hardMultiple ChoiceObjective-mapped
XK0-006 Practice Question: A Linux server in a DMZ is experiencing…
A Linux server in a DMZ is experiencing intermittent SSH lockouts. The /var/log/secure shows repeated failed login attempts from multiple IP addresses, but then suddenly the administrator cannot SSH in even with correct credentials. The administrator suspects a brute-force protection mechanism. The server uses PAM with pam_tally2 for login counting. The administrator checks /etc/pam.d/sshd and sees: auth required pam_tally2.so deny=3 unlock_time=300 onerr=succeed file=/var/log/tallylog. What is the most likely reason the administrator is locked out even after 5 minutes?
⚠ Common exam trap
Watch out — candidates often assume pam_tally2 applies equally to all users, including root, without realizing the default exemption for root and the need for the 'even_deny_root' option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The root account is not subject to pam_tally2 without the 'even_deny_root' option, so the lockout is from another mechanism
Pam_tally2 does not apply to the root account unless the 'even_deny_root' option is explicitly added to the pam_tally2 configuration line. Since the administrator is likely logging in as root (or the root account is being targeted), the lockout observed is not from pam_tally2 but from another mechanism such as sshd's own MaxAuthTries or a separate service like fail2ban. The configuration shown only denies regular users after 3 failures and unlocks after 300 seconds, but root remains unaffected by this rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The SSH server is not configured with UsePAM yes, so pam_tally2 is not applied
Why it's wrong here
Incorrect. UsePAM yes is required for pam_tally2 to function, but the issue is that the administrator is locked out despite pam_tally2 not affecting root. The configuration shown implies UsePAM is enabled; otherwise, pam_tally2 wouldn't work at all.
- ✗
The tallylog file has incorrect permissions, preventing pam_tally2 from reading the count
Why it's wrong here
Incorrect. If the tallylog file had incorrect permissions, pam_tally2 would fail to update the count, but it would not cause a lockout. The lockout is likely due to a different mechanism targeting the root account.
- ✓
The root account is not subject to pam_tally2 without the 'even_deny_root' option, so the lockout is from another mechanism
Why this is correct
Correct. pam_tally2 does not apply to the root account unless the 'even_deny_root' option is added. Since the administrator is likely logging in as root, the lockout is from another source like sshd's MaxAuthTries or fail2ban.
- ✗
The DenyHosts service is running and blocks IPs after too many failures
Why it's wrong here
Incorrect. DenyHosts is a third-party service that can block IPs, but it is not mentioned in the scenario. The lockout observed is more likely due to sshd's default behavior or a similar mechanism, not specifically DenyHosts.
Go deeper
Related to this question
Learn chapter
Linux Fundamentals and History
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
About these practice questions
One of 979 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.