XK0-006 Security Practice Test 6 — 15 Questions

Question 1

An AppArmor profile for a web server is in complain mode. After testing, the administrator wants to enforce the profile. Which command accomplishes this?

Accepted Answer

aa-enforce /etc/apparmor.d/usr.sbin.httpd. The correct command to enforce an AppArmor profile that is currently in complain mode is `aa-enforce`. This command switches the profile from complain (log-only) to enforce (block violations) mode. The option `-r` in `apparmor_parser` reloads the profile but does not change its mode; `aa-complain` sets it to complain mode, and `aa-status` only displays status.

Answer

apparmor_parser -r /etc/apparmor.d/usr.sbin.httpd

Answer

aa-complain /etc/apparmor.d/usr.sbin.httpd

Answer

aa-status /etc/apparmor.d/usr.sbin.httpd

Question 2

An administrator is hardening SSH and wants to disable root login and only allow users in the 'sshusers' group. Which two directives should be set in /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin no and AllowGroups sshusers. The directive `PermitRootLogin no` explicitly disallows root login via SSH, and `AllowGroups sshusers` restricts SSH access to only members of the 'sshusers' group. This combination meets both requirements: disabling root login and limiting access to a specific group. The `AllowGroups` directive is group-based, unlike `AllowUsers`, which is user-based.

Answer

DenyRootLogin yes and AllowGroups sshusers

Answer

PermitRootLogin prohibit-password and AllowGroups sshusers

Answer

PermitRootLogin no and AllowUsers sshusers

Question 3

An administrator notices that a process is running with the context 'unconfined_u:unconfined_r:unconfined_t:s0'. What does this indicate about SELinux?

Accepted Answer

The process is running in an unconfined domain.. The context 'unconfined_u:unconfined_r:unconfined_t:s0' indicates that the process is running in the unconfined domain (unconfined_t). In SELinux, processes in the unconfined domain are not restricted by the targeted policy, meaning they have full access subject to standard Linux permissions.

Answer

The process is running in permissive mode.

Answer

SELinux is disabled.

Answer

The process is confined by a targeted policy.

Question 4

A security policy requires that user passwords must be changed every 60 days, and users should be warned 7 days before expiration. Which two chage commands set these requirements for user 'jsmith'? (Choose TWO.)

Accepted Answer

chage -M 60 jsmith. Option A, `chage -M 60 jsmith`, is correct because the `-M` flag sets the maximum number of days a password remains valid before it must be changed, which directly enforces the 60-day password expiration requirement. Option C, `chage -W 7 jsmith`, is correct because the `-W` flag sets the number of days of advance warning before the password expires, satisfying the requirement to warn users 7 days ahead. Option B (`-E 60`) sets an account expiration date, not a password change interval, so it does not meet the policy. Option D (`-m 60`) sets the minimum days between password changes, which would prevent users from changing passwords for 60 days rather than requiring a change every 60 days. Option E (`-I 7`) sets the number of inactive days after password expiration before the account is locked, which is unrelated to the warning requirement.

Answer

chage -E 60 jsmith

Answer

chage -m 60 jsmith

Answer

chage -I 7 jsmith

Question 5

An administrator is configuring iptables on a server. The requirements are: allow incoming SSH (port 22) from the 192.168.1.0/24 network, drop all other incoming traffic, and allow all outgoing traffic. Which three iptables rules achieve this? (Choose THREE.)

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT. Option A is correct because it appends an INPUT rule that matches TCP packets destined for port 22 (--dport 22) with source address 192.168.1.0/24 (-s 192.168.1.0/24) and accepts them, exactly fulfilling the requirement to allow SSH only from that subnet. Option B is correct because setting the OUTPUT chain's default policy to ACCEPT (iptables -P OUTPUT ACCEPT) permits all outgoing traffic, matching the stated requirement. Option E is correct because setting the INPUT chain's default policy to DROP (iptables -P INPUT DROP) ensures that any incoming traffic not explicitly accepted by the earlier SSH rule is dropped, satisfying the 'drop all other incoming traffic' requirement. Option C is not correct because FORWARD concerns traffic routed through the host, not traffic destined to the server itself, and the scenario does not require allowing forwarded packets. Option D is not correct because it accepts SSH from any source address, not restricted to 192.168.1.0/24 as required.

Answer

iptables -P FORWARD ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Question 6

An administrator wants to restrict SSH access to only users in the 'sshusers' group. Which configuration directive should be added to /etc/ssh/sshd_config?

Accepted Answer

AllowGroups sshusers. The AllowGroups directive in /etc/ssh/sshd_config explicitly permits SSH login only for users who are members of the specified group(s). When AllowGroups sshusers is set, any user not in the 'sshusers' group is denied access, regardless of other settings. This is the correct and direct way to restrict SSH access to a specific group.

Answer

AllowUsers sshusers

Answer

Match Group sshusers

Answer

DenyGroups all

Question 7

A security policy requires that all users must have passwords with at least one uppercase letter, one digit, and a minimum length of 12 characters. Which PAM configuration file and module should be used to enforce this?

Accepted Answer

/etc/pam.d/common-password with pam_pwquality.so. The pam_pwquality.so module is specifically designed to enforce password complexity policies such as minimum length, uppercase, digit, and special character requirements. It is configured in the password stack of PAM, typically in /etc/pam.d/common-password on Debian-based systems or /etc/pam.d/system-auth on RHEL-based systems. The options for pam_pwquality (e.g., minlen=12, ucredit=-1, dcredit=-1) directly map to the policy requirements. Therefore, /etc/pam.d/common-password with pam_pwquality.so is the correct choice.

Answer

/etc/pam.d/login with pam_securetty.so

Answer

/etc/pam.d/sshd with pam_unix.so

Answer

/etc/pam.d/sudo with pam_permit.so

Question 8

A server running nftables has a rule set that allows incoming SSH from the management network (192.168.1.0/24). An administrator needs to insert a rule to drop SSH from all other sources. Which nft command accomplishes this? Assume the input chain is 'input' and the table is 'inet filter'.

Accepted Answer

nft add rule inet filter input ip saddr != 192.168.1.0/24 tcp dport 22 drop. The correct rule uses 'nft add rule' with a source address negation (ip saddr != 192.168.1.0/24) matching TCP destination port 22 and a drop verdict, which precisely drops SSH from every source outside the management network while leaving the existing allow rule intact. This is the only option that combines the correct match criteria (source negation plus SSH port) with the drop action.

Answer

nft insert rule inet filter input tcp dport 22 drop

Answer

nft replace rule inet filter input handle 1 tcp dport 22 drop

Answer

nft add rule inet filter input tcp dport 22 accept

Question 9

An administrator needs to configure SELinux to allow the Apache HTTP server to connect to a database server. Which SELinux boolean should be enabled?

Accepted Answer

httpd_can_network_connect_db. The SELinux boolean `httpd_can_network_connect_db` specifically allows the Apache HTTP server to make outbound TCP connections to database servers (e.g., MySQL, PostgreSQL). This is required when a web application needs to query a remote database. The other booleans control different aspects of httpd's behavior and do not grant network connectivity to databases.

Answer

httpd_can_network_connect

Answer

httpd_enable_cgi

Answer

httpd_use_nfs

Question 10

A file named 'webapp.conf' is being served by Apache but users get a 'Permission denied' error. The SELinux context of the file is 'unconfined_u:object_r:admin_home_t:s0'. What is the most appropriate command to fix the SELinux context?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t webapp.conf && restorecon -v webapp.conf. The most appropriate command. It adds a persistent SELinux file context rule with semanage fcontext and then applies it with restorecon, ensuring the correct type (httpd_sys_content_t) is set and preserved across system relabeling. Option D (restorecon alone) may not work if the file's path lacks a default mapping in the SELinux policy, making it unreliable for non-standard locations. Therefore, only A fully addresses the requirement for a permanent and reliable fix.

Answer

setenforce 0

Answer

chcon -t httpd_sys_content_t webapp.conf

Answer

restorecon -v webapp.conf

Question 11

An administrator notices repeated failed login attempts in /var/log/secure. The company policy requires account lockout after 5 failed attempts within 15 minutes. Which PAM module and configuration can enforce this?

Accepted Answer

pam_faillock.so with deny=5 unlock_time=900. Pam_faillock.so is the PAM module specifically designed to track failed login attempts and enforce account lockout policies. The `deny=5` parameter sets the threshold to 5 failures, and `unlock_time=900` sets the lockout duration to 900 seconds (15 minutes), matching the policy requirement exactly.

Answer

pam_unix.so with remember=5

Answer

pam_pwquality.so with minlen=5

Answer

pam_limits.so with maxlogins=5

Question 12

A system administrator is hardening SSH and needs to disable root login and password authentication. Which two directives should be set in /etc/ssh/sshd_config?

Accepted Answer

PermitRootLogin no and PasswordAuthentication no. Disabling root login and password authentication are two separate directives in sshd_config. PermitRootLogin no prevents direct SSH access for the root user, and PasswordAuthentication no disables password-based logins, forcing the use of key-based authentication. Both directives are required to meet the hardening goal.

Answer

PermitRootLogin no and ChallengeResponseAuthentication no

Answer

DenyUsers root and PasswordAuthentication no

Answer

PermitRootLogin prohibit-password and PasswordAuthentication yes

Question 13

Which command can be used to generate an SSH key pair for user authentication?

Accepted Answer

ssh-keygen. The `ssh-keygen` command is the standard tool for generating SSH key pairs (public and private keys) used for user authentication. It creates RSA, ECDSA, Ed25519, or DSA key files (e.g., `~/.ssh/id_rsa` and `~/.ssh/id_rsa.pub`) and supports options like `-t` for key type and `-b` for bit length, directly enabling passwordless login via public key authentication.

Answer

ssh-keyscan

Answer

ssh-copy-id

Answer

ssh-add

Question 14

A Linux engineer needs to restrict resource usage for users in the 'developers' group. Which TWO files or commands can be used to set ulimit values?

Accepted Answer

/etc/security/limits.conf. Option B, /etc/security/limits.conf, is correct because this is the PAM configuration file where persistent per-user or per-group resource limits (such as nproc, nofile, or memlock) are defined using entries like '@developers hard nproc 20'. Option E, the ulimit command, is correct because it is the shell builtin used to view or set soft and hard resource limits for the current shell session, for example 'ulimit -u 20' to cap processes. Option C is not correct on its own because /etc/pam.d/login with pam_limits.so is the PAM module that enforces the limits defined in limits.conf, but it is not where the ulimit values themselves are set. Option A, sysctl, is incorrect because it tunes kernel parameters at runtime (e.g., net.ipv4.ip_forward) rather than per-user resource limits. Option D, /etc/ulimit.conf, is incorrect because no such standard file exists for setting ulimit values.

Answer

sysctl command

Answer

/etc/pam.d/login with pam_limits.so

Answer

/etc/ulimit.conf

Question 15

Which THREE are valid SELinux modes?

Accepted Answer

Permissive. SELinux has exactly three operational modes, and the three correct options here are B. Permissive, C. Enforcing, and D. Disabled. Permissive mode is valid because SELinux loads the policy and logs AVC denials to the audit log but does not actually block any access, which is useful for troubleshooting. Enforcing mode is valid because it loads the policy and actively denies and logs any operation that violates the policy. Disabled mode is valid because it turns SELinux off entirely at the kernel level, so no policy is loaded and no AVC messages are generated. The unmarked options do not belong: Strict is not a mode but rather a type of policy (targeted vs. strict policy), and Audit is not an SELinux mode at all, though auditd is the userspace daemon that records AVC denials.

Answer

Strict

Answer

Audit