XK0-006 Security Practice Question
A security analyst notices repeated failed login attempts on a Linux server. They want to lock the account after 3 failed attempts using PAM. Which PAM module should be configured in /etc/pam.d/sshd or /etc/pam.d/system-auth?
⚠ Common exam trap
XK0-006 often tests the difference between deprecated and current PAM modules, so candidates may incorrectly choose pam_tally2.so because they remember it from older study materials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
pam_faillock.so
pam_faillock.so is the modern PAM module designed to lock accounts after a configurable number of failed login attempts. It replaces the deprecated pam_tally2.so and is configured in /etc/pam.d/sshd or /etc/pam.d/system-auth with parameters like deny=3 to enforce the lockout threshold. It tracks failures per user and can automatically unlock accounts after a specified time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
pam_faillock.so
Why this is correct
pam_faillock.so counts consecutive authentication failures per account and locks it once the configured deny threshold is reached, directly enforcing the three-attempt lockout. It is inserted into the auth and account stacks of /etc/pam.d/sshd or system-auth.
- ✗
pam_tally2.so
Why it's wrong here
pam_tally2.so counts failed logins and can lock accounts, but it was removed in newer Linux distributions in favour of pam_faillock.so, which the scenario's target systems require. It is tempting because it historically performed exactly this lockout function, and would be correct on older RHEL or Debian releases still shipping it.
- ✗
pam_pwquality.so
Why it's wrong here
pam_pwquality.so enforces password complexity and length rules at password-change time; it does not count authentication failures or lock accounts. It is tempting because it is a standard PAM module for credential hardening, and would be correct when the requirement is rejecting weak passwords rather than locking after three failed logins.
- ✗
pam_unix.so
Why it's wrong here
pam_unix.so performs password authentication and account checks; it does not count failures or lock accounts. It is tempting because it is the default auth module in system-auth, but the lockout-after-three-attempts requirement needs pam_faillock.so, which tracks failed attempts per user.
Go deeper
Related to this question
Learn chapter
Firewall and Security Basics
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 781 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.