XK0-006 Security Practice Question
A Linux administrator needs to ensure that user passwords meet a minimum length requirement of 12 characters. The system uses PAM and the pam_pwquality module. Which file should the administrator edit to set the minlen parameter?
⚠ Common exam trap
The trap here is assuming that PASS_MIN_LEN in /etc/login.defs controls password length for all changes, when it is only used by certain account creation tools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
/etc/security/pwquality.conf
The pam_pwquality module's parameters, including minlen, are configured in /etc/security/pwquality.conf. This centralized file is read by the module whenever a password is set or changed, provided the PAM stack includes pam_pwquality. Other files like login.defs may contain password aging settings but do not control PAM-based quality checks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
/etc/security/pwquality.conf
Why this is correct
The pam_pwquality module reads its configuration from /etc/security/pwquality.conf, where parameters like minlen, dcredit, and ucredit are defined. Setting minlen = 12 in this file enforces a minimum password length of 12 characters for all users, assuming the PAM stack includes pam_pwquality.
- ✗
/etc/pam.d/system-auth
Why it's wrong here
This file defines the PAM stack for system authentication and can include pam_pwquality, but it is not where the minlen parameter is set. Modifying it to add options like minlen=12 directly on the pam_pwquality line is possible but non-standard; the recommended location for such parameters is the module's own configuration file.
- ✗
/etc/security/limits.conf
Why it's wrong here
This file configures resource limits for user processes, such as maximum number of open files or CPU time. It has no relation to password quality or length enforcement. Editing it would not affect password policies and would be entirely ineffective for the stated requirement.
- ✗
/etc/login.defs
Why it's wrong here
This file contains shadow password suite configuration such as PASS_MAX_DAYS and PASS_MIN_LEN, but PASS_MIN_LEN is only enforced by tools like useradd and is not used by PAM for password changes. It does not affect the pam_pwquality module's behavior, so it would not enforce the requirement for all password changes.
Go deeper
Related to this question
Learn chapter
File Permissions and Ownership
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.