XK0-006 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  selinuxenabled

  Why it's wrong here

  selinuxenabled only returns an exit code indicating whether SELinux is enabled, printing nothing about enforcing, permissive or disabled state. It is tempting because its name suggests a status query, and it is genuinely useful inside scripts that branch on enablement alone, but getenforce is the command that reports the current mode.

• ✗

  getsebool -a

  Why it's wrong here

  getsebool -a lists all SELinux booleans and their current on/off values; it reports policy toggles, not the enforcing, permissive or disabled mode. It is tempting because it queries SELinux state, but getenforce is the command that returns the mode itself.

• ✗

  chcon

  Why it's wrong here

  chcon changes the SELinux security context of files, so it cannot report the running mode. It is tempting because it is a core SELinux administration tool, and it would be the right choice when relabelling a file to match a policy type, but the question asks which command displays the current mode, answered by getenforce.

• ✓

  sestatus

  Why this is correct

  Running `sestatus` queries the SELinux kernel subsystem and prints the current enforcement mode (Enforcing, Permissive, or Disabled) alongside policy version and loaded policy name. This directly satisfies the stem's requirement to display the current mode, unlike `setenforce`, which changes it, or `getenforce`, which shows only the mode.