XK0-006 Security Practice Test 5 — 15 Questions

Question 1

A security team wants to enforce that all new files created by members of the 'developers' group on a shared project directory inherit the group ownership of 'developers' and that directories created within it also inherit the setgid bit. The shared directory is /srv/project. Which command accomplishes this while preserving existing permissions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

chmod 2775 /srv/project. Setting mode 2775 applies the setgid bit to the directory along with standard owner, group, and other permissions. On a directory, setgid makes newly created entries inherit the directory's group and causes new subdirectories to carry the setgid bit forward. The sticky bit and default ACL approaches address different behaviors and do not provide the required group inheritance.

Answer

setfacl -d -m g:developers:rwx /srv/project

Answer

chmod g+s /srv/project && chmod o+t /srv/project

Answer

chmod 1775 /srv/project

Question 2

A security administrator is configuring a Linux server to use auditd for compliance monitoring. The administrator needs to create audit rules that log all executions of the /usr/bin/passwd command and all attempts to modify the /etc/shadow file. Which TWO auditctl commands should the administrator use to add these rules? (Choose two.)

Accepted Answer

auditctl -w /etc/shadow -p wa -k shadow_mod. File watches in auditd are created with the -w option followed by the path and -p to specify permissions. To log executions, use -p x on the binary. To log modifications to /etc/shadow, use -p wa to capture writes and attribute changes. Syscall-based rules with -a always,exit and -S are used for system calls, not for direct file path watches.

Answer

auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/bin/passwd -k passwd_exec

Answer

auditctl -a always,exit -F path=/usr/bin/passwd -F perm=x -k passwd_exec

Answer

auditctl -w /etc/shadow -p r -k shadow_read

Question 3

A Linux server runs an internal web application accessible only from the local network. A security review requires that the web server's private key and certificate be stored in a directory that only the web server process can read. The web server runs as user 'www-data' and group 'www-data'. Which command should be used to set the correct ownership and permissions on the private key file /etc/ssl/private/webapp.key?

Accepted Answer

chown www-data:www-data /etc/ssl/private/webapp.key && chmod 600 /etc/ssl/private/webapp.key. The private key must be readable only by the web server process. Setting ownership to www-data:www-data and permissions to 600 ensures that only the owner can read and write the file, which is the standard secure configuration for a private key. This prevents other users and group members from accessing the key, aligning with the principle of least privilege.

Answer

chown www-data:root /etc/ssl/private/webapp.key && chmod 640 /etc/ssl/private/webapp.key

Answer

chown www-data:www-data /etc/ssl/private/webapp.key && chmod 400 /etc/ssl/private/webapp.key

Answer

chown root:root /etc/ssl/private/webapp.key && chmod 644 /etc/ssl/private/webapp.key

Question 4

A Linux administrator discovers that a compromised process is running with the capabilities cap_setuid and cap_setgid, allowing it to change user and group IDs. The administrator wants to remove these capabilities from the running process to limit its privilege. Which command should be used to drop the capabilities for the process with PID 1234?

Accepted Answer

capsh --pid=1234 --drop=cap_setuid,cap_setgid. The compromised process already holds capabilities in its live capability sets, so file-level tools like setcap are ineffective. capsh with --pid targets the running process and --drop removes the dangerous capabilities from its bounding and effective sets. This immediately reduces the process's ability to escalate privileges by switching user or group identity, helping contain the compromise.

Answer

capsh --drop=cap_setuid,cap_setgid -- -c 'echo done'

Answer

setpriv --reuid=1234 --clear-groups --inh-caps=-setuid,-setgid --ambient-caps=-setuid,-setgid

Answer

setcap -r cap_setuid,cap_setgid /proc/1234/exe

Question 5

A security administrator needs to ensure that all user passwords on a Linux system meet a minimum length of 12 characters and include at least one digit. Which file should be modified to enforce these requirements globally using PAM?

Accepted Answer

/etc/security/pwquality.conf. Password complexity requirements are enforced by the pam_pwquality module, which reads its settings from /etc/security/pwquality.conf. Parameters such as minlen and dcredit control minimum length and required digits. While other files like /etc/login.defs or PAM configuration files play roles in password management, they do not provide the same level of granularity for enforcing character class requirements globally.

Answer

/etc/pam.d/common-password

Answer

/etc/login.defs

Answer

/etc/pam.d/system-auth

Question 6

A security engineer is hardening a Linux bastion host. She wants to confirm which SSH host key algorithms the local sshd will actually offer to clients and verify the fingerprint of each key file on disk before publishing them to the operations team. Which command shows the fingerprints of the host keys in /etc/ssh?

Accepted Answer

ssh-keygen -l -f /etc/ssh/ssh_host_ed25519_key.pub. ssh-keygen with -l and -f is the canonical way to derive the fingerprint of a specific key file, and it works for RSA, ECDSA, and Ed25519 host keys alike. Running it against each public host key in /etc/ssh gives the engineer the size, SHA-256 fingerprint, and comment needed to document and distribute the bastion host's identities.

Answer

ssh-add -L /etc/ssh/ssh_host_ed25519_key

Answer

ssh-keyscan -t ed25519 localhost

Answer

openssl rsa -in /etc/ssh/ssh_host_rsa_key -pubout

Question 7

A Linux server is configured with a default umask of 022. A security auditor recommends that all newly created files and directories by users be accessible only to the owner and group, with no permissions for others. Which TWO commands, when set as the default umask for all users, would achieve this? (Choose two.)

Accepted Answer

umask 077. Both umask 027 and umask 077 remove all permissions for others, satisfying the requirement that others have no access. umask 027 grants group read (and directory traverse) while umask 077 denies all group access as well. Either command, when set as the default umask, ensures new files and directories are not accessible to other users, meeting the auditor's recommendation.

Answer

umask 002

Answer

umask 022

Answer

umask 007

Question 8

A security administrator is hardening a Linux server and needs to ensure that the system logs authentication events and that these logs are protected from unauthorized modification. Which TWO actions should the administrator take to achieve these goals? (Choose two.)

Accepted Answer

Configure rsyslog to send authentication logs to a remote log server.. To log authentication events and protect them, the administrator should enable auditd with appropriate rules and configure rsyslog to forward logs to a remote server. Auditd provides detailed event logging, while remote logging ensures logs are stored off-system where they are less likely to be tampered with. Other options either disrupt logging or do not provide protection against modification.

Answer

Configure logrotate to compress and rotate logs daily.

Answer

Set the immutable attribute on /var/log/secure using chattr +i.

Answer

Restrict permissions on /var/log to 700 and change ownership to root.

Question 9

A security analyst is investigating a suspected rootkit on a Linux system. The analyst runs 'chkrootkit' and sees the output 'Checking `bindshell'... INFECTED'. However, the analyst suspects a false positive because the system runs a legitimate service that listens on a port. Which command should the analyst use to verify whether the suspicious process is actually a rootkit?

Accepted Answer

rpm -Vf /path/to/binary. To confirm whether the 'bindshell' detection is a false positive, the analyst should verify the integrity of the binary that is listening on the port. The rpm -Vf command checks the file against the RPM database, revealing any modifications. If the binary is unmodified, it is likely a legitimate service and not a rootkit. Other tools like netstat or lsof can identify the process but do not verify its integrity.

Answer

netstat -tulpn | grep LISTEN

Answer

rkhunter --check --sk

Answer

lsof -i :<port>

Question 10

A security administrator is hardening a Linux server that uses systemd. They want to ensure that the SSH daemon (sshd) is restricted to only listen on a specific IP address and port, and that it cannot be started manually by a user. Which of the following should the administrator configure?

Accepted Answer

Modify the sshd.service unit to include ListenStream=192.168.1.10:22 and set RefuseManualStart=yes, then reload systemd and restart sshd.. To restrict sshd to a specific IP and port, the administrator must edit /etc/ssh/sshd_config with ListenAddress and Port directives. To prevent manual start, a systemd override with RefuseManualStart=yes is needed. Combining these two configurations achieves both requirements. The other options either misplace directives or rely on firewall rules that do not change the daemon's binding.

Answer

Create a systemd override for sshd.service with RestrictAddressFamilies=AF_INET and IPAddressAllow=, and set RefuseManualStart=yes.

Answer

Use firewall-cmd to restrict SSH to a specific IP and port, and set RefuseManualStart=yes in the sshd service.

Answer

Edit /etc/ssh/sshd_config with ListenAddress and Port directives, then restart sshd.

Question 11

A Linux administrator is configuring a new server that will store sensitive financial data. The security policy requires that all user passwords must be hashed using a strong algorithm and that password aging be enforced. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Set the ENCRYPT_METHOD SHA512 in /etc/login.defs.. To enforce strong password hashing, the ENCRYPT_METHOD in /etc/login.defs should be set to SHA512. To enforce password aging, PASS_MAX_DAYS and PASS_MIN_DAYS in /etc/login.defs should be configured. These two changes together meet the policy requirements for hashing and aging. The other options either address complexity, per-user settings, or PAM module configurations that do not globally enforce both requirements.

Answer

Use the chage command to set the password expiration for each user to 90 days.

Answer

Enable pam_unix.so with obscure and sha512 options in /etc/pam.d/common-password.

Answer

Modify /etc/pam.d/system-auth to include pam_pwquality.so with retry=3.

Question 12

A Linux administrator needs to securely transfer a file from a local server to a remote server. The administrator wants to ensure that the file is encrypted in transit and that the remote server's identity is verified. Which command should the administrator use?

Accepted Answer

scp /local/file.txt user@remote:/remote/directory/. The scp command uses SSH to transfer files, ensuring encryption and server authentication. The other options either lack encryption (rsync without -e ssh, ftp, nc) or do not verify the server's identity. scp is the appropriate tool for secure file transfer in this scenario.

Answer

ftp user@remote

Answer

rsync -avz /local/file.txt user@remote:/remote/directory/

Answer

nc -l 1234 > file.txt

Question 13

A Linux administrator needs to add a new user named 'jdoe' with a home directory and a bash shell. Which command accomplishes this?

Accepted Answer

useradd -m -s /bin/bash jdoe. The useradd command with -m creates the home directory and -s /bin/bash sets the login shell, so 'useradd -m -s /bin/bash jdoe' creates user jdoe with a home directory and bash shell in one step. This is the canonical low-level command on RHEL/CentOS and other systemd-based distributions for non-interactive user creation.

Answer

usermod -m -s /bin/bash jdoe

Answer

adduser jdoe --home /home/jdoe --shell /bin/bash

Answer

passwd -m jdoe

Question 14

A security audit reveals that users can change their password without meeting complexity requirements. Which PAM module should be configured to enforce password complexity?

Accepted Answer

pam_pwquality. pam_pwquality is the PAM module that enforces password complexity requirements such as minimum length, character classes, and dictionary checks on Linux. It replaced the older pam_cracklib module and is configured in /etc/security/pwquality.conf and referenced in /etc/pam.d/system-auth or /etc/pam.d/common-password. Configuring it ensures users cannot set weak passwords that violate policy.

Answer

pam_faillock

Answer

pam_unix

Answer

pam_tally2

Question 15

An administrator wants to allow the user 'ops' to run only the command '/usr/bin/systemctl restart httpd' via sudo on a specific host 'webserver'. Which /etc/sudoers entry is correct?

Accepted Answer

ops webserver=(root) /usr/bin/systemctl restart httpd. The sudoers entry format is: user host=(runas) command. To allow user 'ops' to run only the specified command on host 'webserver' as root, the correct entry is 'ops webserver=(root) /usr/bin/systemctl restart httpd'. This restricts both the host and the command, and specifies the runas user as root.

Answer

ops ALL=(root) /usr/bin/systemctl restart httpd

Answer

ops webserver=(ALL) /usr/bin/systemctl restart httpd

Answer

ops webserver=(root) ALL