XK0-006 Security Practice Question
A system administrator is configuring PAM to lock out users after 3 failed login attempts for 15 minutes. Which TWO PAM modules can be used together to achieve this? (Select TWO.)
⚠ Common exam trap
The trap here is that candidates often select pam_tally2.so (option B) because it was historically used for this purpose, but the exam expects knowledge of the modern, supported module pam_faillock.so, and they may also mistakenly think pam_unix.so alone handles lockout when it only performs standard Unix authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
pam_faillock.so
pam_faillock.so is the modern PAM module designed to track failed login attempts and enforce account lockout policies. It can be configured with parameters like `deny=3` to lock after three failures and `unlock_time=900` to set a 15-minute lockout duration. This module is the recommended replacement for the deprecated pam_tally2.so in current Linux distributions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
pam_faillock.so
Why this is correct
pam_faillock can enforce lockout after failed attempts.
- ✗
pam_tally2.so
Why it's wrong here
pam_tally2 is an alternative, but not typically used with pam_faillock; they conflict.
- ✗
pam_limits.so
Why it's wrong here
pam_limits manages resource limits, not lockout.
- ✗
pam_pwquality.so
Why it's wrong here
pam_pwquality enforces password complexity, not lockout.
- ✓
pam_unix.so
Why this is correct
pam_unix handles authentication and works with pam_faillock.
Go deeper
Related to this question
Learn chapter
Linux Fundamentals and History
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
PAM
Privileged Access Management (PAM) is a security framework that controls, monitors, and audits access to critical systems and accounts with elevated permissions.
About these practice questions
This XK0-006 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.