hardMultiple Choice
XK0-006 Practice Question: An application running under an AppArmor profile…
An application running under an AppArmor profile is being denied access to log files. The administrator wants to troubleshoot by allowing all actions and logging denials. Which command will switch the profile to complain mode?
⚠ Common exam trap
Many candidates confuse `aa-complain` with `aa-enforce`, as candidates often assume that logging denials requires enforcement mode, but complain mode is specifically designed for logging without blocking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
aa-complain /path/to/profile
The `aa-complain` command places an AppArmor profile into complain mode, which allows all actions but logs denials to the system log. This is the correct tool for troubleshooting because it lets the administrator see what the application is trying to do without actually blocking it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
aa-complain /path/to/profile
Why this is correct
Complain mode makes the AppArmor profile report denials rather than block them, satisfying the requirement to allow all actions while logging. Running aa-complain against the profile path switches it from enforce to complain, letting the application reach its log files immediately.
- ✗
aa-enforce /path/to/profile
Why it's wrong here
aa-enforce switches a profile into enforcement mode, which continues blocking the denied log-file access rather than permitting it. It is tempting because enforcement is the normal production state for AppArmor profiles, and it would be the right command when a tested profile must be locked down after troubleshooting completes.
- ✗
aa-disable /path/to/profile
Why it's wrong here
aa-disable unloads the profile entirely, so the application runs unconfined with no denial logging, defeating the troubleshooting goal. It suits permanently removing a profile from a program that should never be confined, not temporarily observing denials.
- ✗
aa-status
Why it's wrong here
aa-status only reports which profiles are loaded and whether each runs in enforce or complain mode; it cannot change that state. It is tempting because it is the standard AppArmor overview tool, and it would be the right choice when auditing which profiles are active before troubleshooting.
Go deeper
Related to this question
About these practice questions
Courseiva writes every XK0-006 question from scratch — 781 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.