XK0-006 Security Practice Test 5 — 15 Questions

Question 1

An administrator wants to enforce an account lockout policy after five failed login attempts on a Linux system. Which PAM module should be added to the authentication stack?

Accepted Answer

pam_faillock.so. pam_faillock is used for account lockout after failed attempts. pam_unix handles authentication, pam_pwquality checks password strength, pam_tally2 is an older module.

Answer

pam_unix.so

Answer

pam_pwquality.so

Answer

pam_tally2.so

Question 2

A system administrator needs to add an iptables rule to drop incoming TCP traffic on port 22 (SSH) from the IP address 10.0.0.100. Which command should be used?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 10.0.0.100 -j DROP. The correct syntax is iptables -A INPUT -p tcp --dport 22 -s 10.0.0.100 -j DROP. The chain is INPUT, protocol tcp, destination port 22, source IP, and target DROP.

Answer

iptables -A INPUT -p udp --dport 22 -s 10.0.0.100 -j DROP

Answer

iptables -I OUTPUT -p tcp --sport 22 -d 10.0.0.100 -j DROP

Answer

iptables -A FORWARD -p tcp --dport 22 -s 10.0.0.100 -j DROP

Question 3

An administrator is configuring log rotation for /var/log/auth.log. They want logs to be rotated weekly, compressed, and kept for 12 weeks. Which logrotate configuration directive achieves this?

Accepted Answer

weekly { rotate 12 compress }. weekly, compress, and rotate 12 set the desired behavior. The other options have incorrect parameters.

Answer

daily { rotate 12 compress }

Answer

weekly { rotate 52 compress }

Answer

monthly { rotate 12 compress }

Question 4

A security analyst needs to see a list of failed login attempts on a Linux system. Which command displays this information from the /var/log/btmp log?

Accepted Answer

lastb. lastb shows failed login attempts by reading the /var/log/btmp file. last reads /var/log/wtmp for successful logins, lastlog shows last login per user from /var/log/lastlog, and faillog is an older command that reads from /var/log/faillog.

Answer

lastlog

Answer

last

Answer

faillog

Question 5

An administrator wants to ensure that only users in the 'wheel' group can use the sudo command. Which directive in /etc/sudoers enables this?

Accepted Answer

%wheel ALL=(ALL) ALL. %wheel ALL=(ALL) ALL grants sudo access to all members of the wheel group.

Answer

%wheel ALL=ALL

Answer

@wheel ALL=(ALL) ALL

Answer

wheel ALL=(ALL) ALL

Question 6

A Linux administrator is hardening an SSH server. Which two of the following settings should be applied to /etc/ssh/sshd_config to improve security?

Accepted Answer

PermitRootLogin no. PermitRootLogin no prevents root login; PasswordAuthentication no forces key-based authentication. Changing the port and enabling X11 forwarding are not necessarily hardening.

Answer

Port 2222

Answer

X11Forwarding yes

Answer

Protocol 1

Question 7

A security administrator is reviewing file permissions on a Linux system. They want to ensure that the /etc/shadow file is only readable by the root user. Which two commands can be used to set the correct permissions?

Accepted Answer

chown root:root /etc/shadow. The chown root:root /etc/shadow command changes both the owner and group of the /etc/shadow file to root. This ensures that only the root user has ownership, which is a prerequisite for setting restrictive permissions. However, the question asks for commands to set the correct permissions, and while ownership change is important, the primary requirement is that the file is only readable by root, which is achieved by setting permissions to 600 (owner read/write, no access for group or others). Thus, chmod 600 /etc/shadow (Option C) is also correct, making A and C the two commands that together ensure the file is only readable by root.

Answer

chmod 444 /etc/shadow

Answer

chmod 640 /etc/shadow

Answer

chown root:shadow /etc/shadow

Question 8

An administrator is configuring auditd to monitor changes to the /etc/passwd file. Which three commands are part of the auditd toolset for setting up and reviewing audit rules?

Accepted Answer

aureport. auditctl adds rules, ausearch searches logs, aureport generates reports. auditd is the daemon, not a command for rules. aulog is not a standard tool.

Answer

aulog

Answer

auditd

Question 9

A Linux administrator needs to configure a firewall to allow incoming SSH connections on the default port. Which firewalld command accomplishes this permanently?

Accepted Answer

firewall-cmd --add-service=ssh --permanent && firewall-cmd --reload. The correct command adds the ssh service to the default zone permanently and reloads the firewall.

Answer

firewall-cmd --add-port=22/tcp --permanent

Answer

firewall-cmd --add-service=ssh

Answer

firewall-cmd --zone=public --add-port=22/tcp

Question 10

A system administrator wants to enforce a password policy requiring a minimum length of 12 characters, at least one uppercase letter, and one digit. Which PAM module should be configured?

Accepted Answer

pam_pwquality. pam_pwquality is the correct PAM module because it is specifically designed to enforce password complexity requirements, such as minimum length, uppercase letters, and digits, through configurable parameters like minlen, ucredit, and dcredit. It replaces the older pam_cracklib and is the standard module for password quality checks on modern Linux systems.

Answer

pam_unix

Answer

pam_faillock

Answer

pam_tally2

Question 11

A security audit reveals that an SELinux boolean 'httpd_can_network_connect' is currently off, but a web application requires Apache to connect to a database server. Which command should the administrator use to enable this boolean persistently?

Accepted Answer

setsebool -P httpd_can_network_connect on. setsebool -P makes the change persistent across reboots.

Answer

setenforce 1

Answer

setsebool httpd_can_network_connect 1

Answer

getsebool httpd_can_network_connect

Question 12

An administrator needs to prevent a specific user 'bob' from logging in via SSH while allowing other users. Which configuration directive should be added to /etc/ssh/sshd_config?

Accepted Answer

DenyUsers bob. The DenyUsers directive in /etc/ssh/sshd_config explicitly blocks specific usernames from logging in via SSH. By specifying 'DenyUsers bob', only user bob is denied, while all other users remain allowed. This matches the requirement to prevent bob without affecting others. AllowUsers with a whitelist would also block bob but would require listing every other user, which is impractical and not the intended solution.

Answer

AllowUsers alice charlie

Answer

PermitRootLogin no

Answer

AllowUsers bob

Question 13

A Linux administrator wants to monitor changes to the /etc/passwd file for security auditing. Which auditctl command should be used?

Accepted Answer

auditctl -w /etc/passwd -p wa -k passwd_change. auditctl -w /etc/passwd -p wa -k passwd_change watches for write and attribute changes.

Answer

auditctl -a always,exit -F path=/etc/passwd -F perm=wa

Answer

auditctl -w /etc/passwd -p r -k passwd_read

Answer

ausearch -f /etc/passwd

Question 14

Which command displays the current SELinux mode?

Accepted Answer

getenforce. The `getenforce` command displays the current SELinux mode as either Enforcing, Permissive, or Disabled. It reads the enforcing status directly from the kernel, making it the correct choice for checking the runtime mode.

Answer

sestatus

Answer

setenforce

Answer

selinuxenabled

Question 15

A user reports they cannot log in after three failed password attempts. The system uses PAM with pam_faillock. Which command can the administrator use to view the number of failed attempts for the user?

Accepted Answer

faillock --user username. The system uses PAM with pam_faillock, a modern lockout module. The 'faillock' command is specifically designed to display and manage failure counts for this module. 'pam_tally2' is used with the older pam_tally2 module and is not applicable here.

Answer

ausearch -m USER_LOGIN -ui username

Answer

pam_tally2 --user username

Answer

lastb username