XK0-006 Security Practice Test 4 — 15 Questions

Question 1

A firewall administrator wants to add a rule to allow incoming SSH traffic (port 22) using firewalld. Which command correctly adds this rule to the default zone permanently?

Accepted Answer

firewall-cmd --add-service=ssh --permanent. firewall-cmd --add-service=ssh --permanent adds the SSH service permanently. Option A lacks --permanent, Option C is missing the required protocol specification (e.g., /tcp), and Option D lacks --permanent. While --add-port=22/tcp would also work, --add-service is more descriptive and easier to manage.

Answer

firewall-cmd --add-port=22/tcp

Answer

firewall-cmd --add-port=22 --permanent

Answer

firewall-cmd --zone=public --add-service=ssh

Question 2

An administrator needs to view all current nftables rules. Which command should be used?

Accepted Answer

nft list ruleset. nft list ruleset displays the entire ruleset. nft list table only shows a specific table.

Answer

nft --list

Answer

nft show ruleset

Answer

iptables -L

Question 3

SELinux is currently in enforcing mode. A service is being blocked by SELinux. Which command can analyze the audit log and suggest the minimum policy changes to allow the service?

Accepted Answer

audit2allow. audit2allow reads audit messages and generates policy modules to allow the denied actions.

Answer

ausearch

Answer

setsebool

Answer

restorecon

Question 4

An administrator wants to set an SELinux boolean that allows Apache to connect to databases. After setting the boolean, which option ensures the change persists across reboots?

Accepted Answer

setsebool -P httpd_can_network_connect_db on. setsebool -P makes the change permanent. Without -P, it only lasts until reboot.

Answer

setenforce 1

Answer

setsebool httpd_can_network_connect_db on

Answer

semanage boolean -m --on httpd_can_network_connect_db

Question 5

To harden SSH, an administrator needs to disable root login over SSH. Which directive should be set in /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin no. PermitRootLogin no prevents root from logging in via SSH.

Answer

RootLogin no

Answer

DenyUsers root

Answer

AllowUsers root

Question 6

Which log file typically records authentication failures and successes on a Debian-based system?

Accepted Answer

/var/log/auth.log. On Debian/Ubuntu, /var/log/auth.log records authentication events. On RHEL/CentOS, it's /var/log/secure.

Answer

/var/log/messages

Answer

/var/log/syslog

Answer

/var/log/secure

Question 7

An administrator wants to generate a self-signed certificate and private key for testing. Which command creates both in one step?

Accepted Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes. The `openssl req -x509 -newkey rsa:2048` command generates a new private key (via `-newkey`) and immediately creates a self-signed X.509 certificate (via `-x509`) in a single step. The `-keyout` and `-out` flags specify the output files for the private key and certificate, respectively, and `-nodes` ensures the private key is not encrypted with a passphrase, which is typical for testing scenarios.

Answer

openssl genrsa -out key.pem 2048

Answer

openssl req -new -x509 -days 365 -key key.pem -out cert.pem

Answer

openssl x509 -req -in req.pem -signkey key.pem -out cert.pem

Question 8

A security administrator is reviewing SSH configuration. Which TWO settings enhance security by limiting authentication attempts and preventing password-based logins? (Choose two.)

Accepted Answer

MaxAuthTries 3. MaxAuthTries sets maximum authentication attempts. PasswordAuthentication no disables password auth, forcing key-based.

Answer

Protocol 2

Answer

PermitRootLogin no

Answer

Port 2222

Question 9

After configuring AppArmor, an administrator wants to verify the status of all profiles and switch a profile from complain to enforce mode. Which TWO commands are appropriate? (Choose two.)

Accepted Answer

aa-status. B is correct because `aa-status` displays the current status of all AppArmor profiles, allowing the administrator to verify which are in enforce or complain mode. E is correct because `aa-enforce` switches a profile to enforce mode, which is the required action. A is incorrect; restarting the AppArmor service does not verify status or switch a profile's mode. C is incorrect; `apparmor_parser -r` reloads profile definitions from disk, but does not change the mode of a profile; mode is changed via `aa-enforce` or `aa-complain`. D is incorrect because `aa-complain` sets the profile to complain mode, which is the opposite of the desired enforce mode.

Answer

systemctl restart apparmor

Answer

apparmor_parser -r /etc/apparmor.d/profile

Answer

aa-complain /path/to/profile

Question 10

A Linux administrator needs to prevent the root user from logging in via SSH. Which directive should be set in /etc/ssh/sshd_config to accomplish this?

Accepted Answer

PermitRootLogin no. The directive `PermitRootLogin no` in `/etc/ssh/sshd_config` explicitly disallows the root user from authenticating via SSH, regardless of the authentication method used. This is the standard way to block root SSH logins while still allowing other users to connect.

Answer

PasswordAuthentication no

Answer

MaxAuthTries 1

Answer

AllowUsers root

Question 11

A security auditor notices that users can set weak passwords on a Linux system. The administrator wants to enforce password complexity requiring a minimum of 12 characters, at least one uppercase letter, and at least one digit. Which PAM module should be configured in /etc/pam.d/common-password?

Accepted Answer

pam_pwquality.so. pam_pwquality provides password strength checking with parameters like minlen, ucredit, dcredit. The other modules do not handle complexity.

Answer

pam_unix.so

Answer

pam_tally2.so

Answer

pam_faillock.so

Question 12

A system administrator is configuring firewalld on a Linux server. They want to allow incoming HTTPS traffic permanently for the public zone. Which command should be used?

Accepted Answer

firewall-cmd --add-service=https --zone=public --permanent. The `firewall-cmd --add-service=https --zone=public --permanent` command adds the HTTPS service (TCP port 443) to the public zone and makes the rule persistent across reboots. The `--permanent` flag ensures the change survives a firewall reload or system restart, and the `--zone=public` targets the correct network zone for incoming traffic.

Answer

firewall-cmd --zone=public --add-service=https

Answer

firewall-cmd --service=https --add --zone=public --permanent

Answer

firewall-cmd --add-port=443/tcp --zone=public --permanent

Question 13

An administrator wants to view the current SELinux mode on a system. Which command displays whether SELinux is enforcing, permissive, or disabled?

Accepted Answer

getenforce. The `getenforce` command directly displays the current SELinux mode as either 'Enforcing', 'Permissive', or 'Disabled'. It reads the enforcing status from the kernel's SELinux state and outputs the mode in a simple, single-word format, making it the correct choice for this task.

Answer

seinfo

Answer

sestatus

Answer

getsebool -a

Question 14

A user named 'jdoe' needs to run commands as root without being given the root password. The administrator wants to grant jdoe the ability to run any command as root, but only after entering their own password. Which entry in /etc/sudoers accomplishes this?

Accepted Answer

jdoe ALL=(ALL) ALL. The format is 'user host=(runas) commands'. The correct entry grants jdoe full root access with password authentication.

Answer

jdoe ALL=(ALL) NOPASSWD: ALL

Answer

jdoe ALL=(root) /usr/bin/su

Answer

jdoe ALL= /bin/su -

Question 15

A Linux security administrator needs to generate a self-signed certificate for a web server. They want to create a private key and a certificate signing request (CSR) in one step. Which OpenSSL command should be used?

Accepted Answer

openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.pem. The 'req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.pem' command generates a new private key and CSR. The other options either generate a self-signed certificate directly or are incomplete.

Answer

openssl genrsa -out key.pem 2048 && openssl req -new -key key.pem -out req.pem

Answer

openssl req -new -key key.pem -out req.pem

Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365