XK0-006 Security Practice Question
A file named 'webapp.conf' is being served by Apache but users get a 'Permission denied' error. The SELinux context of the file is 'unconfined_u:object_r:admin_home_t:s0'. What is the most appropriate command to fix the SELinux context?
⚠ Common exam trap
The trap is that candidates often choose chcon (option C) because it works immediately without additional commands. However, chcon changes are not persistent across file relabeling (e.g., after a full restorecon or system policy update), making semanage fcontext the recommended approach for a permanent fix.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
semanage fcontext -a -t httpd_sys_content_t webapp.conf && restorecon -v webapp.conf
The most appropriate command. It adds a persistent SELinux file context rule with semanage fcontext and then applies it with restorecon, ensuring the correct type (httpd_sys_content_t) is set and preserved across system relabeling. Option D (restorecon alone) may not work if the file's path lacks a default mapping in the SELinux policy, making it unreliable for non-standard locations. Therefore, only A fully addresses the requirement for a permanent and reliable fix.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
semanage fcontext -a -t httpd_sys_content_t webapp.conf && restorecon -v webapp.conf
Why this is correct
The file carries the admin_home_t type, which Apache's httpd_t domain cannot read, causing the denial. `semanage fcontext -a -t httpd_sys_content_t` adds a persistent mapping in the file-context policy, and `restorecon` applies it to webapp.conf, satisfying the requirement that the file hold the httpd content type.
- ✗
setenforce 0
Why it's wrong here
Incorrect. setenforce 0 disables SELinux temporarily, which is not a proper fix and reduces security.
- ✗
chcon -t httpd_sys_content_t webapp.conf
Why it's wrong here
Incorrect. chcon changes the context immediately but is not persistent; it will be lost after a restorecon or policy update.
- ✗
restorecon -v webapp.conf
Why it's wrong here
restorecon resets a file's context to the default defined by its parent directory's policy, which here would be admin_home_t rather than the httpd_sys_content_t Apache requires. It is tempting because restorecon is the standard relabelling tool, but it would be correct only if the file sat in a directory whose policy already mapped to the right type.
Go deeper
Related to this question
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.