hardMultiple ChoiceObjective-mapped
XK0-006 Practice Question: An administrator notices that new SSH sessions…
Exhibit
Refer to the exhibit. /etc/pam.d/sshd: auth required pam_sepermit.so auth substack password-auth auth include postlogin account required pam_nologin.so account include password-auth password include password-auth session required pam_selinux.so close session required pam_loginuid.so session required pam_selinux.so open session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth session include postlogin
An administrator notices that new SSH sessions fail for all users. Which line in the exhibit is most likely causing the failure?
⚠ Common exam trap
It's easy for candidates to confuse the 'account' stack with the 'auth' or 'session' stacks, mistakenly thinking a missing authentication module (like pam_sepermit.so) or a session module (like pam_loginuid.so) is the cause, when in fact the account-level pam_nologin.so is specifically designed to block new logins system-wide.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
account required pam_nologin.so
The line 'account required pam_nologin.so' causes new SSH sessions to fail because the pam_nologin module checks for the existence of /etc/nologin. If that file exists, it denies login to all non-root users. This is commonly used during maintenance to prevent new logins, and since the question states 'all users' (including root if root is not explicitly exempted), this PAM module is the direct cause of the failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
account required pam_nologin.so
Why this is correct
If /etc/nologin exists, this module denies login to all non-root users.
- ✗
session include password-auth
Why it's wrong here
This includes default password authentication session rules, typically not causing failures.
- ✗
auth required pam_sepermit.so
Why it's wrong here
This is for SELinux and typically not the cause of total login failure.
- ✗
session required pam_loginuid.so
Why it's wrong here
This sets the loginuid process attribute and is standard.
Go deeper
Related to this question
Learn chapter
File Permissions and Ownership
Key term
PAM
Privileged Access Management (PAM) is a security framework that controls, monitors, and audits access to critical systems and accounts with elevated permissions.
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
About these practice questions
One of 979 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.