hardMultiple Choice
XK0-006 Practice Question: Based on the exhibit, what is the purpose of the…
Exhibit
Refer to the exhibit. # auditctl -l LIST_RULES: exit,always auid>=1000 auid!=4294967295 (0xffffffff) syscall=open key=user-open # ausearch -k user-open ---- time->Thu Jan 1 12:00:00 2025 type=SYSCALL msg=audit(1735689600.123:456): arch=c000003e syscall=2 success=yes exit=3 a0=7ffe... a1=0 a2=1c a3=7f... items=1 ppid=1234 pid=5678 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=pts0 ses=1 comm="cat" exe="/usr/bin/cat" key="user-open"
Based on the exhibit, what is the purpose of the audit rule?
⚠ Common exam trap
CompTIA often tests the direction of comparison operators in audit rules — candidates frequently confuse `uid>=1000` (monitor UIDs 1000 and above) with `uid<1000` (monitor UIDs below 1000), leading them to select the exclusion-based option D instead of the correct inclusion-based option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Monitor all open syscalls by users with UID 1000 or higher.
The audit rule `-a always,exit -F arch=b64 -S open -F uid>=1000 -k monitor_open` uses the `uid>=1000` filter to match only system calls made by users with UID 1000 or higher. This is a common Linux auditd rule to track user-level activity while excluding system accounts (typically UIDs below 1000). Option C correctly identifies that the rule monitors all open syscalls by users with UID 1000 or higher.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Monitor open syscalls on a specific file.
Why it's wrong here
The rule watches the openat syscall generally rather than a path, so no specific file is targeted. Adding a -F path= clause naming the file is what you would configure when auditing reads or writes to one particular file.
- ✗
Monitor all open syscalls by the root user.
Why it's wrong here
The rule's filter keys on the openat syscall, not on the acting user's identity, so it cannot restrict auditing to root. Root-targeted monitoring would instead use an auid or uid field in the rule, which is what you would configure when investigating privileged activity.
- ✓
Monitor all open syscalls by users with UID 1000 or higher.
Why this is correct
The audit rule's filter specifies UID >= 1000, which on Linux excludes system and service accounts below that threshold. It therefore logs every syscall made by ordinary user accounts, matching the stated purpose of monitoring non-privileged user activity.
- ✗
Monitor all open syscalls except those by users with UID 1000 or higher.
Why it's wrong here
The rule filters by syscall name, not by UID threshold, so it cannot exclude users at or above UID 1000. A uid>=1000 comparison in the rule's field list is what you would write to audit only low-numbered system accounts.
Go deeper
Related to this question
Learn chapter
User and Group Administration
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 781 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.