XK0-006 Security Practice Question
An administrator wants to enforce an account lockout policy after five failed login attempts on a Linux system. Which PAM module should be added to the authentication stack?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
pam_faillock.so
pam_faillock is used for account lockout after failed attempts. pam_unix handles authentication, pam_pwquality checks password strength, pam_tally2 is an older module.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
pam_faillock.so
Why this is correct
`pam_faillock.so` counts consecutive failed authentications per account and locks the account once the threshold is reached, satisfying the five-attempt lockout requirement. Configure it via `pam_faillock` in both the `auth` and `account` stacks, since the `account` phase enforces the lockout after the counter trips.
- ✗
pam_unix.so
Why it's wrong here
pam_unix.so performs standard password and shadow-file authentication; it verifies credentials but does not count failures or lock accounts. It would be correct as the base authentication module in the stack. Lockout after five failures requires a module that tracks and denies repeated attempts.
- ✗
pam_pwquality.so
Why it's wrong here
pam_pwquality.so enforces password strength rules such as length and complexity at change time; it never counts failed logins or locks accounts. It would be correct when hardening password composition policy. Enforcing lockout after five failed attempts needs a module that tallies authentication failures.
- ✗
pam_tally2.so
Why it's wrong here
pam_tally2.so counts failed authentication attempts and locks accounts after a threshold, but it was removed in newer PAM releases in favour of pam_faillock.so. It would be correct on older distributions still shipping it. On current systems, pam_faillock.so provides the required lockout behaviour.
Go deeper
Related to this question
Learn chapter
Linux Fundamentals and History
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
PAM
Privileged Access Management (PAM) is a security framework that controls, monitors, and audits access to critical systems and accounts with elevated permissions.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 781 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.