hardMultiple SelectObjective-mapped
XK0-006 Practice Question: An administrator runs auditctl -l and ausearch -k…
Exhibit
Refer to the exhibit. # auditctl -l LIST_RULES: syscall=openat,open,creat,truncate,ftruncate key=file_monitor -a always,exclude -F msgtype=CRED_DISP -w /etc/passwd -p wa -k passwd_changes -w /etc/shadow -p wa -k shadow_changes -w /etc/group -p wa -k group_changes -w /var/log/auth.log -p wa -k auth_log # ausearch -k auth_log -ts today <no matches>
An administrator runs auditctl -l and ausearch -k auth_log -ts today as shown in the exhibit. The administrator expects to see audit events for /var/log/auth.log but gets no matches. Which TWO actions should the administrator take to resolve this issue?
⚠ Common exam trap
CompTIA often tests the misconception that loading rules with auditctl is sufficient to generate audit events, without verifying that the auditd service is actually running to process and log those events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that auditd is running with 'systemctl status auditd'
The audit daemon (auditd) must be running to process audit rules and generate events. If auditd is not active, rules loaded via auditctl will have no effect, and commands like ausearch will return no results. The administrator should verify the service status with 'systemctl status auditd' and start it if necessary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change '-p wa' to '-p rwxa' in the rule for /var/log/auth.log
Why it's wrong here
The rule already captures write and append; adding read might be unnecessary and not the cause.
- ✓
Verify that auditd is running with 'systemctl status auditd'
Why this is correct
If auditd is not running, no events are captured.
- ✗
Add '-a always,exit -S all -F path=/var/log/auth.log' to capture all syscalls
Why it's wrong here
This would be redundant and not fix the issue of no matches.
- ✗
Run 'auditctl -R /etc/audit/rules.d/audit.rules' to reload rules
Why it's wrong here
Reloading rules is not necessarily needed if rules are already loaded.
- ✓
Change the key in the ausearch command to match the rule key exactly
Why this is correct
The ausearch command uses the -k option to filter by a specific audit rule key. If the key specified in ausearch does not exactly match the key defined in the audit rule, no matching events will be displayed. The administrator should ensure the ausearch key matches the rule key (e.g., by running 'auditctl -l' to list rules and checking the key). In this case, the rule for /var/log/auth.log likely uses a different key than 'auth_log', so the ausearch command should be updated to match.
Visual reference
Go deeper
Related to this question
Learn chapter
Process Management and System Monitoring
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
systemctl
systemctl is the command-line tool used to inspect, start, stop, enable, or disable services managed by the systemd init system in Linux.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.