XK0-006 Security Practice Test 12 — 15 Questions

Question 1

A Linux administrator is configuring a server that must meet strict security guidelines. The server uses firewalld and should drop all incoming traffic on the public zone by default, but allow outgoing SSH connections initiated by the server itself to a remote management host. Which firewalld configuration should the administrator apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the target of the public zone to DROP, and ensure the default outbound behavior allows SSH to the remote host.. The public zone target DROP ensures all incoming traffic is silently discarded unless explicitly allowed. Outgoing traffic is not filtered by firewalld zones, so SSH connections initiated by the server are allowed by default. Adding inbound service rules or using REJECT would violate the drop requirement or send rejection messages.

Answer

Set the target of the public zone to DROP, and add a rich rule to allow outbound SSH to the remote host.

Answer

Set the target of the public zone to %%REJECT%%, and create a direct rule to allow outgoing SSH to the remote host.

Answer

Set the target of the public zone to DROP, and add a service rule for ssh to the public zone.

Question 2

A compliance auditor requires that a Linux server's /home directory be mounted with options that prevent users from executing setuid binaries stored there and from creating device files. The administrator is editing /etc/fstab for the /home entry. Which TWO mount options should be added to meet these requirements? (Choose two.)

Accepted Answer

nosuid. The nosuid option blocks execution of setuid and setgid binaries, and nodev blocks the use of device files on the filesystem. Together they harden /home against privilege escalation and device-based attacks without preventing normal file storage. noexec, noatime, and ro either do not target the stated risks or impose excessive functional restrictions that the auditor did not request.

Answer

noatime

Answer

ro

Answer

noexec

Question 3

A Linux administrator is configuring a server that must meet strict security guidelines. The server uses firewalld and should drop all incoming traffic on the public zone by default, but allow outgoing SSH connections initiated by the server itself to a remote management host. Which firewalld configuration should the administrator apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

openssl s_client -connect ldap.example.com:636 -showcerts. The openssl s_client command is designed to test TLS connections, making it ideal for verifying the LDAP server's certificate and handshake on the LDAPS port. It displays the certificate chain and any errors, ensuring that the encryption is correctly configured. Other commands either connect without encryption, check only for listening sockets, or do not validate the certificate in the LDAP context.

Answer

ss -tlnp | grep 636

Answer

nmap --script ssl-enum-ciphers -p 389 ldap.example.com

Answer

ldapsearch -H ldap://ldap.example.com -x -b '' -s base

Question 4

A junior administrator is asked to verify that the integrity of a downloaded package file has not been altered in transit. The vendor publishes a SHA-256 checksum file alongside the package. Which command should the administrator run to compare the computed hash of the downloaded file against the published value?

Accepted Answer

sha256sum package.rpm. The sha256sum utility computes the SHA-256 digest of a file, allowing a direct comparison with the vendor's published checksum to confirm the download was not altered. The other commands either use a different algorithm, require signature artifacts not provided, or verify RPM signatures rather than a standalone hash file.

Answer

rpm --checksig package.rpm

Answer

md5sum package.rpm

Answer

gpg --verify package.rpm

Question 5

A Linux administrator is configuring a server that must meet strict security guidelines. The server uses firewalld and should drop all incoming traffic on the public zone by default, but allow outgoing SSH connections initiated by the server itself to a remote management host. Which firewalld configuration should the administrator apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

pam_sss with caching enabled in SSSD. SSSD with caching enabled provides offline authentication by storing credentials locally. The pam_sss module integrates with SSSD, and when the central server is down, SSSD uses its cache to validate credentials. Other modules like pam_unix only handle local accounts, and pam_ccreds is deprecated.

Answer

pam_ccreds

Answer

pam_unix

Answer

pam_sss

Question 6

A Linux administrator needs to ensure that user passwords meet a minimum length requirement of 12 characters. The system uses PAM and the pam_pwquality module. Which file should the administrator edit to set the minlen parameter?

Accepted Answer

/etc/security/pwquality.conf. The pam_pwquality module's parameters, including minlen, are configured in /etc/security/pwquality.conf. This centralized file is read by the module whenever a password is set or changed, provided the PAM stack includes pam_pwquality. Other files like login.defs may contain password aging settings but do not control PAM-based quality checks.

Answer

/etc/pam.d/system-auth

Answer

/etc/security/limits.conf

Answer

/etc/login.defs

Question 7

A Linux administrator needs to ensure that all user passwords meet a minimum length of 12 characters and include at least one uppercase letter, one lowercase letter, one digit, and one special character. Which file should be edited to enforce these password complexity requirements?

Accepted Answer

/etc/security/pwquality.conf. Password complexity requirements are enforced by the pam_pwquality module, which reads its configuration from /etc/security/pwquality.conf. This file allows setting parameters like minlen, ucredit, lcredit, dcredit, and ocredit to require specific character types and lengths. The other files serve different purposes and cannot enforce these rules.

Answer

/etc/pam.d/system-auth

Answer

/etc/login.defs

Answer

/etc/shadow

Question 8

A Linux administrator is configuring a server that must meet strict security guidelines. The server uses firewalld and should drop all incoming traffic on the public zone by default, but allow outgoing SSH connections initiated by the server itself to a remote management host. Which firewalld configuration should the administrator apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="8080" protocol="tcp" accept'. Rich rules in firewalld allow combining source addresses, ports, and actions in a single rule. The correct syntax uses --add-rich-rule with a rule that specifies source address, port, protocol, and accept action. This precisely allows TCP 8080 from 192.168.1.0/24. Adding a port with a source argument is not supported, and adding a source to a zone does not restrict individual ports.

Answer

firewall-cmd --permanent --add-source=192.168.1.0/24 --add-port=8080/tcp

Answer

firewall-cmd --permanent --add-port=8080/tcp --source=192.168.1.0/24

Answer

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="8080" protocol="tcp" drop'

Question 9

A Linux administrator is configuring an SSH server to use certificate-based authentication. The administrator has generated a CA key pair and wants to sign a user's public key. Which command should be used to sign the user's public key with the CA and produce a certificate?

Accepted Answer

ssh-keygen -s /etc/ssh/ca_key -I user_id -n username -V +52w user_key.pub. To sign a user's public key with a CA in OpenSSH, the ssh-keygen command is used with the -s flag pointing to the CA private key, -I for the key identity, -n for principals, -V for validity, and the public key file as the final argument. This produces a certificate file that can be used for authentication. The other options misuse flags like -f, omit the .pub extension, or incorrectly use -O for the public key.

Answer

ssh-keygen -s /etc/ssh/ca_key -I user_id -n username -V +52w user_key

Answer

ssh-keygen -s /etc/ssh/ca_key -I user_id -n username -V +52w -f user_key

Answer

ssh-keygen -s /etc/ssh/ca_key -I user_id -n username -V +52w -O user_key.pub

Question 10

A Linux server is configured with an IPsec VPN using strongSwan. The administrator needs to verify that the VPN tunnel is active and that traffic is being encrypted. Which command should be used to display the current status of the IPsec security associations?

Accepted Answer

ipsec statusall. The 'ipsec statusall' command is the standard tool in strongSwan to display the status of all IPsec security associations, including connection states, encryption details, and traffic counters. It provides a comprehensive overview that confirms whether the VPN tunnel is active and properly encrypting traffic, which is exactly what the administrator needs.

Answer

ss -tuln

Answer

ip xfrm state

Answer

systemctl status strongswan

Question 11

A Linux server hosts a payroll database. The security policy states that the file /srv/payroll/ledger.db must be readable and writable only by members of the group payroll, and that no other user on the system may read it, even root. Which approach satisfies the requirement that even root cannot read the file contents?

Accepted Answer

Encrypt the file with a tool such as gpg or openssl enc using a key that is never stored on the server.. Traditional Unix permissions, including restrictive modes and special attributes, are enforced by the kernel, and root is deliberately exempt from those checks. The only way to guarantee that even root cannot read a file's contents is to encrypt it and keep the decryption key off the server, shifting enforcement from the permission model to cryptography that root cannot bypass.

Answer

Set the file mode to 0660 and change its group owner to payroll.

Answer

Place the file on a filesystem mounted with the noexec and nodev options.

Answer

Apply the immutable attribute to the file with chattr +i /srv/payroll/ledger.db.

Question 12

A Linux administrator is hardening a server and needs to ensure that the system is protected against unauthorized access. The administrator wants to implement account lockout after multiple failed login attempts and enforce password complexity. Which TWO actions should the administrator take to achieve these goals? (Choose two.)

Accepted Answer

Configure the pam_faillock module in /etc/pam.d/system-auth and /etc/pam.d/password-auth to lock accounts after a specified number of failed attempts.. To implement account lockout, the pam_faillock module must be configured in the PAM system-auth and password-auth files, which enforces lockout across authentication services. To enforce password complexity, the /etc/security/pwquality.conf file must be edited to set parameters like minlen and character class requirements. Together, these actions meet both requirements.

Answer

Add the line 'auth required pam_tally2.so deny=5' to /etc/pam.d/sshd to lock accounts after five failed SSH login attempts.

Answer

Set the PASS_MAX_DAYS parameter to 90 in /etc/login.defs to enforce password expiration.

Answer

Set the UMASK value to 077 in /etc/login.defs to restrict default file permissions.

Question 13

A Linux administrator needs to grant a user named 'bob' the ability to run the /usr/bin/systemctl command as root without being prompted for a password. Which entry should be added to the sudoers file to accomplish this?

Accepted Answer

bob ALL=(ALL) NOPASSWD: /usr/bin/systemctl. The sudoers entry must specify the user, hosts, target user, the NOPASSWD tag, and the full path to the command. The line 'bob ALL=(ALL) NOPASSWD: /usr/bin/systemctl' grants exactly the intended permission without a password, while other options either require a password, lack the full path, or grant excessive privileges. Always use visudo to edit sudoers to avoid syntax errors.

Answer

bob ALL=(ALL) NOPASSWD: ALL

Answer

bob ALL=(root) NOPASSWD: systemctl

Answer

bob ALL=(ALL) PASSWD: /usr/bin/systemctl

Question 14

A Linux administrator needs to grant a user the ability to run a specific command as root without being prompted for a password, while restricting all other commands. Which file should be edited to configure this using sudo?

Accepted Answer

/etc/sudoers. The /etc/sudoers file is the standard configuration file for sudo, where administrators define user privileges and command restrictions. To allow a user to run a specific command without a password, an entry with NOPASSWD is added. This file should be edited with visudo to ensure syntax correctness. Other files like sudo.conf or PAM configurations serve different purposes and do not control command authorization.

Answer

/etc/security/access.conf

Answer

/etc/sudo.conf

Answer

/etc/pam.d/sudo

Question 15

A Linux server hosts a web application that must be able to bind to TCP port 443. The administrator has already installed the application and configured it to listen on 443. However, when the service starts, it fails with a 'Permission denied' error. The administrator confirms that no other process is using port 443 and that the service runs as the non-root user 'webapp'. Which command should the administrator use to grant the necessary capability to the service binary without giving it full root privileges?

Accepted Answer

setcap 'cap_net_bind_service=+ep' /usr/local/bin/webapp. The service runs as a non-root user and needs to bind to a privileged port (443). Linux capabilities allow fine-grained privilege assignment. The setcap command with cap_net_bind_service grants exactly the needed capability, enabling the binary to bind to low-numbered ports without full root privileges. This follows the principle of least privilege and is the standard solution for this scenario.

Answer

chmod u+s /usr/local/bin/webapp

Answer

firewall-cmd --add-port=443/tcp --permanent

Answer

usermod -aG root webapp