XK0-006 Security Practice Test 6 — 15 Questions

Question 1

Which file contains the hashed passwords and password aging information for user accounts?

Accepted Answer

/etc/shadow. /etc/shadow stores password hashes and aging fields.

Answer

/etc/gshadow

Answer

/etc/group

Answer

/etc/passwd

Question 2

A security policy requires that system logs be rotated weekly and kept for 4 weeks. Which configuration file should be modified to achieve this for /var/log/syslog?

Accepted Answer

/etc/logrotate.conf. Log rotation is managed by logrotate, not by rsyslog or syslog itself. The /etc/logrotate.conf file contains global rotation settings, including frequency (weekly) and retention count (rotate 4). Adding or modifying a configuration block for /var/log/syslog in logrotate.conf (or a file in /etc/logrotate.d/) directly implements the policy requirement.

Answer

/etc/security/limits.conf

Answer

/etc/rsyslog.conf

Answer

/etc/audit/auditd.conf

Question 3

An administrator is troubleshooting an AppArmor profile that is blocking a custom application. They want to set the profile to complain mode to gather violations without enforcing. Which command should they use?

Accepted Answer

aa-complain /path/to/profile. aa-complain sets the profile to complain mode.

Answer

aa-status

Answer

apparmor_parser -r /etc/apparmor.d/profile

Answer

aa-enforce /path/to/profile

Question 4

A Linux administrator needs to configure sudo access for members of the 'wheel' group to run any command. Which two steps are required? (Choose TWO.)

Accepted Answer

Uncomment the line '%wheel ALL=(ALL) ALL' in /etc/sudoers using visudo. The line '%wheel ALL=(ALL) ALL' in /etc/sudoers grants all members of the 'wheel' group permission to execute any command as any user. This line must be uncommented using visudo, which locks the file to prevent concurrent edits and performs syntax validation before saving. Option D is correct because users must be added to the 'wheel' group using 'usermod -aG wheel username' for the sudoers rule to apply to them.

Answer

Set the setuid bit on /usr/bin/sudo

Answer

Run 'sudo visudo -c' to check syntax

Answer

Edit /etc/ssh/sshd_config to allow wheel group

Question 5

An administrator wants to harden SSH access by implementing the following: disallow root login, disable password authentication, and limit the number of authentication attempts. Which three configuration directives should be set in /etc/ssh/sshd_config? (Choose THREE.)

Accepted Answer

PermitRootLogin no. PermitRootLogin no, PasswordAuthentication no, and MaxAuthTries limit attempts.

Answer

Port 22

Answer

PermitEmptyPasswords no

Question 6

A security audit reveals that a service is running with an incorrect SELinux context. Which two commands can be used to relabel the file or directory to the correct context? (Choose TWO.)

Accepted Answer

restorecon -R /path/to/file. restorecon restores default context based on policy, and chcon can set a specific context manually.

Answer

setenforce 0

Answer

fixfiles relabel

Answer

ls -Z

Question 7

A Linux administrator needs to add a new user named 'jdoe' with a home directory and bash shell. Which command accomplishes this?

Accepted Answer

useradd -m -s /bin/bash jdoe. The useradd command creates a new user, and the -m flag creates the home directory, -s sets the shell. useradd -m -s /bin/bash jdoe is correct.

Answer

groupadd -u jdoe -s /bin/bash

Answer

adduser -h /home/jdoe -s bash jdoe

Answer

usermod -m -s /bin/bash jdoe

Question 8

An administrator wants to force a password change for user 'alice' on next login. Which command is appropriate?

Accepted Answer

passwd --expire alice. The correct command to force a password change on next login is `passwd --expire alice`. This immediately expires alice's password, requiring a change at next login. The other options are incorrect: `passwd -l` locks the account, `chage -l alice` lists account aging information without changing anything, and `usermod -f` sets the inactivity period.

Answer

passwd -l alice

Answer

chage -l alice

Answer

usermod -f alice

Question 9

A system administrator needs to configure sudo so that members of the 'wheel' group can execute any command without a password. Which line should be added to /etc/sudoers (using visudo)?

Accepted Answer

%wheel ALL=(ALL) NOPASSWD: ALL. To allow wheel group to run all commands without a password, the line should be '%wheel ALL=(ALL) NOPASSWD: ALL'.

Answer

%wheel ALL=(ALL) ALL

Answer

wheel ALL=(ALL) NOPASSWD: ALL

Answer

%wheel ALL=NOPASSWD: ALL

Question 10

A security analyst notices repeated failed login attempts on a Linux server. They want to lock the account after 3 failed attempts using PAM. Which PAM module should be configured in /etc/pam.d/sshd or /etc/pam.d/system-auth?

Accepted Answer

pam_faillock.so. pam_faillock is the recommended PAM module in modern Linux distributions (e.g., RHEL 7+, CentOS 7+) for locking accounts after a specified number of failed login attempts. While pam_tally2 is an older module, it is considered deprecated and not the standard answer for this exam. pam_pwquality is for password quality checking, and pam_unix handles standard authentication, not account locking. Therefore, only pam_faillock is the correct choice.

Answer

pam_tally2.so

Answer

pam_pwquality.so

Answer

pam_unix.so

Question 11

A web server running on port 8080 must be accessible from external networks. The system uses firewalld. Which command opens port 8080/tcp permanently in the default zone?

Accepted Answer

firewall-cmd --permanent --add-port=8080/tcp. The correct firewalld command is 'firewall-cmd --permanent --add-port=8080/tcp' followed by '--reload'.

Answer

firewall-cmd --zone=public --add-service=8080/tcp --permanent

Answer

iptables -A INPUT -p tcp --dport 8080 -j ACCEPT

Answer

firewall-cmd --add-port=8080/tcp

Question 12

A Linux server has SELinux enforcing and a custom application needs to write to /var/log/app.log. The audit log shows 'avc: denied { write } for pid=1234'. After verifying that the application runs in the correct domain, which command should be used to allow the write access by generating a policy module?

Accepted Answer

ausearch -m avc | audit2allow -M myapp. audit2allow reads audit messages and generates SELinux policy allow rules. ausearch can retrieve the specific denial, then audit2allow creates the module.

Answer

chcon -t var_log_t /var/log/app.log

Answer

setsebool -P httpd_unified 1

Answer

restorecon -v /var/log/app.log

Question 13

An administrator needs to ensure that only users from the 'ops' group can SSH into a server. Which configuration in /etc/ssh/sshd_config accomplishes this?

Accepted Answer

AllowGroups ops. The `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH access to only users who are members of the specified group. By setting `AllowGroups ops`, only users belonging to the 'ops' group will be permitted to log in via SSH, which directly meets the requirement.

Answer

Match Group ops DenyUsers *

Answer

AllowUsers ops

Answer

DenyUsers all

Question 14

A system administrator wants to monitor changes to the /etc/passwd file using auditd. Which auditctl command sets up a watch on this file?

Accepted Answer

auditctl -a always,exit -F path=/etc/passwd -F perm=wa. The correct command is `auditctl -a always,exit -F path=/etc/passwd -F perm=wa`. This creates a syscall-based audit rule that triggers on every syscall that accesses /etc/passwd with write (w) or attribute change (a) permissions, effectively monitoring any changes to the file. Option D uses `-w` for a file watch but with `-p rwxa`, which monitors reads and executes as well—not just changes—making it less precise for monitoring changes only.

Answer

ausearch -f /etc/passwd

Answer

aureport -f /etc/passwd

Answer

auditctl -w /etc/passwd -p rwxa

Question 15

A user reports being unable to log in because the password is locked. The administrator needs to unlock the account. Which command should be used?

Accepted Answer

passwd -u username. passwd -u unlocks a locked account. usermod -U also works. Among options, passwd -u is correct.

Answer

usermod -L username

Answer

passwd -l username

Answer

chage -E -1 username