XK0-006 Security Practice Test 4 — 15 Questions

Question 1

Which THREE of the following commands are used to manage iptables rules? (Select THREE.)

Accepted Answer

iptables -I. Option C, iptables -I, is correct because it inserts a new rule at a specified position in a chain (e.g., iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT), which is a core rule-management operation. Option D, iptables -A, is correct because it appends a new rule to the end of a chain (e.g., iptables -A INPUT -s 192.168.1.0/24 -j DROP), another fundamental way to add rules. Option E, iptables -D, is correct because it deletes a rule from a chain, either by rule number or by repeating the rule specification (e.g., iptables -D INPUT 3), which is essential for removing existing rules. Options A and B are not correct: -p is the match option that specifies a protocol (such as tcp, udp, or icmp) within a rule, and -j specifies the target/jump action (such as ACCEPT, DROP, or REJECT); neither is a standalone command for managing (adding, inserting, or deleting) rules.

Answer

iptables -p

Answer

iptables -j

Question 2

An administrator is configuring sudo access for a group of developers. They should be able to run any command as root, but only after authenticating with their own password. Which TWO configuration lines in /etc/sudoers would achieve this? (Select TWO.)

Accepted Answer

%developers ALL=(ALL) ALL. Option D, `%developers ALL=(ALL) ALL`, is correct because it grants the developers group full sudo rights to run any command as any user (including root) on all hosts, and by default sudo requires the invoking user's own password for authentication. Option E, `%developers ALL=(ALL) PASSWD: ALL`, is also correct because it explicitly sets the PASSWD tag, which forces sudo to prompt for the user's password rather than skipping authentication, achieving the same required behavior. Option A is wrong because `!authenticate` disables password prompting entirely, which contradicts the requirement to authenticate with their own password. Option B is wrong because it applies to the root user, not the developers group, and does not configure group sudo access. Option C is wrong because the NOPASSWD tag allows command execution without any password, violating the authentication requirement.

Answer

Defaults:%developers !authenticate

Answer

root ALL=(ALL) ALL

Answer

%developers ALL=(ALL) NOPASSWD: ALL

Question 3

A Linux administrator is configuring a new file server. A security policy requires that every file created in the shared directory /srv/shared automatically receives the group 'sales' and that only the file owner can delete their own files. The directory already exists with permissions 2775. Which command should the administrator run to meet these requirements?

Accepted Answer

chmod 3775 /srv/shared && chgrp sales /srv/shared. The setgid bit on a directory causes new files and subdirectories to inherit the directory's group ownership, satisfying the group requirement. The sticky bit on a directory restricts deletion and renaming of files to the file owner, the directory owner, or root, satisfying the deletion restriction. Setting mode 3775 combines both bits while preserving group write access, and changing the directory group to sales aligns ownership with the intended group.

Answer

chmod 3775 /srv/shared

Answer

chmod 2775 /srv/shared

Answer

chmod g+s,o+t /srv/shared

Question 4

A security administrator needs to verify that the SSH daemon on a production server is configured to disallow direct root login and to use only SSH protocol 2. The administrator opens the SSH configuration file and wants to confirm the effective settings. Which command should be used to display the active configuration of the running sshd service?

Accepted Answer

sshd -T. The sshd -T command parses the SSH server configuration, including any included files and defaults, and prints the effective settings. This allows the administrator to confirm the actual runtime configuration for PermitRootLogin and Protocol without ambiguity. Other methods either show runtime status, client capabilities, or only the literal file contents, which may not reflect the effective configuration.

Answer

grep -i 'PermitRootLogin\|Protocol' /etc/ssh/sshd_config

Answer

systemctl status sshd

Answer

ssh -Q protocol-version

Question 5

A Linux administrator manages a shared web server where several contractors have shell accounts. The security team wants to audit which files under /var/www/html have the SUID bit set, because any such file could allow a contractor to escalate privileges. Which command will list only those files?

Accepted Answer

find /var/www/html -perm -4000 -type f -ls. The leading minus in -perm -4000 performs an inclusive bitwise match against the mode, which is exactly how you locate files carrying the SUID bit regardless of their other permissions. Pairing it with -type f and -ls produces a clean, actionable inventory of executable files that could be abused for privilege escalation on the shared host.

Answer

find /var/www/html -perm /6000 -type f -ls

Answer

find /var/www/html -perm 4000 -type f -ls

Answer

ls -lR /var/www/html | grep '^-rws'

Question 6

A Linux administrator is tasked with securing a web server. The security policy requires that the server use only TLS 1.2 or higher and that the private key be protected with a passphrase. The administrator has already generated a private key and a certificate signing request (CSR). Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Use openssl rsa -aes256 -in server.key -out server.key.enc to encrypt the private key with a passphrase. To enforce TLS 1.2 or higher, the web server's protocol configuration must explicitly disable older versions and enable TLS 1.2 and 1.3. To protect the private key with a passphrase, the key must be encrypted using a tool like openssl rsa with a symmetric cipher such as AES-256. These two actions directly meet the policy requirements.

Answer

Set the SSLCipherSuite directive to HIGH:!aNULL:!MD5 to ensure strong ciphers are used

Answer

Generate a new certificate with a longer key length using openssl req -new -newkey rsa:4096 -nodes

Answer

Configure the web server to require client certificates for all connections

Question 7

A Linux server uses GRUB2 with a boot loader password configured. An administrator needs to prevent users from editing kernel boot parameters at the boot menu without authentication. Which file should be edited to set the GRUB2 superuser and encrypted password?

Accepted Answer

/etc/default/grub. GRUB2 authentication is configured by setting a superuser and an encrypted password in /etc/default/grub (or /etc/grub.d/01_users), then regenerating grub.cfg. Direct edits to grub.cfg are overwritten. This prevents unauthorized users from editing kernel parameters at boot, which is a key hardening step for physical and console access security.

Answer

/boot/grub2/grub.cfg

Answer

/etc/grub.d/40_custom

Answer

/etc/sysconfig/grub

Question 8

A Linux administrator is hardening a web server. The security policy requires that the system's audit daemon retain its audit records even after the system reboots, rather than losing them when the audit log rotates. The administrator edits /etc/audit/auditd.conf. Which directive should be set to stop auditd from halting when the audit partition reaches its maximum size?

Accepted Answer

max_log_file_action = keep_logs. To keep auditd running and retain rotated audit records instead of halting when the maximum file size is reached, max_log_file_action must be set to keep_logs. This keeps the daemon active and preserves logs, which is what the security policy demands. Other directives govern disk-space warnings, rotation size, or full-disk emergencies rather than the normal rotation action.

Answer

space_left_action = email

Answer

disk_full_action = suspend

Answer

max_log_file = 50

Question 9

A junior administrator must set the password for a newly created local account named svcbackup. The account will be used only by an automated backup script that reads the password from a protected credentials file. Which command lets the administrator assign the password non-interactively so the value can be supplied from that file?

Accepted Answer

chpasswd < /root/creds.txt. chpasswd is the standard shadow-utils tool for bulk, non-interactive password changes: it consumes username:password pairs on standard input and writes the resulting hashes to /etc/shadow in a single pass. Redirecting the protected credentials file into it satisfies the requirement to set the service account's password from a file without any terminal interaction.

Answer

passwd svcbackup <<< 'newpassword'

Answer

passwd --stdin svcbackup < /root/creds.txt

Answer

usermod -p $(cat /root/creds.txt) svcbackup

Question 10

A Linux administrator is configuring a web server that must serve content from a directory located on an NFS mount. SELinux is enforcing, and the web server process is unable to read files in the mounted directory. The administrator has confirmed that standard Unix permissions allow access. Which command should the administrator use to set the correct SELinux file context on the NFS mount so that httpd can read the content?

Accepted Answer

chcon -t httpd_sys_content_t /mnt/nfs/webcontent. To immediately grant httpd access to the NFS-mounted content, the file type must be set to httpd_sys_content_t. The chcon command applies the type directly to the files. While semanage fcontext with restorecon is the persistent method, it requires two steps. The Boolean httpd_use_nfs is often needed as well, but by itself it does not correct a mislabeled file context.

Answer

restorecon -R /mnt/nfs/webcontent

Answer

semanage fcontext -a -t httpd_sys_content_t "/mnt/nfs/webcontent(/.*)?"

Answer

setsebool -P httpd_use_nfs on

Question 11

A Linux administrator needs to check the current status of the firewall and list all active zones on a system using firewalld. Which command provides a comprehensive overview of the firewall state and active zones?

Accepted Answer

firewall-cmd --list-all-zones. The --list-all-zones option outputs the full configuration for every zone, including active and inactive ones, giving a complete picture of the firewall setup. Other options provide only partial information, such as state or active zones without details. For a thorough audit, --list-all-zones is the most comprehensive single command.

Answer

firewall-cmd --list-all

Answer

firewall-cmd --get-active-zones

Answer

firewall-cmd --state

Question 12

A Linux server hosts a web application that must only be accessible from the local subnet 192.168.10.0/24. The administrator decides to use nftables instead of iptables. Which command creates a base chain in the filter table for IPv4 input traffic and sets the default policy to drop?

Accepted Answer

nft add chain ip filter input { type filter hook input priority 0 \; policy drop \; }. To create a base chain with a default drop policy in nftables, the add chain command must include the type, hook, priority, and policy parameters. The escaped semicolons ensure the shell passes the entire brace-enclosed block as one argument. Omitting the policy or using incorrect syntax results in a chain that either fails to create or defaults to accept, which does not satisfy the security requirement.

Answer

nft add rule ip filter input policy drop

Answer

nft create chain ip filter input { type filter hook input priority 0 ; policy drop ; }

Answer

nft add chain ip filter input { type filter hook input priority 0 \; }

Question 13

A Linux administrator needs to harden a server's SSH configuration to prevent brute-force attacks and reduce the attack surface. Which TWO settings should be configured in /etc/ssh/sshd_config? (Choose two.)

Accepted Answer

MaxAuthTries 3. PermitRootLogin no prevents direct root logins, and MaxAuthTries 3 limits authentication attempts per connection. Together, they reduce the risk of brute-force attacks and limit the impact of compromised credentials. Enabling password authentication or empty passwords, or disabling PAM, would weaken security.

Answer

PermitEmptyPasswords yes

Answer

UsePAM no

Answer

PasswordAuthentication yes

Question 14

A compliance officer requires that on a fleet of RHEL servers, only the root user may schedule jobs with atcron, and that every use of crontab by a non-root account must be recorded in the system log. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Configure rsyslog to capture the cron facility by ensuring /etc/rsyslog.conf routes cron.* messages to a log file such as /var/log/cron.. Restricting scheduling is done with the /etc/cron.allow allow-list: once it exists with only root listed, every other account is denied crontab access. Auditing is achieved by making sure the cron syslog facility is routed to a persistent file, since the cron daemon records each crontab invocation there. Together these two changes enforce root-only scheduling and preserve a log of non-root attempts.

Answer

Change the mode of /usr/bin/crontab to 0700 and set its owner to root.

Answer

Add the pam_loginuid and pam_tty_audit entries to /etc/pam.d/crond.

Answer

Set the CRON_LOG_LEVEL directive to verbose in /etc/crontab.

Question 15

A Linux server has file integrity monitoring enabled. An administrator notices that the /etc/passwd file has been modified outside of normal change windows. Which command should be used to verify the file's integrity against the package manager's database?

Accepted Answer

aide --check. AIDE is a widely used file integrity checker that creates a database of file signatures and compares them on demand. Running aide --check reports any modifications, additions, or deletions. It works across distributions and is a standard tool for detecting unauthorized changes to critical files like /etc/passwd. Other tools are distribution-specific or not primarily designed for this purpose.

Answer

debsums /etc/passwd

Answer

tripwire --check

Answer

rpm -Vf /etc/passwd