XK0-006 Security Practice Test 8 — 15 Questions

Question 1

A security team wants to restrict SSH access to only users in the 'sshusers' group. Which configuration line in /etc/ssh/sshd_config achieves this?

Accepted Answer

AllowGroups sshusers. The `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH login to users who are members of the specified group. By setting `AllowGroups sshusers`, only users in the 'sshusers' group are permitted to authenticate via SSH, meeting the security team's requirement.

Answer

DenyGroups sshusers

Answer

AllowUsers sshusers

Answer

Subsystem sftp /usr/lib/openssh/sftp-server

Question 2

An administrator notices that an AppArmor profile is in complain mode for a service that should be enforcing. Which command changes the profile to enforce mode?

Accepted Answer

aa-enforce /etc/apparmor.d/profile. aa-enforce sets a profile to enforce mode. aa-complain sets to complain, aa-status shows status, and apparmor_parser loads profiles.

Answer

apparmor_parser -r /etc/apparmor.d/profile

Answer

aa-status --enforce /etc/apparmor.d/profile

Answer

aa-complain /etc/apparmor.d/profile

Question 3

Which command displays the current SELinux mode?

Accepted Answer

getenforce. getenforce displays the current SELinux mode (Enforcing, Permissive, Disabled). sestatus provides more detail including mode and policy version. setenforce changes mode, getsebool shows booleans.

Answer

sestatus

Answer

setenforce

Answer

getsebool -a

Question 4

A security audit has identified that several users have excessive sudo privileges. The administrator needs to review and modify sudo access. Which two files or commands would be used? (Choose TWO.)

Accepted Answer

visudo. visudo is the recommended way to edit /etc/sudoers safely. The file /etc/sudoers contains the rules. /etc/sudoers.d/ is a directory for drop-in files. The other options are unrelated.

Answer

chage

Answer

usermod -G

Answer

/etc/group

Question 5

An administrator is configuring a firewall using iptables to block all incoming traffic except SSH on port 22. Which three rules correctly implement this? (Choose THREE.)

Accepted Answer

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT. The correct approach: set default policy to DROP on INPUT, then allow established/related connections, then allow SSH. The other options either drop all (blocking SSH), use wrong chain, or allow all.

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP

Answer

iptables -A INPUT -j DROP

Question 6

A Linux administrator needs to implement password complexity rules requiring at least one uppercase letter, one digit, and a minimum length of 10 characters. Which two PAM configuration entries would be used? (Choose TWO.)

Accepted Answer

password requisite pam_pwquality.so minlen=10 ucredit=1 dcredit=1. The `pam_pwquality.so` module enforces password complexity rules. The `minlen=10` parameter sets the minimum password length to 10 characters, `ucredit=1` requires at least one uppercase letter, and `dcredit=1` requires at least one digit. The `requisite` control ensures that if these checks fail, authentication is immediately denied. Option E is also correct because `enforce_for_root` applies the same complexity rules to the root user, which is often needed to fully enforce the policy. Options A, B, and D are incorrect: `pam_pwhistory.so` is for password history, not complexity; `pam_unix.so` does not enforce complexity; `pam_faillock.so` is an `auth` module for account lockout, not password strength.

Answer

password required pam_pwhistory.so use_authtok

Answer

password required pam_unix.so

Answer

auth required pam_faillock.so

Question 7

A Linux administrator needs to add a new user named 'jdoe' with a home directory and default shell /bin/bash. Which command should be used?

Accepted Answer

useradd -m -s /bin/bash jdoe. The useradd command is used to create new users. The -m option creates the home directory, and -s sets the shell. usermod modifies existing users, passwd sets passwords, and chage manages password aging.

Answer

chage -m -s /bin/bash jdoe

Answer

passwd -m -s /bin/bash jdoe

Answer

usermod -m -s /bin/bash jdoe

Question 8

A security policy requires that users cannot reuse any of their last 5 passwords. Which PAM module and configuration directive enforces this?

Accepted Answer

pam_pwhistory with remember=5. The pam_pwhistory module with the remember directive tracks password history and prevents reuse. pam_pwquality enforces complexity, pam_faillock handles lockout, and pam_tally2 is an older lockout module.

Answer

pam_faillock with deny=5

Answer

pam_tally2 with deny=5

Answer

pam_pwquality with remember=5

Question 9

An administrator notices that a custom application uses port 8443/TCP. To allow external access, which firewalld command permanently opens this port in the default zone?

Accepted Answer

firewall-cmd --add-port=8443/tcp --permanent. The correct command is firewall-cmd --permanent --add-port=8443/tcp. The --permanent flag makes it persistent, --add-port opens the port, and the syntax includes protocol. --add-service is for predefined services, not port numbers.

Answer

firewall-cmd --add-service=8443/tcp --zone=public --permanent

Answer

firewall-cmd --add-port=8443 --permanent

Answer

firewall-cmd --permanent --add-port=8443

Question 10

A system administrator needs to ensure that the Apache web server can read files in /var/www/html, which has the SELinux context httpd_sys_content_t. However, Apache is unable to access the files. What command should be used to apply the correct context to the directory and its contents?

Accepted Answer

restorecon -Rv /var/www/html. The directory /var/www/html already has the correct SELinux type (httpd_sys_content_t) as stated, but Apache cannot access the files. This suggests that the file contexts are not correctly applied or are mislabeled. The restorecon -Rv command resets the SELinux context of the directory and its contents to the default policy-defined context (httpd_sys_content_t), ensuring consistent labeling. This directly resolves the access issue without needing to define or change the context type.

Answer

chcon -R -t httpd_sys_content_t /var/www/html

Answer

fixfiles -R restore /var/www/html

Answer

semanage fcontext -a -t httpd_sys_content_t /var/www/html

Question 11

Which of the following correctly describes the purpose of the /etc/shadow file?

Accepted Answer

It stores encrypted passwords and password aging fields.. The /etc/shadow file stores encrypted (hashed) user passwords and password aging information such as the date of last password change, minimum/maximum password age, and account expiration. This file is readable only by root to protect password hashes from unauthorized access, unlike /etc/passwd which is world-readable.

Answer

It stores the list of users who can use sudo.

Answer

It stores group memberships and group passwords.

Answer

It stores user account information including UID, GID, and shell.

Question 12

An administrator configures /etc/ssh/sshd_config with the following settings: PermitRootLogin no, PasswordAuthentication no, AllowUsers alice bob, MaxAuthTries 2. After restarting sshd, which of the following is true?

Accepted Answer

User bob can log in using a public key.. PasswordAuthentication no disables password logins, so public key authentication is required. PermitRootLogin no prevents root login entirely. AllowUsers restricts to alice and bob only. MaxAuthTries 2 limits authentication attempts. So root cannot log in even with keys, and alice/bob must use keys.

Answer

User charlie can log in using a public key.

Answer

User alice can log in using a password.

Answer

Root can log in using a valid password.

Question 13

A security audit reveals that the system's PAM configuration does not enforce password complexity. Which PAM module and configuration line should be added to /etc/pam.d/common-password to require at least one uppercase letter, one digit, and a minimum length of 12 characters?

Accepted Answer

password requisite pam_pwquality.so minlen=12 ucredit=-1 dcredit=-1. pam_pwquality is the module for password complexity. The options ucredit=-1, dcredit=-1, minlen=12 enforce the requirements. pam_unix handles password hashing, pam_faillock handles lockout, and pam_cracklib is an older module (deprecated in favor of pam_pwquality).

Answer

password sufficient pam_faillock.so minlen=12 ucredit=-1 dcredit=-1

Answer

password required pam_cracklib.so minlen=12 ucredit=-1 dcredit=-1

Answer

password required pam_unix.so minlen=12 ucredit=-1 dcredit=-1

Question 14

Which command displays the current SELinux mode (e.g., enforcing, permissive, disabled)?

Accepted Answer

getenforce. getenforce shows the current mode. getsebool shows boolean values. sestatus shows more detailed status including mode and policy. seinfo shows policy information.

Answer

getsebool -a

Answer

seinfo

Answer

sestatus

Question 15

An administrator runs 'auditctl -w /etc/passwd -p wa -k passwd_changes' to monitor changes to /etc/passwd. Which command should be used to search the audit log for all events related to this watch?

Accepted Answer

ausearch -k passwd_changes. The `ausearch -k passwd_changes` command is correct because it searches the audit log for events that were tagged with the key `passwd_changes` when the watch was created via `auditctl -w /etc/passwd -p wa -k passwd_changes`. The `-k` option in `auditctl` assigns a key to the rule, and `ausearch` uses that same key to filter and retrieve matching audit records from `/var/log/audit/audit.log`.

Answer

auditctl -l -k passwd_changes

Answer

tail -f /var/log/audit/audit.log | grep passwd_changes

Answer

aureport -k passwd_changes