XK0-006 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  faillock --user username

  Why this is correct

  The faillock utility reads the tally files that pam_faillock.so maintains and prints each user's recorded failure timestamps and count. Running it with --user username displays that account's failed attempts, letting the administrator confirm the lockout cause.

• ✗

  ausearch -m USER_LOGIN -ui username

  Why it's wrong here

  ausearch queries the audit daemon's USER_LOGIN records, which capture audit events rather than pam_faillock's internal failure tally; the lockout counter lives in the faillock database, not audit logs. It is tempting where auditd is running, since audit records do show authentication attempts, but they do not reflect pam_faillock state.

• ✗

  pam_tally2 --user username

  Why it's wrong here

  pam_tally2 belongs to the older pam_tally2 module, which stores counters in /var/log/tallylog; pam_faillock writes its per-user failure records to /var/run/faillock (or /var/log/faillock), so pam_tally2 reads the wrong store and reports nothing. It is tempting because it was the standard counter-inspection tool before pam_faillock replaced it.

• ✗

  lastb username

  Why it's wrong here

  lastb reads the btmp login-failure record, which logs failed terminal and network logins, not PAM authentication counters; pam_faillock's tally is never written there. It is tempting because it lists failed logins by username, but it cannot report the faillock attempt count that triggers the lockout.

Go deeper

Related to this question