudo without a password. Which line should be added to /etc/sudoers?

Question 100mediummultiple choice

Read the full Security explanation →

A file on an SELinux-enabled system has the security context 'unconfined_u:object_r:httpd_sys_content_t:s0'. A web server needs to read it, but it is being denied. Which command changes the context to allow access?

Question 101mediummultiple choice

Read the full Security explanation →

A system administrator needs to monitor file access attempts to /etc/shadow using auditd. Which auditctl command sets up the watch?

Question 102hardmultiple choice

Read the full Security explanation →

After modifying a PAM configuration file for sshd, a user reports they cannot log in. Which command can be used to verify the syntax of the PAM configuration without affecting running services?

Question 103hardmultiple choice

Read the full Security explanation →

An administrator needs to generate a self-signed certificate valid for 365 days with a 2048-bit RSA key. Which OpenSSL command correctly creates both the private key and certificate in one step?

Question 104easymultiple choice

Read the full Security explanation →

Which file contains the password aging information such as minimum and maximum days between password changes?

Question 105mediummultiple choice

Read the full Security explanation →

A security team wants to restrict SSH access to only users in the 'sshusers' group. Which configuration line in /etc/ssh/sshd_config achieves this?

Question 106hardmultiple choice

Read the full Security explanation →

An administrator notices that an AppArmor profile is in complain mode for a service that should be enforcing. Which command changes the profile to enforce mode?

Question 107easymultiple choice

Read the full Security explanation →

Which command displays the current SELinux mode?

Question 108mediummulti select

Read the full Security explanation →

A security audit has identified that several users have excessive sudo privileges. The administrator needs to review and modify sudo access. Which two files or commands would be used? (Choose TWO.)

Question 109hardmulti select

Read the full Security explanation →

An administrator is configuring a firewall using iptables to block all incoming traffic except SSH on port 22. Which three rules correctly implement this? (Choose THREE.)

Question 110mediummulti select

Read the full Security explanation →

A Linux administrator needs to implement password complexity rules requiring at least one uppercase letter, one digit, and a minimum length of 10 characters. Which two PAM configuration entries would be used? (Choose TWO.)

Question 111easymultiple choice

Read the full Security explanation →

A Linux administrator needs to add a new user named 'jdoe' with a home directory and default shell /bin/bash. Which command should be used?

Question 112mediummultiple choice

Read the full Security explanation →

A security policy requires that users cannot reuse any of their last 5 passwords. Which PAM module and configuration directive enforces this?

Question 113hardmultiple choice

Read the full Security explanation →

An administrator notices that a custom application uses port 8443/TCP. To allow external access, which firewalld command permanently opens this port in the default zone?

Question 114mediummultiple choice

Read the full Security explanation →

A Linux server fails to boot after an administrator edits /etc/selinux/config and sets SELINUX=disabled. What is the most likely reason for the boot failure?

Question 115mediummultiple choice

Read the full Security explanation →

A system administrator needs to ensure that the Apache web server can read files in /var/www/html, which has the SELinux context httpd_sys_content_t. However, Apache is unable to access the files. What command should be used to apply the correct context to the directory and its contents?

Question 116easymultiple choice

Read the full Security explanation →

Which of the following correctly describes the purpose of the /etc/shadow file?

Question 117hardmultiple choice

Read the full Security explanation →

An administrator configures /etc/ssh/sshd_config with the following settings: PermitRootLogin no, PasswordAuthentication no, AllowUsers alice bob, MaxAuthTries 2. After restarting sshd, which of the following is true?

Question 118mediummultiple choice

Read the full Security explanation →

A security audit reveals that the system's PAM configuration does not enforce password complexity. Which PAM module and configuration line should be added to /etc/pam.d/common-password to require at least one uppercase letter, one digit, and a minimum length of 12 characters?

Question 119easymultiple choice

Read the full Security explanation →

Which command displays the current SELinux mode (e.g., enforcing, permissive, disabled)?

Question 120hardmultiple choice

Read the full Security explanation →

An administrator runs 'auditctl -w /etc/passwd -p wa -k passwd_changes' to monitor changes to /etc/passwd. Which command should be used to search the audit log for all events related to this watch?

Question 121mediummulti select

Read the full Security explanation →

A Linux engineer needs to harden SSH access. Which TWO of the following settings should be configured in /etc/ssh/sshd_config to enhance security? (Select TWO.)

Question 122hardmulti select

Read the full Security explanation →

A system administrator is configuring PAM to lock out users after 3 failed login attempts for 15 minutes. Which TWO PAM modules can be used together to achieve this? (Select TWO.)

Question 123easymulti select

Read the full Security explanation →

Which THREE of the following commands are used to manage iptables rules? (Select THREE.)

Question 124mediummulti select

Read the full Security explanation →

A security analyst is investigating a potential breach and needs to examine user login history. Which THREE commands or log files provide information about user logins? (Select THREE.)

Question 125hardmulti select

Read the full Security explanation →

An administrator is configuring sudo access for a group of developers. They should be able to run any command as root, but only after authenticating with their own password. Which TWO configuration lines in /etc/sudoers would achieve this? (Select TWO.)