XK0-006 Security Practice Question
A file named 'webapp.conf' is being served by Apache but users get a 'Permission denied' error. The SELinux context of the file is 'unconfined_u:object_r:admin_home_t:s0'. What is the most appropriate command to fix the SELinux context?
⚠ Common exam trap
The trap is that candidates often choose chcon (option C) because it works immediately without additional commands. However, chcon changes are not persistent across file relabeling (e.g., after a full restorecon or system policy update), making semanage fcontext the recommended approach for a permanent fix.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
semanage fcontext -a -t httpd_sys_content_t webapp.conf && restorecon -v webapp.conf
The most appropriate command. It adds a persistent SELinux file context rule with semanage fcontext and then applies it with restorecon, ensuring the correct type (httpd_sys_content_t) is set and preserved across system relabeling. Option D (restorecon alone) may not work if the file's path lacks a default mapping in the SELinux policy, making it unreliable for non-standard locations. Therefore, only A fully addresses the requirement for a permanent and reliable fix.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
semanage fcontext -a -t httpd_sys_content_t webapp.conf && restorecon -v webapp.conf
Why this is correct
Correct. semanage fcontext adds a persistent rule, then restorecon applies it, ensuring the context survives relabeling.
- ✗
setenforce 0
Why it's wrong here
Incorrect. setenforce 0 disables SELinux temporarily, which is not a proper fix and reduces security.
- ✗
chcon -t httpd_sys_content_t webapp.conf
Why it's wrong here
Incorrect. chcon changes the context immediately but is not persistent; it will be lost after a restorecon or policy update.
- ✗
restorecon -v webapp.conf
Why it's wrong here
Incorrect as the most appropriate. restorecon applies the default context from the policy, but if no mapping exists for the file's path, it may not set httpd_sys_content_t. It is not guaranteed and lacks persistence.
Go deeper
Related to this question
About these practice questions
One of 979 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.