XK0-006 Security Practice Test 11 — 15 Questions

Question 1

A Linux administrator wants to harden a server against brute-force attacks. They decide to use fail2ban to monitor SSH authentication failures. After installing and enabling the fail2ban service, they need to verify that the SSH jail is active and correctly configured. Which command should they use to check the current status of the sshd jail?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

fail2ban-client status sshd. To verify that the sshd jail is active and functioning, the administrator should use fail2ban-client status sshd. This command queries the running fail2ban server and returns details such as the number of failed attempts, banned IPs, and total bans for that specific jail. It is the definitive way to confirm the jail's operational status after configuration.

Answer

fail2ban-client -v

Answer

systemctl status fail2ban

Answer

cat /etc/fail2ban/jail.conf

Question 2

A Linux administrator needs to grant the user 'jsmith' the ability to restart the httpd service without entering a password, while preventing all other sudo commands. The administrator creates the file /etc/sudoers.d/jsmith with the line: jsmith ALL=(root) NOPASSWD: /usr/bin/systemctl restart httpd. After saving the file, jsmith reports that sudo still prompts for a password. Which command should the administrator run to diagnose the issue?

Accepted Answer

sudo -l -U jsmith. The sudo -l -U jsmith command displays the sudo privileges for jsmith, including whether NOPASSWD is applied to the specified command. This directly shows if the rule in /etc/sudoers.d/jsmith is being read and matched, which is essential for troubleshooting why a password is still required.

Answer

journalctl -u sudo

Answer

visudo -c

Answer

grep jsmith /etc/sudoers

Question 3

A Linux administrator needs to inspect the capabilities assigned to the /usr/bin/ping binary to verify it can open raw sockets without being setuid root. Which command should be used?

Accepted Answer

getcap /usr/bin/ping. File capabilities allow a binary to perform privileged operations without being setuid root. The getcap command reads the security.capability extended attribute and reports capabilities such as cap_net_raw. Inspecting /usr/bin/ping with getcap confirms whether it can open raw sockets under least privilege, which is the goal of the administrator's verification.

Answer

chacl -l /usr/bin/ping

Answer

getfacl /usr/bin/ping

Answer

lsattr /usr/bin/ping

Question 4

A security administrator is hardening a Linux server that uses firewalld. The server hosts a web application that must be accessible only from the internal network 192.168.1.0/24 on port 443. The administrator wants to implement this using a rich rule in the public zone and ensure it persists across reboots. Which sequence of commands should the administrator use?

Accepted Answer

firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="443" protocol="tcp" accept' && firewall-cmd --reload. Using a rich rule with --permanent allows granular control, specifying source address, port, and protocol in one rule. The subsequent reload applies the permanent configuration to the runtime environment. This meets the requirement of restricting access to the internal subnet on port 443 and ensuring persistence.

Answer

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="443" protocol="tcp" accept' && firewall-cmd --runtime-to-permanent

Answer

firewall-cmd --permanent --zone=public --add-service=https && firewall-cmd --reload

Answer

firewall-cmd --permanent --zone=public --add-source=192.168.1.0/24 --add-port=443/tcp && firewall-cmd --reload

Question 5

A security engineer must ensure that a new SSH host key is generated using the Ed25519 algorithm and stored in the default location. Which command accomplishes this?

Accepted Answer

ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key. Host keys are generated with ssh-keygen using -t to select the algorithm and -f to specify the output file. For an Ed25519 host key in the default location, the correct invocation is ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key. This ensures sshd will find and use the key without additional configuration.

Answer

ssh-keygen -A

Answer

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519

Answer

ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key

Question 6

A Linux administrator needs to configure the system so that all users must use a minimum password length of 12 characters. The administrator edits /etc/security/pwquality.conf. Which line should be added or modified to enforce this requirement?

Accepted Answer

minlen = 12. The pwquality.conf file uses the minlen directive to set the minimum password length. Adding minlen = 12 ensures that the pam_pwquality module enforces a 12-character minimum for new passwords, provided the module is enabled in the PAM configuration.

Answer

password requisite pam_pwquality.so minlen=12

Answer

min_password_length = 12

Answer

PASS_MIN_LEN 12

Question 7

A Linux server has SELinux enabled. An administrator wants to temporarily set the SELinux mode to permissive without rebooting, then confirm the change. Which command should be used?

Accepted Answer

setenforce 0. The setenforce command changes the SELinux mode at runtime. Passing 0 selects permissive mode, where denials are logged but not enforced. This satisfies the requirement to switch temporarily without rebooting. Persistent changes require editing /etc/selinux/config, but the scenario explicitly asks for a runtime change.

Answer

setsebool -P httpd_can_network_connect on

Answer

semanage permissive -a httpd_t

Answer

restorecon -R /

Question 8

A junior administrator needs to check whether a user account named 'bob' is locked and view the password aging information. Which command should be used?

Accepted Answer

passwd -S bob. The passwd -S command reports the password status for a user, indicating locked, no password, or usable states, and includes aging data. This single command lets the administrator verify lock status and review password aging, which matches the scenario's need for inspection without modifying the account.

Answer

usermod -L bob

Answer

chage -l bob

Answer

id bob

Question 9

A Linux administrator wants to allow the web server (httpd) to bind to a non-standard port, TCP 8080, without disabling SELinux. The system is running SELinux in enforcing mode. Which command should the administrator run to permanently allow httpd to listen on TCP port 8080?

Accepted Answer

semanage port -a -t http_port_t -p tcp 8080. To allow httpd to listen on TCP port 8080 in enforcing mode, the port must be added to the http_port_t SELinux type using semanage port -a. This is persistent and does not require disabling SELinux. Modifying an existing port definition is only for reassigning a port that is already defined, and boolean or file context changes do not affect port bindings.

Answer

semanage port -m -t http_port_t -p tcp 8080

Answer

chcon -t http_port_t /etc/httpd/conf/httpd.conf

Answer

setsebool -P httpd_can_network_connect 1

Question 10

A security administrator is hardening a Linux web server and wants to reduce the attack surface of the SSH service. Which TWO actions should be taken in /etc/ssh/sshd_config to restrict access and authentication? (Choose two.)

Accepted Answer

Set PermitRootLogin to no. Disabling root login and password authentication are two widely recommended SSH hardening measures. They force administrators to use named accounts and key-based authentication, reducing the effectiveness of brute-force and credential-stuffing attacks. The other listed changes either increase exposure or weaken authentication controls, so they do not support the goal of reducing the SSH attack surface.

Answer

Set MaxAuthTries to 10

Answer

Set UsePAM to no

Answer

Set X11Forwarding to yes

Question 11

A Linux administrator is implementing mandatory access control using AppArmor on an Ubuntu server. A custom web application profile is loaded in enforce mode, but the application is failing to write to /var/log/myapp/. The administrator wants to temporarily switch the profile to complain mode to diagnose the issue without disabling AppArmor entirely. Which command should be used?

Accepted Answer

aa-complain /etc/apparmor.d/usr.bin.myapp. Switching an AppArmor profile to complain mode is done with aa-complain, which changes the profile's mode so that policy violations are logged rather than denied. This allows the application to function while capturing the necessary audit data to refine the profile. The other commands either unload the profile, disable it permanently, or merely display status, none of which achieve temporary diagnostic logging.

Answer

aa-disable /etc/apparmor.d/usr.bin.myapp

Answer

aa-status --enforce /etc/apparmor.d/usr.bin.myapp

Answer

apparmor_parser -R /etc/apparmor.d/usr.bin.myapp

Question 12

A security administrator needs to configure a Linux server so that all users must use a password of at least 12 characters and include at least one uppercase letter, one lowercase letter, one digit, and one special character. Which file should be edited to enforce these requirements?

Accepted Answer

/etc/security/pwquality.conf. Password complexity requirements are enforced by the pam_pwquality PAM module, which reads its settings from /etc/security/pwquality.conf. This file allows administrators to set minimum length and required character classes globally. Other files like login.defs or system-auth serve different purposes and do not contain the specific parameters for password composition.

Answer

/etc/login.defs

Answer

/etc/shadow

Answer

/etc/pam.d/system-auth

Question 13

A security administrator is hardening a Linux server and wants to verify that the SSH daemon is configured to disallow direct root logins. The administrator has already edited /etc/ssh/sshd_config and set PermitRootLogin no. Which command should the administrator run to ensure the SSH daemon reloads the configuration without terminating existing SSH sessions?

Accepted Answer

systemctl reload sshd. Reloading the sshd service with systemctl reload sshd causes the daemon to re-read its configuration file without dropping existing connections, which is ideal when applying changes like PermitRootLogin no. Testing the syntax with sshd -t is good practice beforehand, but it does not activate the new setting. Restarting would disrupt sessions, and direct kill is less reliable than the systemd-managed reload.

Answer

sshd -t

Answer

systemctl restart sshd

Answer

kill -HUP $(pidof sshd)

Question 14

A security team wants to harden a Linux server against unauthorized access. They need to restrict which users can authenticate via SSH and ensure that only key-based authentication is allowed for a specific group. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Use AllowGroups sshusers in /etc/ssh/sshd_config to limit SSH access to members of the sshusers group.. Disabling PasswordAuthentication enforces key-based logins, and AllowGroups restricts SSH access to a defined set of users. Together they meet the hardening goals. The other options either weaken security, add unrelated controls, or grant unnecessary privileges. Restarting sshd after changes is required for them to take effect.

Answer

Configure PAM to require two-factor authentication for all SSH sessions.

Answer

Add all users to the wheel group and set UsePAM yes in sshd_config.

Answer

Set PermitRootLogin yes in /etc/ssh/sshd_config to allow administrative access.

Question 15

A Linux administrator is hardening a server that runs a custom application. The security team requires that the system enforce password complexity and account lockout policies. The administrator decides to use PAM. Which TWO modules should be added to the appropriate PAM configuration files to enforce these requirements? (Choose two.)

Accepted Answer

pam_faillock.so. To enforce password complexity, pam_pwquality.so is the standard module, checking password strength against configured criteria. For account lockout, pam_faillock.so is the modern replacement for pam_tally2.so, tracking failed attempts and locking accounts after a threshold. Together, they meet the security team's requirements when placed in the correct PAM stacks.

Answer

pam_unix.so

Answer

pam_tally2.so

Answer

pam_limits.so