hardMultiple ChoiceObjective-mapped
XK0-006 Practice Question: Refer to the exhibit
Exhibit
$ cat /etc/audit/audit.rules
-D
-b 8192
-f 1
-e 1
$ auditctl -l
No rules
$ systemctl status auditd
● auditd.service - Security Auditing Service
Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; vendor preset: enabled)
Active: active (running) since Mon 2023-03-20 10:20:00 UTC; 1h 30min ago
Docs: man:auditd(8)
https://github.com/linux-audit/audit-documentation
Process: 1234 ExecStart=/sbin/auditd (code=exited, status=0/SUCCESS)
Main PID: 1235 (auditd)
Tasks: 2 (limit: 1234)
Memory: 1.2M
CGroup: /system.slice/auditd.service
└─1235 /sbin/auditd
$ auditctl -s
AUDIT_STATUS: enabled=1 flag=1 pid=1235 rate_limit=0 backlog_limit=8192 lost=0 backlog=0 backlog_wait_time=15000Refer to the exhibit. An administrator has configured audit rules but notices that 'auditctl -l' returns 'No rules'. What is the most likely issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The audit rules have not been loaded into the kernel.
The audit rules file is present but not loaded. The rules need to be loaded using 'auditctl -R /etc/audit/audit.rules' or by restarting auditd. The 'auditctl -l' shows no rules because they haven't been loaded.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The audit rules have not been loaded into the kernel.
Why this is correct
Rules from the file must be loaded with auditctl -R or by restarting auditd.
- ✗
The audit system is disabled.
Why it's wrong here
The status shows enabled=1.
- ✗
The audit rules file has incorrect syntax.
Why it's wrong here
There is no indication of syntax errors.
- ✗
The audit daemon is not running.
Why it's wrong here
The status shows active (running).
Go deeper
Related to this question
About these practice questions
One of 979 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.