XK0-006 Security Practice Question
A security audit reveals that an SELinux boolean 'httpd_can_network_connect' is currently off, but a web application requires Apache to connect to a database server. Which command should the administrator use to enable this boolean persistently?
⚠ Common exam trap
XK0-006 often tests the -P flag for persistence — candidates pick setsebool without -P and fail the 'persistently' requirement, or confuse setsebool with setenforce.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
setsebool -P httpd_can_network_connect on
The command 'setsebool -P httpd_can_network_connect on' is correct because setsebool modifies SELinux booleans at runtime, and the -P flag makes the change persistent across reboots by writing it to the policy store. This enables Apache to initiate network connections to the database server as required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
setenforce 1
Why it's wrong here
setenforce toggles SELinux between enforcing and permissive modes globally; it does not alter the httpd_can_network_connect boolean, so Apache remains blocked. It is tempting because it addresses SELinux denials broadly, and would be correct when troubleshooting whether SELinux itself causes a failure.
- ✗
setsebool httpd_can_network_connect 1
Why it's wrong here
Without the -P flag, setsebool changes the boolean only in memory, so the setting reverts at reboot and fails the persistence requirement. It is tempting because it does toggle the boolean immediately, and would be correct for a temporary change during testing.
- ✓
setsebool -P httpd_can_network_connect on
Why this is correct
The `-P` flag writes the change into the persistent SELinux policy, so `httpd_can_network_connect` stays enabled across reboots. Without it, `setsebool` only alters the running state, which the audit would flag again after restart. This satisfies the requirement for persistent enablement of Apache's outbound database connection.
- ✗
getsebool httpd_can_network_connect
Why it's wrong here
getsebool only reports the boolean's current value; it makes no change, so the application stays unable to connect. It is tempting because it confirms the audit finding, and would be correct as a verification step before or after enabling the boolean.
Go deeper
Related to this question
About these practice questions
This XK0-006 question is part of Courseiva's 781-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.