XK0-006 Security — Timed 10 Questions

Question 1

An administrator needs to allow incoming TCP traffic on port 8443 using firewalld. Which command should be used to make this change persistent?

Accepted Answer

firewall-cmd --add-port=8443/tcp --permanent && firewall-cmd --reload. To make a firewalld port rule persistent, the `--permanent` flag must be used so the change is written to the permanent configuration, and `--reload` must be run to apply the permanent config to the running firewall. The combined command `firewall-cmd --add-port=8443/tcp --permanent && firewall-cmd --reload` accomplishes both.

Answer

firewall-cmd --zone=public --add-port=8443/tcp

Answer

firewall-cmd --add-service=8443/tcp --permanent

Answer

firewall-cmd --add-port=8443/tcp

Question 2

A system is running SELinux in enforcing mode. A custom application needs to write to /var/log/app.log. The log file shows the correct context, but access is denied. What is the most likely cause?

Accepted Answer

The SELinux boolean for the application is disabled.. When the file context is already correct but access is still denied in enforcing mode, the most likely cause is that an SELinux boolean controlling the application's ability to write to that location is disabled. Booleans are runtime toggles that allow or deny specific policy behaviors without changing file contexts. The application's domain policy may permit writing to /var/log only when the relevant boolean (e.g., httpd_can_write_audit_log or a custom boolean) is enabled.

Answer

The file context is incorrect.

Answer

The application is running in an unconfined domain.

Answer

SELinux is in permissive mode.

Question 3

Which command displays the current SELinux mode?

Accepted Answer

getenforce. The `getenforce` command displays the current SELinux mode as either Enforcing, Permissive, or Disabled. It directly queries the SELinux status from the kernel and returns the current enforcement state without requiring elevated privileges. This makes it the correct command for simply viewing the current mode.

Answer

selinuxenabled

Answer

sestatus

Answer

setenforce

Question 4

An administrator wants to audit all attempts to access the file /etc/shadow. Which auditctl command should be used?

Accepted Answer

auditctl -w /etc/shadow -p rwxa -k shadow. `auditctl -w /etc/shadow -p rwxa -k shadow` sets a watch on the file for all access types: read (r), write (w), execute (x), and attribute change (a). This captures all attempts to access the file, including reads, which matches the requirement. Option C uses `-F perm=wa`, which only logs write and attribute changes, excluding reads. Option A has invalid syntax (`-A` instead of `-a`). Option D uses `ausearch`, which is for searching audit logs, not setting rules.

Answer

auditctl -A exit,always -F path=/etc/shadow -k shadow

Answer

auditctl -a always,exit -F path=/etc/shadow -F perm=wa -k shadow

Answer

ausearch -w /etc/shadow

Question 5

Which command displays the last successful login times for all users?

Accepted Answer

lastlog. The `lastlog` command reads /var/log/lastlog and formats the most recent login time for every user account on the system, including accounts that have never logged in (shown as '**Never logged in**'). It is the purpose-built utility for reporting per-user last-login timestamps.

Answer

who /var/log/wtmp

Answer

lastb

Answer

last

Question 6

A technician needs to generate a self-signed certificate for an internal web server. Which OpenSSL command creates a new private key and a certificate signing request (CSR) in one step?

Accepted Answer

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr. The `openssl req` command with the `-new` and `-newkey` flags generates a new private key and a certificate signing request (CSR) in a single invocation. The `-newkey rsa:2048` option creates a 2048-bit RSA key, `-nodes` skips passphrase encryption, `-keyout` specifies the private key file, and `-out` specifies the CSR file. This matches the requirement to create both a private key and a CSR in one step.

Answer

openssl req -x509 -newkey rsa:2048 -nodes -keyout server.key -out server.crt

Answer

openssl genrsa -out server.key 2048 && openssl req -new -key server.key -out server.csr

Answer

openssl ca -new -key server.key -out server.csr

Question 7

A Linux administrator is troubleshooting a firewall issue using nftables. The ruleset is complex. Which two commands are useful for listing the current ruleset and adding a new rule? (Choose TWO.)

Accepted Answer

nft list ruleset. Option B, `nft list ruleset`, is correct because it is the canonical nftables command that dumps the entire currently loaded ruleset across all tables, chains, and families, which is exactly what an administrator needs when auditing a complex ruleset. Option C, `nft add rule inet filter input tcp dport 443 accept`, is correct because it uses the proper nftables syntax to append a new rule to the input chain of the inet filter table, matching TCP destination port 443 and accepting it. Option A is wrong because `nft insert rule` is an incomplete command—insert requires a full rule specification (table, chain, and match/verdict) and by itself does not add a usable rule. Option D is wrong because `nft show ruleset` is not a valid nftables subcommand; the correct verb is `list`. Option E is wrong because while `nft -a list ruleset` is a valid command that lists the ruleset with handle numbers, it is not one of the two answers marked correct for this question.

Answer

nft insert rule

Answer

nft show ruleset

Answer

nft -a list ruleset

Question 8

A Linux administrator needs to ensure that user passwords expire after 90 days. Which command should be used to enforce this policy?

Accepted Answer

chage -M 90 username. The `chage -M 90 username` command sets the maximum number of days a password is valid before it must be changed, enforcing a 90-day expiration policy. This directly modifies the `PASS_MAX_DAYS` field in `/etc/shadow` for the specified user, which the system checks during authentication.

Answer

passwd -x 90 username

Answer

passwd -e 90 username

Answer

usermod -e 90 username

Question 9

A security auditor notices that a service account's password never expires. The company policy requires password rotation every 60 days. Which command will enforce this policy for the service account?

Accepted Answer

chage -M 60 serviceacct && chage -d 0 serviceacct. chage -M 60 sets the maximum password age to 60 days. To also force a password change on next login, use -d 0.

Answer

chage -W 7 serviceacct

Answer

usermod -e 60 serviceacct

Answer

passwd -n 60 serviceacct

Question 10

A system administrator needs to configure PAM to lock a user account after 5 failed login attempts for 15 minutes. Which two PAM modules and configuration lines are appropriate? (Select TWO.)

Accepted Answer

auth required pam_tally2.so deny=5 unlock_time=900. pam_faillock can be used to lock accounts after failed attempts. The 'deny' option sets the threshold, and 'unlock_time' sets the lockout duration. Alternatively, pam_tally2 can be used with similar options.

Answer

session required pam_limits.so

Answer

account required pam_faillock.so deny=5 unlock_time=900

Answer

password required pam_pwquality.so retry=5