hardMultiple ChoiceObjective-mapped
XK0-006 Practice Question: A company's web server running Apache on CentOS 7…
A company's web server running Apache on CentOS 7 has been compromised. The attacker exploited a vulnerability in the web application and gained access to the system as the 'apache' user. The administrator wants to prevent similar attacks in the future by hardening the server. Currently, the Apache process runs as the 'apache' user and can execute arbitrary code. The administrator considers enabling SELinux with targeted policy to confine the httpd daemon. However, after setting SELinux to enforcing and installing the 'httpd' SELinux package, the web server fails to serve pages over HTTPS. The administrator checks the audit log (/var/log/audit/audit.log) and sees denials related to port binding. What is the most likely cause of the issue?
⚠ Common exam trap
The trap here is that candidates often focus on file contexts or booleans, overlooking that SELinux also controls network port access via port labeling, which is a distinct and frequently tested concept in the XK0-005 exam.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The port 443 is not labeled with the http_port_t type; use semanage port -a -t http_port_t -p tcp 443
The issue is that SELinux is blocking Apache from binding to port 443 because that port is not labeled with the http_port_t type. By default, SELinux only allows httpd to bind to ports that have the http_port_t context (e.g., 80, 443, 8080). If port 443 lacks this label, the httpd process will be denied permission to bind, even though the firewall may allow it. The administrator must use `semanage port -a -t http_port_t -p tcp 443` to assign the correct SELinux port type.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SSL certificate files have incorrect SELinux context (e.g., httpd_sys_content_t instead of cert_t)
Why it's wrong here
This would cause file access denials, not port binding denials.
- ✗
The httpd binary must have the httpd_exec_t context
Why it's wrong here
The binary context is typically already set correctly by the package.
- ✗
The boolean httpd_enable_homedirs must be enabled to allow HTTPS
Why it's wrong here
This boolean controls access to home directories, not HTTPS.
- ✓
The port 443 is not labeled with the http_port_t type; use semanage port -a -t http_port_t -p tcp 443
Why this is correct
SELinux requires ports to be labeled for the daemon to bind. Without this, httpd cannot listen on 443.
Go deeper
Related to this question
Learn chapter
Installing Linux and Package Management
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Process
In IT service management, a process is a structured set of activities designed to accomplish a specific objective, such as managing incidents or changes, by transforming inputs into defined outputs.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.