XK0-006 Security Practice Question
A Linux administrator wants to monitor changes to the /etc/passwd file for security auditing. Which auditctl command should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
auditctl -w /etc/passwd -p wa -k passwd_change
auditctl -w /etc/passwd -p wa -k passwd_change watches for write and attribute changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
auditctl -a always,exit -F path=/etc/passwd -F perm=wa
Why it's wrong here
This option attempts to monitor write and attribute changes to `/etc/passwd` using `perm=wa`. While `perm=wa` correctly captures modifications and metadata changes, it does not specifically track *read* access. For comprehensive security auditing of a sensitive file like `/etc/passwd`, it is crucial to log all attempts to read its contents, as unauthorised reads can also indicate a security breach or data exfiltration attempt. This command would be appropriate if the sole requirement was to audit only actual modifications to the file's content or attributes, for instance, tracking system configuration changes.
- ✗
auditctl -w /etc/passwd -p r -k passwd_read
Why it's wrong here
Monitors read access, not write.
- ✓
auditctl -w /etc/passwd -p wa -k passwd_change
Why this is correct
Correctly watches for write and attribute changes.
- ✗
ausearch -f /etc/passwd
Why it's wrong here
ausearch is for searching audit logs, not setting watches.
Go deeper
Related to this question
Learn chapter
Linux Fundamentals and History
Key term
passwd
passwd is a command-line utility used on Linux and Unix-like systems to change a user's password, typically stored in an encrypted format in the /etc/shadow file.
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
About these practice questions
This XK0-006 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.