XK0-006 Security Practice Test 9 — 15 Questions

Question 1

A security audit reveals that a service is running with an incorrect SELinux context. Which two commands can be used to relabel the file or directory to the correct context? (Choose TWO.)

Accepted Answer

restorecon -R /path/to/file. Option B (restorecon -R /path/to/file) is correct because restorecon resets a file or directory's SELinux context to the default defined by the system's policy, and the -R flag applies this recursively to the specified path, which is exactly what is needed to fix an incorrect context. Option C (chcon -t httpd_sys_content_t /path/to/file) is correct because chcon directly changes the SELinux type of a file or directory to the specified context (here httpd_sys_content_t), allowing an administrator to manually set the correct context. Option A (setenforce 0) only switches SELinux to permissive mode and does not relabel anything. Option D (fixfiles relabel) is a broader relabeling utility typically used to relabel the entire filesystem or all files, not to target a specific file or directory's context. Option E (ls -Z) merely displays SELinux contexts and does not modify them.

Answer

setenforce 0

Answer

fixfiles relabel

Answer

ls -Z

Question 2

A Linux administrator needs to add a new user named 'jdoe' with a home directory and bash shell. Which command accomplishes this?

Accepted Answer

useradd -m -s /bin/bash jdoe. The useradd command creates a new user, and the -m flag creates the home directory, -s sets the shell. useradd -m -s /bin/bash jdoe is correct.

Answer

groupadd -u jdoe -s /bin/bash

Answer

adduser -h /home/jdoe -s bash jdoe

Answer

usermod -m -s /bin/bash jdoe

Question 3

An administrator wants to force a password change for user 'alice' on next login. Which command is appropriate?

Accepted Answer

passwd --expire alice. The `passwd --expire alice` command (equivalent to `passwd -e alice`) immediately expires alice's password by setting the shadow file's last-change date to 0, forcing a password change at her next login. This is the standard Linux mechanism for administrators to force a one-time password reset without disabling the account.

Answer

passwd -l alice

Answer

chage -l alice

Answer

usermod -f alice

Question 4

A system administrator needs to configure sudo so that members of the 'wheel' group can execute any command without a password. Which line should be added to /etc/sudoers (using visudo)?

Accepted Answer

%wheel ALL=(ALL) NOPASSWD: ALL. To allow wheel group to run all commands without a password, the line should be '%wheel ALL=(ALL) NOPASSWD: ALL'.

Answer

%wheel ALL=(ALL) ALL

Answer

wheel ALL=(ALL) NOPASSWD: ALL

Answer

%wheel ALL=NOPASSWD: ALL

Question 5

A security analyst notices repeated failed login attempts on a Linux server. They want to lock the account after 3 failed attempts using PAM. Which PAM module should be configured in /etc/pam.d/sshd or /etc/pam.d/system-auth?

Accepted Answer

pam_faillock.so. pam_faillock.so is the modern PAM module designed to lock accounts after a configurable number of failed login attempts. It replaces the deprecated pam_tally2.so and is configured in /etc/pam.d/sshd or /etc/pam.d/system-auth with parameters like deny=3 to enforce the lockout threshold. It tracks failures per user and can automatically unlock accounts after a specified time.

Answer

pam_tally2.so

Answer

pam_pwquality.so

Answer

pam_unix.so

Question 6

A web server running on port 8080 must be accessible from external networks. The system uses firewalld. Which command opens port 8080/tcp permanently in the default zone?

Accepted Answer

firewall-cmd --permanent --add-port=8080/tcp. The correct firewalld command is 'firewall-cmd --permanent --add-port=8080/tcp' followed by '--reload'.

Answer

firewall-cmd --zone=public --add-service=8080/tcp --permanent

Answer

iptables -A INPUT -p tcp --dport 8080 -j ACCEPT

Answer

firewall-cmd --add-port=8080/tcp

Question 7

A Linux server has SELinux enforcing and a custom application needs to write to /var/log/app.log. The audit log shows 'avc: denied { write } for pid=1234'. After verifying that the application runs in the correct domain, which command should be used to allow the write access by generating a policy module?

Accepted Answer

ausearch -m avc | audit2allow -M myapp. The audit2allow workflow is the standard way to convert SELinux AVC denial messages into a loadable policy module. Piping ausearch output into audit2allow -M myapp generates a .te source file and compiles it into a myapp.pp module that can be installed with semodule -i, granting exactly the denied write permission.

Answer

chcon -t var_log_t /var/log/app.log

Answer

setsebool -P httpd_unified 1

Answer

restorecon -v /var/log/app.log

Question 8

An administrator needs to ensure that only users from the 'ops' group can SSH into a server. Which configuration in /etc/ssh/sshd_config accomplishes this?

Accepted Answer

AllowGroups ops. The `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH access to only users who are members of the specified group. By setting `AllowGroups ops`, only users belonging to the 'ops' group will be permitted to log in via SSH, which directly meets the requirement.

Answer

Match Group ops DenyUsers *

Answer

AllowUsers ops

Answer

DenyUsers all

Question 9

A user reports being unable to log in because the password is locked. The administrator needs to unlock the account. Which command should be used?

Accepted Answer

passwd -u username. The passwd -u username command unlocks a previously locked user account by removing the leading '!' from the password hash in /etc/shadow. This is the direct counterpart to passwd -l, which locks the account by prepending '!' to the hash.

Answer

usermod -L username

Answer

passwd -l username

Answer

chage -E -1 username

Question 10

Which command displays the current SELinux mode?

Accepted Answer

sestatus. The 'sestatus' command displays the current SELinux mode, including whether it is enforcing, permissive, or disabled, along with other SELinux status information.

Answer

selinuxenabled

Answer

getsebool -a

Answer

chcon

Question 11

An administrator needs to generate a self-signed certificate and private key for an internal web server. Which OpenSSL command creates both in one step?

Accepted Answer

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes. The `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes` command generates a new RSA private key and a self-signed X.509 certificate in a single step. The `-x509` flag outputs a self-signed certificate instead of a CSR, `-newkey` creates the key pair, and `-nodes` prevents encryption of the private key, which is typical for an internal web server that must start without manual passphrase entry.

Answer

openssl ca -in req.pem -out cert.pem

Answer

openssl genrsa -out key.pem 2048 && openssl req -new -x509 -key key.pem -out cert.pem -days 365

Answer

openssl x509 -req -in req.pem -signkey key.pem -out cert.pem

Question 12

A system administrator wants to limit the number of simultaneous logins for a user to 2. Which file and parameter should be configured?

Accepted Answer

/etc/security/limits.conf: username hard maxlogins 2. The `/etc/security/limits.conf` file allows setting resource limits per user or group, and the `maxlogins` parameter specifically controls the maximum number of simultaneous logins for a user. The syntax `username hard maxlogins 2` enforces a hard limit of 2 concurrent sessions for that user, which is the exact requirement. This limit is enforced by the PAM module `pam_limits.so`, which must be configured in the appropriate PAM stack file (e.g., `/etc/pam.d/login` or `/etc/pam.d/sshd`).

Answer

/etc/pam.d/login: session required pam_limits.so

Answer

/etc/security/limits.conf: @users hard maxlogins 2

Answer

/etc/security/limits.conf: username soft nproc 2

Question 13

An administrator needs to harden SSH access. Which TWO settings in /etc/ssh/sshd_config are recommended to improve security? (Choose two.)

Accepted Answer

PermitRootLogin no. Option B (PermitRootLogin no) is correct because disabling direct root logins over SSH forces attackers to compromise a normal user account and then escalate privileges, removing a high-value, well-known target and enabling accountability through sudo or su. Option D (PasswordAuthentication no) is correct because it disables password-based authentication, requiring key-based (public/private key) authentication instead, which is not vulnerable to brute-force or credential-guessing attacks. Option A (PermitRootLogin yes) is wrong because it explicitly allows root to log in directly, the opposite of hardening. Option C (Protocol 1) is wrong because SSH protocol 1 is deprecated and insecure (weak integrity/crypto), and modern OpenSSH only supports protocol 2 anyway. Option E (Port 22) is wrong because it merely sets the default port and provides no real security benefit; changing the port is at most minor obscurity, not a recommended hardening control.

Answer

PermitRootLogin yes

Answer

Protocol 1

Answer

Port 22

Question 14

A security audit reveals that a Linux system allows password-based SSH logins and has weak password policies. Which THREE actions should the administrator take to improve security? (Choose three.)

Accepted Answer

Configure pam_faillock.so to lock accounts after failed attempts. Option B is correct because configuring pam_faillock.so in the PAM stack enforces account lockout after a defined number of failed authentication attempts (e.g., deny=5, unlock_time=900), directly mitigating brute-force and password-guessing attacks against the weak password policy. Option C is correct because pam_pwquality.so enforces password complexity requirements such as minimum length (minlen), character classes (ucredit, lcredit, dcredit, ocredit), and dictionary checks, which addresses the audit finding of weak password policies at their source. Option D is correct because setting PasswordAuthentication no in sshd_config disables password-based SSH authentication entirely, forcing key-based authentication and eliminating the password-guessing attack surface the audit flagged; this requires reloading sshd (systemctl reload sshd) to take effect. Option A does not belong because merely changing the SSH port to 2222 is security through obscurity and does not fix the underlying weak authentication or password policy issues. Option E does not belong because setting PermitRootLogin yes permits direct root logins over SSH, which increases risk rather than improving security; it should be set to no or prohibit-password.

Answer

Change SSH port to 2222

Answer

Set PermitRootLogin yes

Question 15

A Linux administrator wants to prevent users from reusing their last five passwords. Which PAM module should be configured?

Accepted Answer

pam_pwhistory. The pam_pwhistory module is specifically designed to enforce password history policies by storing a user's previous passwords in a separate file (e.g., /etc/security/opasswd) and preventing reuse of those passwords. By configuring the 'remember' option in the PAM stack, the administrator can set the number of previous passwords that cannot be reused, such as 'remember=5' to block the last five passwords.

Answer

pam_faillock

Answer

pam_pwquality

Answer

pam_unix