easyMultiple ChoiceObjective-mapped
XK0-006 Practice Question: A Linux administrator needs to implement file…
A Linux administrator needs to implement file integrity monitoring to detect unauthorized changes to critical system binaries. The administrator decides to use the 'aide' tool. After installing AIDE and initializing the database with 'aide --init', the database is placed at /var/lib/aide/aide.db.new.gz. The administrator then runs 'aide --check' and receives several warnings about files in /tmp being modified. However, the administrator is not concerned about /tmp. What is the simplest way to exclude the /tmp directory from future checks?
⚠ Common exam trap
Test-takers frequently think '--update' or moving the database will exclude directories, when in fact only the configuration file controls which paths are monitored.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Edit /etc/aide.conf to add a '!/tmp' directive to exclude /tmp from checking, then run 'aide --init' to rebuild the database
AIDE uses a configuration file (/etc/aide.conf) to define which directories and files to monitor. Adding '!/tmp' to this file tells AIDE to exclude the /tmp directory from all future checks. After editing the configuration, running 'aide --init' rebuilds the database based on the new rules, ensuring /tmp is no longer tracked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run 'aide --update' to update the database with current state of /tmp
Why it's wrong here
This would include /tmp as baseline, not exclude it.
- ✗
Move the database to a different location so /tmp is not included
Why it's wrong here
The database location does not affect what is checked; it only stores the baseline.
- ✗
Run 'aide --check --verbose' to see more details and manually ignore /tmp messages
Why it's wrong here
Verbose output does not exclude; it just shows more detail.
- ✓
Edit /etc/aide.conf to add a '!/tmp' directive to exclude /tmp from checking, then run 'aide --init' to rebuild the database
Why this is correct
The exclamation mark in aide.conf excludes a directory from monitoring.
Go deeper
Related to this question
About these practice questions
Courseiva writes every XK0-006 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.