XK0-006 Security Practice Test 2 — 15 Questions

Question 1

An administrator is configuring AppArmor for a custom application. Which THREE commands are used to manage AppArmor profiles?

Accepted Answer

aa-status. aa-status (B) is correct because it reports the current AppArmor state, listing loaded profiles, their enforce/complain modes, and processes confined by them, which is essential for verifying profile management results. aa-complain (D) is correct because it sets a profile to complain mode, allowing the administrator to log policy violations without blocking the application while tuning the custom profile. aa-enforce (E) is correct because it switches a profile into enforce mode, actively denying operations that violate the profile, which is the goal once the profile is validated. aa-logprof (A) is not among the marked answers here, and apparmor_parser (C) is likewise unmarked; while both are real AppArmor utilities, they are not part of the three correct selections for this question.

Answer

aa-logprof

Answer

apparmor_parser

Question 2

An administrator needs to configure iptables to allow incoming SSH traffic only from the 10.0.0.0/8 network and drop all other incoming traffic except established connections. Which TWO rules are necessary?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT. Option D is correct because it appends an INPUT rule that matches TCP packets destined for port 22 (SSH) whose source address falls within 10.0.0.0/8, and jumps to ACCEPT, thereby permitting SSH only from that network. Option E is correct because it uses the state match to ACCEPT packets belonging to ESTABLISHED or RELATED connections, which is required so that return traffic and already-established sessions are not blocked by the default drop policy. The remaining options are not part of the required pair: A would explicitly DROP SSH traffic from all sources (including 10.0.0.0/8), C would drop all INPUT traffic unconditionally, and B sets a default DROP policy but by itself does not implement the SSH-from-10.0.0.0/8 allowance or the established-connection exception.

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP

Answer

iptables -P INPUT DROP

Answer

iptables -A INPUT -j DROP

Question 3

An administrator needs to add a new user named 'jdoe' with a home directory and default group. Which command should be used?

Accepted Answer

useradd jdoe. The useradd command creates a new user. On most Linux distributions, the default configuration (/etc/default/useradd) is set to create a home directory. The command 'useradd jdoe' will create a home directory /home/jdoe and assign the user's own group as the primary group. While the -m option explicitly enforces home directory creation, the default behavior is sufficient. The other options do not add a user: groupadd adds a group, passwd sets a password, and usermod modifies an existing user.

Answer

groupadd jdoe

Answer

passwd jdoe

Answer

usermod jdoe

Question 4

An administrator notices that a non-root user 'alice' can run commands as root without being in the sudoers file. Which group membership could allow this?

Accepted Answer

wheel. On many Linux distributions, membership in the 'wheel' group is a standard mechanism that allows non-root users to execute commands with root privileges via the 'su' command, even if they are not listed in the sudoers file. The 'wheel' group is traditionally used to control access to the 'su' utility, and by default, PAM (Pluggable Authentication Modules) configuration often permits members of the 'wheel' group to switch to the root user without additional sudo configuration.

Answer

admin

Answer

root

Answer

sudo

Question 5

A firewall administrator wants to add a rule to allow incoming SSH traffic (port 22) using firewalld. Which command correctly adds this rule to the default zone permanently?

Accepted Answer

firewall-cmd --add-service=ssh --permanent. firewall-cmd --add-service=ssh --permanent adds the SSH service permanently. Option A lacks --permanent, Option C is missing the required protocol specification (e.g., /tcp), and Option D lacks --permanent. While --add-port=22/tcp would also work, --add-service is more descriptive and easier to manage.

Answer

firewall-cmd --add-port=22/tcp

Answer

firewall-cmd --add-port=22 --permanent

Answer

firewall-cmd --zone=public --add-service=ssh

Question 6

An administrator wants to set an SELinux boolean that allows Apache to connect to databases. After setting the boolean, which option ensures the change persists across reboots?

Accepted Answer

setsebool -P httpd_can_network_connect_db on. The setsebool command with the -P option (setsebool -P httpd_can_network_connect_db on) both sets the SELinux boolean immediately and makes the change persistent across reboots by writing it to the policy configuration. Without -P, the change is temporary and will revert on reboot. Therefore, this is the correct way to ensure persistence.

Answer

setenforce 1

Answer

setsebool httpd_can_network_connect_db on

Answer

semanage boolean -m --on httpd_can_network_connect_db

Question 7

A system administrator is configuring firewalld on a Linux server. They want to allow incoming HTTPS traffic permanently for the public zone. Which command should be used?

Accepted Answer

firewall-cmd --add-service=https --zone=public --permanent. The `firewall-cmd --add-service=https --zone=public --permanent` command adds the HTTPS service (TCP port 443) to the public zone and makes the rule persistent across reboots. The `--permanent` flag ensures the change survives a firewall reload or system restart, and the `--zone=public` targets the correct network zone for incoming traffic.

Answer

firewall-cmd --zone=public --add-service=https

Answer

firewall-cmd --service=https --add --zone=public --permanent

Answer

firewall-cmd --add-port=443/tcp --zone=public --permanent

Question 8

An administrator wants to view the current SELinux mode on a system. Which command displays whether SELinux is enforcing, permissive, or disabled?

Accepted Answer

getenforce. The `getenforce` command directly displays the current SELinux mode as either 'Enforcing', 'Permissive', or 'Disabled'. It reads the enforcing status from the kernel's SELinux state and outputs the mode in a simple, single-word format, making it the correct choice for this task.

Answer

seinfo

Answer

sestatus

Answer

getsebool -a

Question 9

A Linux security administrator needs to generate a self-signed certificate for a web server. They want to create a private key and a certificate signing request (CSR) in one step. Which OpenSSL command should be used?

Accepted Answer

openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.pem. The 'req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.pem' command generates a new private key and CSR. The other options either generate a self-signed certificate directly or are incomplete.

Answer

openssl genrsa -out key.pem 2048 && openssl req -new -key key.pem -out req.pem

Answer

openssl req -new -key key.pem -out req.pem

Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365

Question 10

An administrator is configuring log rotation for /var/log/auth.log. They want logs to be rotated weekly, compressed, and kept for 12 weeks. Which logrotate configuration directive achieves this?

Accepted Answer

weekly { rotate 12 compress }. The 'weekly' directive sets the rotation interval to once per week, 'rotate 12' retains 12 rotated files (which at weekly cadence equals 12 weeks of history), and 'compress' gzips each rotated file. This exactly matches the requirement of weekly rotation, compression, and 12 weeks of retention.

Answer

daily { rotate 12 compress }

Answer

weekly { rotate 52 compress }

Answer

monthly { rotate 12 compress }

Question 11

A security administrator is reviewing file permissions on a Linux system. They want to ensure that the /etc/shadow file is only readable by the root user. Which two commands can be used to set the correct permissions?

Accepted Answer

chown root:root /etc/shadow. Option A, `chown root:root /etc/shadow`, is correct because it sets both the owner and group of /etc/shadow to root, ensuring that only the root user (and root group) has any access rights, which aligns with restricting readability to root. Option C, `chmod 600 /etc/shadow`, is correct because it sets the permission bits to rw-------, meaning only the owner (root) can read and write the file, while group and others have no permissions, directly enforcing that only root can read it. Option B, `chmod 444 /etc/shadow`, is wrong because it makes the file world-readable, which violates the requirement. Option D, `chmod 640 /etc/shadow`, is wrong because it grants read access to the group (typically shadow), not just root. Option E, `chown root:shadow /etc/shadow`, is wrong because it changes the group ownership to shadow, which would allow members of the shadow group to read the file if permissions permit, contrary to the goal of root-only readability.

Answer

chmod 444 /etc/shadow

Answer

chmod 640 /etc/shadow

Answer

chown root:shadow /etc/shadow

Question 12

An administrator is configuring auditd to monitor changes to the /etc/passwd file. Which three commands are part of the auditd toolset for setting up and reviewing audit rules?

Accepted Answer

aureport. auditctl is the command-line utility used to control the audit system's behavior and to add, remove, or list audit rules, such as a watch on /etc/passwd, so option D is correct. ausearch queries the audit log files for events matching specified criteria (for example, by key or file), which is how the administrator reviews the generated audit records, making option B correct. aureport produces summary and columnar reports from the audit logs, such as file-access or authentication reports, so option A is correct for reviewing audit activity. Option C, aulog, is not a real auditd toolset command, and option E, auditd, is the audit daemon itself rather than a command for setting up or reviewing audit rules.

Answer

aulog

Answer

auditd

Question 13

A Linux administrator needs to configure a firewall to allow incoming SSH connections on the default port. Which firewalld command accomplishes this permanently?

Accepted Answer

firewall-cmd --add-service=ssh --permanent && firewall-cmd --reload. The command firewall-cmd --add-service=ssh --permanent adds the predefined ssh service (TCP/22) to the default zone's permanent configuration, and firewall-cmd --reload applies that permanent config to the runtime without dropping existing connections. Both flags are required: --permanent writes to disk, and --reload activates it.

Answer

firewall-cmd --add-port=22/tcp --permanent

Answer

firewall-cmd --add-service=ssh

Answer

firewall-cmd --zone=public --add-port=22/tcp

Question 14

A Linux administrator wants to monitor changes to the /etc/passwd file for security auditing. Which auditctl command should be used?

Accepted Answer

auditctl -w /etc/passwd -p wa -k passwd_change. The command 'auditctl -w /etc/passwd -p wa -k passwd_change' is correct because -w sets a watch on the file path, -p wa specifies that write and attribute-change events should be audited, and -k assigns a searchable key for later ausearch queries. This is the canonical way to monitor modifications to a critical authentication file.

Answer

auditctl -a always,exit -F path=/etc/passwd -F perm=wa

Answer

auditctl -w /etc/passwd -p r -k passwd_read

Answer

ausearch -f /etc/passwd

Question 15

Which command displays the current SELinux mode?

Accepted Answer

getenforce. The `getenforce` command displays the current SELinux mode as either Enforcing, Permissive, or Disabled. It reads the enforcing status directly from the kernel, making it the correct choice for checking the runtime mode.

Answer

sestatus

Answer

setenforce

Answer

selinuxenabled