XK0-006 Security Practice Question
An administrator is troubleshooting an AppArmor profile that is blocking a custom application. They want to set the profile to complain mode to gather violations without enforcing. Which command should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
aa-complain /path/to/profile
aa-complain sets the profile to complain mode.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
aa-status
Why it's wrong here
aa-status only reports which profiles are loaded, loaded in complain mode, or enforcing; it changes nothing. It is tempting because checking current profile state is a sensible first troubleshooting step, but gathering violations requires switching the profile with aa-complain rather than merely inspecting it.
- ✓
aa-complain /path/to/profile
Why this is correct
`aa-complain` switches an AppArmor profile from enforce to complain mode, logging policy violations without blocking the application. This directly satisfies the administrator's requirement to gather violations without enforcement, unlike `aa-enforce`, which would keep blocking. Passing the profile path targets that specific profile rather than all loaded profiles.
- ✗
apparmor_parser -r /etc/apparmor.d/profile
Why it's wrong here
apparmor_parser -r reloads a profile from disk, reapplying whatever mode is already declared in the file, so it does not switch to complain mode. It is tempting because reloading is the normal step after editing a profile, but the correct approach is aa-complain, which sets the profile's mode flag directly.
- ✗
aa-enforce /path/to/profile
Why it's wrong here
aa-enforce sets a profile to enforcing mode, the opposite of what is required. It is tempting because administrators routinely toggle profiles between modes and the command name matches that workflow, but complain mode requires aa-complain, which logs violations without blocking the application's operations.
Go deeper
Related to this question
About these practice questions
Courseiva writes every XK0-006 question from scratch — 781 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.