XK0-006 Security Practice Question
Which THREE are valid SELinux modes?
⚠ Common exam trap
XK0-006 often tests the confusion between SELinux modes and policy types, or between modes and related concepts like audit logging, causing candidates to select 'Strict' or 'Audit' as valid modes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Permissive
SELinux has exactly three operational modes, and the three correct options here are B. Permissive, C. Enforcing, and D. Disabled. Permissive mode is valid because SELinux loads the policy and logs AVC denials to the audit log but does not actually block any access, which is useful for troubleshooting. Enforcing mode is valid because it loads the policy and actively denies and logs any operation that violates the policy. Disabled mode is valid because it turns SELinux off entirely at the kernel level, so no policy is loaded and no AVC messages are generated. The unmarked options do not belong: Strict is not a mode but rather a type of policy (targeted vs. strict policy), and Audit is not an SELinux mode at all, though auditd is the userspace daemon that records AVC denials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Strict
Why it's wrong here
Strict is not a standard SELinux mode.
- ✓
Permissive
Why this is correct
Permissive is a valid SELinux mode: policy violations are logged but not blocked, unlike Enforcing. It satisfies the stem's requirement for a genuine SELinux operating mode, alongside Enforcing and Disabled, and is commonly used for troubleshooting before switching to enforcement.
- ✓
Enforcing
Why this is correct
Enforcing is a valid SELinux mode: policy is loaded and violations are actively denied and audited. It satisfies the stem's requirement for a genuine SELinux operating mode, being the default operational state alongside Permissive and Disabled.
- ✓
Disabled
Why this is correct
Disabled is a valid SELinux mode: the kernel does not load policy and no AVC checks occur. It satisfies the stem's requirement for a genuine SELinux operating mode, distinct from Permissive (logging only) and Enforcing (denying).
- ✗
Audit
Why it's wrong here
Audit is not an SELinux mode.
Go deeper
Related to this question
Learn chapter
File Transfer and Remote Access
Key term
Kernel
The kernel is the core program of an operating system that manages hardware resources and provides essential services for all other software to run.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This XK0-006 question is part of Courseiva's 781-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.