XK0-006 Security Practice Test 10 — 15 Questions

Question 1

A technician needs to ensure a service can listen on TCP port 8443 using firewalld. Which command permanently adds the port to the default zone?

Accepted Answer

firewall-cmd --add-port=8443/tcp --permanent. The correct syntax is firewall-cmd --add-port=8443/tcp --permanent. The other options either omit the protocol, use incorrect syntax, or forget --permanent.

Answer

firewall-cmd --add-port=8443 --permanent

Answer

firewall-cmd --add-port=8443/tcp

Answer

firewall-cmd --add-service=8443/tcp --permanent

Question 2

An administrator needs to generate a self-signed certificate valid for 365 days with a 2048-bit RSA key. Which OpenSSL command correctly creates both the private key and certificate in one step?

Accepted Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes. The command 'openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes' generates a new 2048-bit RSA private key and a self-signed certificate in one step. The -x509 option outputs a self-signed certificate instead of a certificate request, and -nodes ensures the private key is not encrypted. This matches the requirement to create both the private key and certificate simultaneously.

Answer

openssl x509 -req -in req.pem -signkey key.pem -out cert.pem -days 365

Answer

openssl ca -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

Answer

openssl genrsa -out key.pem 2048 && openssl req -new -x509 -key key.pem -out cert.pem -days 365

Question 3

Which file contains the password aging information such as minimum and maximum days between password changes?

Accepted Answer

/etc/shadow. The /etc/shadow file stores encrypted password hashes along with password aging fields: the date of last password change, minimum days before change allowed, maximum days the password is valid, warning days before expiration, inactivity days, and account expiration date. These aging parameters are set by chage or passwd and are enforced by PAM. /etc/passwd no longer stores password hashes on modern systems and does not contain aging fields.

Answer

/etc/security/limits.conf

Answer

/etc/passwd

Answer

/etc/login.defs

Question 4

A security team wants to restrict SSH access to only users in the 'sshusers' group. Which configuration line in /etc/ssh/sshd_config achieves this?

Accepted Answer

AllowGroups sshusers. The `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH login to users who are members of the specified group. By setting `AllowGroups sshusers`, only users in the 'sshusers' group are permitted to authenticate via SSH, meeting the security team's requirement.

Answer

DenyGroups sshusers

Answer

AllowUsers sshusers

Answer

Subsystem sftp /usr/lib/openssh/sftp-server

Question 5

An administrator notices that an AppArmor profile is in complain mode for a service that should be enforcing. Which command changes the profile to enforce mode?

Accepted Answer

aa-enforce /etc/apparmor.d/profile. The aa-enforce command is the AppArmor userspace utility that sets a profile to enforce mode, causing the kernel to actively block operations that violate the profile. Running aa-enforce /etc/apparmor.d/profile transitions the specified profile from complain (or unconfined) to enforce. This is the standard way to harden a service after testing its profile in complain mode.

Answer

apparmor_parser -r /etc/apparmor.d/profile

Answer

aa-status --enforce /etc/apparmor.d/profile

Answer

aa-complain /etc/apparmor.d/profile

Question 6

A security audit has identified that several users have excessive sudo privileges. The administrator needs to review and modify sudo access. Which two files or commands would be used? (Choose TWO.)

Accepted Answer

visudo. Option B (visudo) is correct because it is the designated command for safely editing the sudo policy: it locks the sudoers file against concurrent edits, performs syntax checking before saving, and prevents a corrupt sudoers file from breaking sudo access. Option D (/etc/sudoers) is correct because it is the primary sudo policy file that defines which users and groups may run which commands as which target users, so reviewing and modifying excessive sudo privileges requires examining and changing this file. The unmarked options do not belong: chage (A) manages password aging fields such as -M, -m, and -W, not sudo rights; usermod -G (C) changes a user's supplementary group memberships, which only indirectly affects sudo if those groups are referenced in sudoers; and /etc/group (E) lists group memberships but contains no sudo command-authorization rules.

Answer

chage

Answer

usermod -G

Answer

/etc/group

Question 7

A Linux administrator needs to add a new user named 'jdoe' with a home directory and default shell /bin/bash. Which command should be used?

Accepted Answer

useradd -m -s /bin/bash jdoe. The useradd command creates a new user account, and the -m flag creates the home directory while -s /bin/bash sets the login shell. This is the standard Linux utility for adding users with a specified home directory and shell in a single command.

Answer

chage -m -s /bin/bash jdoe

Answer

passwd -m -s /bin/bash jdoe

Answer

usermod -m -s /bin/bash jdoe

Question 8

A security policy requires that users cannot reuse any of their last 5 passwords. Which PAM module and configuration directive enforces this?

Accepted Answer

pam_pwhistory with remember=5. The pam_pwhistory module records previous password hashes and enforces password reuse restrictions via the remember directive. Setting remember=5 prevents users from reusing any of their last five passwords, exactly matching the policy requirement.

Answer

pam_faillock with deny=5

Answer

pam_tally2 with deny=5

Answer

pam_pwquality with remember=5

Question 9

An administrator notices that a custom application uses port 8443/TCP. To allow external access, which firewalld command permanently opens this port in the default zone?

Accepted Answer

firewall-cmd --add-port=8443/tcp --permanent. The correct command is firewall-cmd --permanent --add-port=8443/tcp. The --permanent flag makes it persistent, --add-port opens the port, and the syntax includes protocol. --add-service is for predefined services, not port numbers.

Answer

firewall-cmd --add-service=8443/tcp --zone=public --permanent

Answer

firewall-cmd --add-port=8443 --permanent

Answer

firewall-cmd --permanent --add-port=8443

Question 10

Which of the following correctly describes the purpose of the /etc/shadow file?

Accepted Answer

It stores encrypted passwords and password aging fields.. The /etc/shadow file stores encrypted (hashed) user passwords and password aging information such as the date of last password change, minimum/maximum password age, and account expiration. This file is readable only by root to protect password hashes from unauthorized access, unlike /etc/passwd which is world-readable.

Answer

It stores the list of users who can use sudo.

Answer

It stores group memberships and group passwords.

Answer

It stores user account information including UID, GID, and shell.

Question 11

An administrator configures /etc/ssh/sshd_config with the following settings: PermitRootLogin no, PasswordAuthentication no, AllowUsers alice bob, MaxAuthTries 2. After restarting sshd, which of the following is true?

Accepted Answer

User bob can log in using a public key.. PasswordAuthentication no disables password logins, so public key authentication is required. PermitRootLogin no prevents root login entirely. AllowUsers restricts to alice and bob only. MaxAuthTries 2 limits authentication attempts. So root cannot log in even with keys, and alice/bob must use keys.

Answer

User charlie can log in using a public key.

Answer

User alice can log in using a password.

Answer

Root can log in using a valid password.

Question 12

A security audit reveals that the system's PAM configuration does not enforce password complexity. Which PAM module and configuration line should be added to /etc/pam.d/common-password to require at least one uppercase letter, one digit, and a minimum length of 12 characters?

Accepted Answer

password requisite pam_pwquality.so minlen=12 ucredit=-1 dcredit=-1. The pam_pwquality.so module is the modern replacement for pam_cracklib.so and provides password quality enforcement. The line 'password requisite pam_pwquality.so minlen=12 ucredit=-1 dcredit=-1' correctly sets the minimum length to 12 and requires at least one uppercase letter (ucredit=-1) and one digit (dcredit=-1). The 'requisite' control ensures that if this module fails, the password change is rejected immediately.

Answer

password sufficient pam_faillock.so minlen=12 ucredit=-1 dcredit=-1

Answer

password required pam_cracklib.so minlen=12 ucredit=-1 dcredit=-1

Answer

password required pam_unix.so minlen=12 ucredit=-1 dcredit=-1

Question 13

An administrator runs 'auditctl -w /etc/passwd -p wa -k passwd_changes' to monitor changes to /etc/passwd. Which command should be used to search the audit log for all events related to this watch?

Accepted Answer

ausearch -k passwd_changes. The `ausearch -k passwd_changes` command is correct because it searches the audit log for events that were tagged with the key `passwd_changes` when the watch was created via `auditctl -w /etc/passwd -p wa -k passwd_changes`. The `-k` option in `auditctl` assigns a key to the rule, and `ausearch` uses that same key to filter and retrieve matching audit records from `/var/log/audit/audit.log`.

Answer

auditctl -l -k passwd_changes

Answer

tail -f /var/log/audit/audit.log | grep passwd_changes

Answer

aureport -k passwd_changes

Question 14

A Linux engineer needs to harden SSH access. Which TWO of the following settings should be configured in /etc/ssh/sshd_config to enhance security? (Select TWO.)

Accepted Answer

PasswordAuthentication no. Option B (PasswordAuthentication no) is correct because disabling password-based authentication forces users to authenticate with SSH key pairs, eliminating brute-force and credential-stuffing attacks against account passwords. Option E (AllowUsers alice bob) is correct because it implements an explicit allowlist, so only the named accounts alice and bob may establish SSH sessions, denying all other valid system users. The remaining options weaken security: MaxAuthTries 6 (A) is too permissive since the default of 3 limits failed attempts more tightly, Protocol 1 (C) enables the obsolete and cryptographically broken SSH-1 protocol, and PermitRootLogin yes (D) allows direct root logins, which should be set to no or prohibit-password.

Answer

MaxAuthTries 6

Answer

Protocol 1

Answer

PermitRootLogin yes

Question 15

A security analyst is investigating a potential breach and needs to examine user login history. Which THREE commands or log files provide information about user logins? (Select THREE.)

Accepted Answer

last. The `last` command (A) reads /var/log/wtmp and displays a chronological list of all successful user logins, logouts, and system reboots, making it a primary tool for reviewing login history. The `lastlog` command (B) reads /var/log/lastlog and reports the most recent login for every user account, which is useful for spotting accounts that have never logged in or that logged in unexpectedly. The `lastb` command (C) reads /var/log/btmp and lists failed login attempts, which is essential when investigating a potential breach involving brute-force or unauthorized access attempts. Options D and E are incorrect because /var/log/syslog and /var/log/messages are general-purpose system logs that capture a broad mix of kernel, service, and application messages; while they may incidentally contain authentication-related entries, they are not dedicated login-history sources like wtmp, lastlog, and btmp.

Answer

/var/log/syslog

Answer

/var/log/messages