XK0-006 SELinux context Practice Question
A file on an SELinux-enabled system has the security context 'unconfined_u:object_r:httpd_sys_content_t:s0'. A web server needs to read it, but it is being denied. Which command changes the context to allow access?
⚠ Common exam trap
Candidates often mistakenly select `chcon` because it directly changes the context, but the file already has the correct type. Others may choose `semanage fcontext` thinking it will fix the denial, but adding a file-context rule does not alter the current context and won't resolve the immediate access problem. The correct approach is to adjust the SELinux boolean that controls the web server's ability to read the content.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
setsebool -P httpd_read_content on
The file already has the correct SELinux type 'httpd_sys_content_t', so the denial is likely due to a missing policy boolean. The command `setsebool -P httpd_read_content on` enables a boolean that permits the web server to read content labeled with that type. This permanently resolves the access issue without altering the file's context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
chcon -t httpd_sys_content_t /path/to/file
Why it's wrong here
chcon sets the SELinux type temporarily, but the file already has the correct type; this command does not resolve the underlying policy denial.
- ✓
setsebool -P httpd_read_content on
Why this is correct
setsebool -P httpd_read_content on enables the necessary boolean to allow httpd to read files with httpd_sys_content_t, fixing the access denial permanently.
- ✗
semanage fcontext -a -t httpd_sys_content_t /path/to/file
Why it's wrong here
semanage fcontext adds a persistent file-context rule, but the file currently already has the target type; it will not resolve the current denial and is meant for paths that need a non-default type after a relabel.
- ✗
restorecon -v /path/to/file
Why it's wrong here
restorecon restores the default SELinux context for the file's path, which may change the type to something else and potentially worsen the access problem.
Visual reference
Go deeper
Related to this question
About these practice questions
This XK0-006 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.