XK0-006 Security Practice Question
A security analyst notices repeated failed login attempts on a Linux server. They want to lock the account after 3 failed attempts using PAM. Which PAM module should be configured in /etc/pam.d/sshd or /etc/pam.d/system-auth?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
pam_faillock.so
pam_faillock is the recommended PAM module in modern Linux distributions (e.g., RHEL 7+, CentOS 7+) for locking accounts after a specified number of failed login attempts. While pam_tally2 is an older module, it is considered deprecated and not the standard answer for this exam. pam_pwquality is for password quality checking, and pam_unix handles standard authentication, not account locking. Therefore, only pam_faillock is the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
pam_faillock.so
Why this is correct
Correct. pam_faillock is the recommended module in current Linux distributions to lock accounts after failed attempts, configurable in /etc/pam.d/sshd or system-auth.
- ✗
pam_tally2.so
Why it's wrong here
Incorrect. While pam_tally2 can also lock accounts, it is an older module not recommended for modern distributions; the question expects pam_faillock.
- ✗
pam_pwquality.so
Why it's wrong here
Incorrect. pam_pwquality is used for enforcing password complexity, not for account locking.
- ✗
pam_unix.so
Why it's wrong here
Incorrect. pam_unix handles standard authentication but does not provide account locking functionality.
Go deeper
Related to this question
Learn chapter
Linux Fundamentals and History
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
PAM
Privileged Access Management (PAM) is a security framework that controls, monitors, and audits access to critical systems and accounts with elevated permissions.
About these practice questions
One of 979 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.