XK0-006 Security Practice Test 2 — 15 Questions

Question 1

A technician needs to generate a self-signed certificate for an internal web server. Which OpenSSL command creates a new private key and a certificate signing request (CSR) in one step?

Accepted Answer

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr. openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr creates both key and CSR.

Answer

openssl req -x509 -newkey rsa:2048 -nodes -keyout server.key -out server.crt

Answer

openssl genrsa -out server.key 2048 && openssl req -new -key server.key -out server.csr

Answer

openssl ca -new -key server.key -out server.csr

Question 2

An administrator notices that a process is running with the context 'unconfined_u:unconfined_r:unconfined_t:s0'. What does this indicate about SELinux?

Accepted Answer

The process is running in an unconfined domain.. The 'unconfined' domain means the process is not restricted by SELinux policy; it can run as if SELinux is disabled.

Answer

The process is running in permissive mode.

Answer

SELinux is disabled.

Answer

The process is confined by a targeted policy.

Question 3

A security policy requires that user passwords must be changed every 60 days, and users should be warned 7 days before expiration. Which two chage commands set these requirements for user 'jsmith'? (Choose TWO.)

Accepted Answer

chage -M 60 jsmith. chage -M 60 sets max days; chage -W 7 sets warning days.

Answer

chage -E 60 jsmith

Answer

chage -m 60 jsmith

Answer

chage -I 7 jsmith

Question 4

An administrator is configuring iptables on a server. The requirements are: allow incoming SSH (port 22) from the 192.168.1.0/24 network, drop all other incoming traffic, and allow all outgoing traffic. Which three iptables rules achieve this? (Choose THREE.)

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT. Default policies: INPUT DROP, OUTPUT ACCEPT. Then allow SSH from subnet.

Answer

iptables -P FORWARD ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Question 5

A Linux administrator is troubleshooting a firewall issue using nftables. The ruleset is complex. Which two commands are useful for listing the current ruleset and adding a new rule? (Choose TWO.)

Accepted Answer

nft list ruleset. `nft list ruleset` is the standard command to display the entire current nftables ruleset in a human-readable format, which is essential for troubleshooting complex firewall configurations. Option C is correct because `nft add rule inet filter input tcp dport 443 accept` is the proper syntax to append a new rule to the specified chain (here, the 'input' chain of the 'filter' table in the 'inet' family) that accepts TCP traffic on port 443.

Answer

nft insert rule

Answer

nft show ruleset

Answer

nft -a list ruleset

Question 6

A Linux administrator needs to ensure that user passwords expire after 90 days. Which command should be used to enforce this policy?

Accepted Answer

chage -M 90 username. The `chage -M 90 username` command sets the maximum number of days a password is valid before it must be changed, enforcing a 90-day expiration policy. This directly modifies the `PASS_MAX_DAYS` field in `/etc/shadow` for the specified user, which the system checks during authentication.

Answer

passwd -x 90 username

Answer

passwd -e 90 username

Answer

usermod -e 90 username

Question 7

A security auditor notices that a service account's password never expires. The company policy requires password rotation every 60 days. Which command will enforce this policy for the service account?

Accepted Answer

chage -M 60 serviceacct && chage -d 0 serviceacct. chage -M 60 sets the maximum password age to 60 days. To also force a password change on next login, use -d 0.

Answer

chage -W 7 serviceacct

Answer

usermod -e 60 serviceacct

Answer

passwd -n 60 serviceacct

Question 8

An administrator wants to restrict SSH access to only users in the 'sshusers' group. Which configuration directive should be added to /etc/ssh/sshd_config?

Accepted Answer

AllowGroups sshusers. The AllowGroups directive in sshd_config restricts SSH access to users who are members of the specified group(s).

Answer

AllowUsers sshusers

Answer

Match Group sshusers

Answer

DenyGroups all

Question 9

A system administrator needs to configure PAM to lock a user account after 5 failed login attempts for 15 minutes. Which two PAM modules and configuration lines are appropriate? (Select TWO.)

Accepted Answer

auth required pam_tally2.so deny=5 unlock_time=900. pam_faillock can be used to lock accounts after failed attempts. The 'deny' option sets the threshold, and 'unlock_time' sets the lockout duration. Alternatively, pam_tally2 can be used with similar options.

Answer

session required pam_limits.so

Answer

account required pam_faillock.so deny=5 unlock_time=900

Answer

password required pam_pwquality.so retry=5

Question 10

A security policy requires that all users must have passwords with at least one uppercase letter, one digit, and a minimum length of 12 characters. Which PAM configuration file and module should be used to enforce this?

Accepted Answer

/etc/pam.d/common-password with pam_pwquality.so. pam_pwquality is used for password complexity requirements. It is typically configured in /etc/pam.d/common-password (or system-auth, password-auth) with options like minlen, ucredit, dcredit.

Answer

/etc/pam.d/login with pam_securetty.so

Answer

/etc/pam.d/sshd with pam_unix.so

Answer

/etc/pam.d/sudo with pam_permit.so

Question 11

A Linux technician is configuring a firewall with firewalld. The organization requires that SSH services be available only on the internal network zone (10.0.0.0/8). Which command should be used to add this rule permanently?

Accepted Answer

firewall-cmd --zone=internal --add-service=ssh --add-source=10.0.0.0/8 --permanent. Option D is correct because it uses --add-service=ssh to allow the SSH service and --add-source to restrict the source to 10.0.0.0/8, making the rule permanent. This follows best practices by leveraging service definitions. Option A opens port 22 directly, which works but is less precise and not service-aware. Option C uses a rich rule, which is overly complex for this straightforward requirement. Option B targets the public zone, which is incorrect.

Answer

firewall-cmd --zone=internal --add-port=22/tcp --add-source=10.0.0.0/8 --permanent

Answer

firewall-cmd --zone=public --add-service=ssh --add-source=10.0.0.0/8 --permanent

Answer

firewall-cmd --zone=internal --add-rich-rule='rule family=ipv4 source address=10.0.0.0/8 service name=ssh accept' --permanent

Question 12

A server running nftables has a rule set that allows incoming SSH from the management network (192.168.1.0/24). An administrator needs to insert a rule to drop SSH from all other sources. Which nft command accomplishes this? Assume the input chain is 'input' and the table is 'inet filter'.

Accepted Answer

nft add rule inet filter input ip saddr != 192.168.1.0/24 tcp dport 22 drop. The correct command is A. The existing rule allows SSH from 192.168.1.0/24. To drop SSH from all other sources, we need a rule that matches packets with source IP address not in that subnet and destination port 22, and then drops them. The `add rule` subcommand appends the rule to the chain, which is appropriate because the allow rule for the management network should remain first. Using `ip saddr != 192.168.1.0/24` properly negates the source subnet. Option B drops SSH from any source (including the management network), which would block the allowed traffic. Option C replaces an existing rule by handle but does not specify the source condition. Option D accepts SSH from all sources, which is not desired. Therefore, A is correct.

Answer

nft insert rule inet filter input tcp dport 22 drop

Answer

nft replace rule inet filter input handle 1 tcp dport 22 drop

Answer

nft add rule inet filter input tcp dport 22 accept

Question 13

An administrator needs to configure SELinux to allow the Apache HTTP server to connect to a database server. Which SELinux boolean should be enabled?

Accepted Answer

httpd_can_network_connect_db. The SELinux boolean `httpd_can_network_connect_db` specifically allows the Apache HTTP server to make outbound TCP connections to database servers (e.g., MySQL, PostgreSQL). This is required when a web application needs to query a remote database. The other booleans control different aspects of httpd's behavior and do not grant network connectivity to databases.

Answer

httpd_can_network_connect

Answer

httpd_enable_cgi

Answer

httpd_use_nfs

Question 14

A file named 'webapp.conf' is being served by Apache but users get a 'Permission denied' error. The SELinux context of the file is 'unconfined_u:object_r:admin_home_t:s0'. What is the most appropriate command to fix the SELinux context?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t webapp.conf && restorecon -v webapp.conf. The most appropriate command. It adds a persistent SELinux file context rule with semanage fcontext and then applies it with restorecon, ensuring the correct type (httpd_sys_content_t) is set and preserved across system relabeling. Option D (restorecon alone) may not work if the file's path lacks a default mapping in the SELinux policy, making it unreliable for non-standard locations. Therefore, only A fully addresses the requirement for a permanent and reliable fix.

Answer

setenforce 0

Answer

chcon -t httpd_sys_content_t webapp.conf

Answer

restorecon -v webapp.conf

Question 15

An administrator notices repeated failed login attempts in /var/log/secure. The company policy requires account lockout after 5 failed attempts within 15 minutes. Which PAM module and configuration can enforce this?

Accepted Answer

pam_faillock.so with deny=5 unlock_time=900. Pam_faillock.so is the PAM module specifically designed to track failed login attempts and enforce account lockout policies. The `deny=5` parameter sets the threshold to 5 failures, and `unlock_time=900` sets the lockout duration to 900 seconds (15 minutes), matching the policy requirement exactly.

Answer

pam_unix.so with remember=5

Answer

pam_pwquality.so with minlen=5

Answer

pam_limits.so with maxlogins=5