XK0-006 Security Practice Test 3 — 15 Questions

Question 1

Which command displays the current SELinux mode?

Accepted Answer

getenforce. getenforce displays whether SELinux is enforcing, permissive, or disabled.

Answer

setenforce

Answer

selinuxenabled

Answer

sestatus

Question 2

A system administrator is hardening SSH and needs to disable root login and password authentication. Which two directives should be set in /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin no and PasswordAuthentication no. Disabling root login and password authentication are two separate directives in sshd_config. PermitRootLogin no prevents direct SSH access for the root user, and PasswordAuthentication no disables password-based logins, forcing the use of key-based authentication. Both directives are required to meet the hardening goal.

Answer

PermitRootLogin no and ChallengeResponseAuthentication no

Answer

DenyUsers root and PasswordAuthentication no

Answer

PermitRootLogin prohibit-password and PasswordAuthentication yes

Question 3

A Linux administrator needs to configure auditing to monitor changes to the /etc/passwd file. Which auditctl command should be used?

Accepted Answer

auditctl -w /etc/passwd -p wa -k passwd_changes. The correct command is option B. It uses the -w watch syntax to monitor /etc/passwd for write (w) and attribute change (a) permissions, which is the standard and simplest method for auditing changes. Option D is a valid syscall-based alternative but is more complex and not the best answer for this question. Option A includes read permission, which is unnecessary. Option C monitors unlink and rename syscalls, not direct file modifications.

Answer

auditctl -w /etc/passwd -p rwxa -k passwd_changes

Answer

auditctl -a exit,always -S unlink -S rename -F path=/etc/passwd

Answer

auditctl -a always,exit -F path=/etc/passwd -F perm=wa -k passwd_changes

Question 4

Which command can be used to generate an SSH key pair for user authentication?

Accepted Answer

ssh-keygen. The `ssh-keygen` command is the standard tool for generating SSH key pairs (public and private keys) used for user authentication. It creates RSA, ECDSA, Ed25519, or DSA key files (e.g., `~/.ssh/id_rsa` and `~/.ssh/id_rsa.pub`) and supports options like `-t` for key type and `-b` for bit length, directly enabling passwordless login via public key authentication.

Answer

ssh-keyscan

Answer

ssh-copy-id

Answer

ssh-add

Question 5

A technician needs to create a self-signed certificate and private key for a web server. Which OpenSSL command should be used?

Accepted Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes. The `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes` command generates a new RSA 2048-bit private key and immediately creates a self-signed X.509 certificate in a single step. The `-x509` flag tells OpenSSL to output a self-signed certificate instead of a certificate signing request (CSR), and `-nodes` ensures the private key is not encrypted with a passphrase, which is typical for a web server that must start without manual intervention.

Answer

openssl genrsa -out key.pem 2048 && openssl req -new -key key.pem -out cert.pem

Answer

openssl x509 -req -in req.pem -signkey key.pem -out cert.pem

Answer

openssl ca -in req.pem -out cert.pem

Question 6

A security audit reveals that user accounts remain active after employees leave the company. Which TWO commands should be used to disable an account immediately?

Accepted Answer

usermod -e 1 username. To disable an account immediately, `usermod -e 1 username` (option B) sets the account expiration date to January 1, 1970, which immediately expires the account and prevents all login methods. `usermod -L username` (option C) locks the user's password, preventing password-based authentication. Both commands together provide immediate disablement covering all authentication paths. Option D also locks the password but is redundant with C; the question asks for two commands, so B and C are the most appropriate. Option A sets expiration to 0 days after epoch, which may not disable immediately. Option E deletes the account, which is not the same as disabling.

Answer

chage -E 0 username

Answer

passwd -l username

Answer

userdel username

Question 7

An administrator is configuring AppArmor for a custom application. Which THREE commands are used to manage AppArmor profiles?

Accepted Answer

aa-status. aa-status displays the status of AppArmor profiles. aa-complain sets a profile to complain mode (logs violations but does not enforce). aa-enforce sets a profile to enforce mode.

Answer

aa-logprof

Answer

apparmor_parser

Question 8

A Linux engineer needs to restrict resource usage for users in the 'developers' group. Which TWO files or commands can be used to set ulimit values?

Accepted Answer

/etc/security/limits.conf. /etc/security/limits.conf is the standard configuration file used by the pam_limits.so PAM module to set per-user or per-group resource limits (ulimits) such as max number of open files, max processes, etc. This file allows system administrators to define hard and soft limits persistently across logins for users or groups, including the 'developers' group.

Answer

sysctl command

Answer

/etc/pam.d/login with pam_limits.so

Answer

/etc/ulimit.conf

Question 9

Which THREE are valid SELinux modes?

Accepted Answer

Permissive. SELinux has three modes: enforcing (policy enforced), permissive (only logs violations), and disabled (SELinux turned off).

Answer

Strict

Answer

Audit

Question 10

An administrator needs to configure iptables to allow incoming SSH traffic only from the 10.0.0.0/8 network and drop all other incoming traffic except established connections. Which TWO rules are necessary?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT. It explicitly allows incoming SSH traffic (TCP port 22) from the 10.0.0.0/8 network, which matches the requirement to permit SSH only from that subnet. Option E is correct because it accepts all packets that are part of an established or related connection, ensuring that return traffic for outbound connections is not dropped by the default policy or subsequent rules.

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP

Answer

iptables -P INPUT DROP

Answer

iptables -A INPUT -j DROP

Question 11

Which file contains user password hashes and aging information on a Linux system?

Accepted Answer

/etc/shadow. The /etc/shadow file stores user password hashes along with password aging information, such as the last password change date, minimum and maximum password age, warning period, and inactivity lockout. This file is readable only by root (or privileged processes) to protect the hashed passwords from unauthorized access, unlike /etc/passwd which is world-readable.

Answer

/etc/group

Answer

/etc/passwd

Answer

/etc/gshadow

Question 12

A security analyst wants to ensure that users cannot change their password more than once every 7 days. Which command and option should be used to enforce this policy for user 'jsmith'?

Accepted Answer

chage -m 7 jsmith. The `chage -m 7 jsmith` command sets the minimum number of days required between password changes for user jsmith to 7 days. The `-m` option of `chage` specifically controls the minimum password age, preventing the user from changing their password more than once every 7 days.

Answer

usermod -e 7 jsmith

Answer

chage -M 7 jsmith

Answer

passwd -n 7 jsmith

Question 13

An administrator notices that a non-root user 'alice' can run commands as root without being in the sudoers file. Which group membership could allow this?

Accepted Answer

wheel. On many Linux distributions, membership in the 'wheel' group is a standard mechanism that allows non-root users to execute commands with root privileges via the 'su' command, even if they are not listed in the sudoers file. The 'wheel' group is traditionally used to control access to the 'su' utility, and by default, PAM (Pluggable Authentication Modules) configuration often permits members of the 'wheel' group to switch to the root user without additional sudo configuration.

Answer

admin

Answer

root

Answer

sudo

Question 14

A system administrator configures PAM to enforce account lockout after 3 failed login attempts. Which PAM module should be used?

Accepted Answer

pam_faillock. pam_faillock is the correct PAM module for enforcing account lockout after a specified number of failed login attempts. It tracks failed authentication attempts per user and can lock the account when the threshold (e.g., 3 attempts) is reached, typically by writing to a tally file like /var/log/faillock.

Answer

pam_pwquality

Answer

pam_securetty

Answer

pam_unix

Question 15

To limit the number of processes a user can create, which file should be configured?

Accepted Answer

/etc/security/limits.conf. /etc/security/limits.conf sets resource limits per user/group, including nproc (number of processes).

Answer

/etc/pam.d/login

Answer

/etc/ulimit.conf

Answer

/etc/systemd/system.conf