XK0-006 Security Practice Question
A Linux server has SELinux enforcing and a custom application needs to write to /var/log/app.log. The audit log shows 'avc: denied { write } for pid=1234'. After verifying that the application runs in the correct domain, which command should be used to allow the write access by generating a policy module?
⚠ Common exam trap
XK0-006 often tests the distinction between labeling commands (chcon, restorecon), boolean toggles (setsebool), and policy generation (audit2allow), so candidates must recognize that only audit2allow produces a policy module.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ausearch -m avc | audit2allow -M myapp
The audit2allow workflow is the standard way to convert SELinux AVC denial messages into a loadable policy module. Piping ausearch output into audit2allow -M myapp generates a .te source file and compiles it into a myapp.pp module that can be installed with semodule -i, granting exactly the denied write permission.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ausearch -m avc | audit2allow -M myapp
Why this is correct
ausearch extracts the AVC denial records from the audit log and pipes them into audit2allow, which translates the denials into allow rules and compiles them into a loadable module named myapp. This satisfies the requirement to generate a policy module granting the write access.
- ✗
chcon -t var_log_t /var/log/app.log
Why it's wrong here
chcon changes only the file's current SELinux type label; it generates no policy module and the relabel is lost on the next restorecon. It is tempting because type labels are what the AVC denial references, so relabelling /var/log/app.log would be correct if the file simply carried the wrong context.
- ✗
setsebool -P httpd_unified 1
Why it's wrong here
setsebool toggles the predefined httpd_unified boolean, which governs Apache's own domain, not the custom application's domain. It is tempting because booleans are the standard way to grant extra SELinux permissions, and it would be correct if the denied process ran in the httpd_t domain.
- ✗
restorecon -v /var/log/app.log
Why it's wrong here
restorecon resets /var/log/app.log to its default policy-defined context; it writes no allow rule, so the denial recurs. It is tempting because restorecon fixes mislabelled files, and it would be correct if the audit log showed a wrong type on the target rather than a missing permission for a correctly labelled domain.
Go deeper
Related to this question
Learn chapter
Installing Linux and Package Management
Key term
Output
In IT service management, output is the result or deliverable produced by a process, system, or component, such as data, reports, or services delivered to a customer.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.