hardMultiple Choice
CISSP Practice Question: A PAM configuration contains pam_tally2.so with…
Exhibit
auth required pam_unix.so auth required pam_tally2.so deny=5 unlock_time=300 account required pam_unix.so
A PAM configuration contains pam_tally2.so with deny=5 and unlock_time=300. What is the effect of this configuration?
⚠ Common exam trap
Candidates often confuse pam_tally2.so with password aging or account disablement features, or assume that unlock_time=300 means manual unlock is required, when in fact it specifies automatic unlock after 300 seconds.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Users are locked out after 5 failed login attempts, and automatically unlocked after 5 minutes
The PAM configuration shows pam_tally2.so with deny=5 and unlock_time=300. Pam_tally2.so with deny=5 locks the user account after 5 failed authentication attempts, and unlock_time=300 sets the automatic unlock period to 300 seconds (5 minutes). This is a standard PAM (Pluggable Authentication Modules) configuration for account lockout policies, commonly used on Linux systems to mitigate brute-force attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The account is disabled after 5 successful logins
Why it's wrong here
The `pam_tally2` module is specifically designed to track and respond to *failed* authentication attempts, not successful ones. The `deny=5` parameter in the configuration dictates that an account will be locked after five *unsuccessful* login attempts, serving as a defense against brute-force attacks. Successful logins, by definition, would never trigger a security mechanism intended to prevent unauthorized access.
- ✗
Passwords must be changed every 5 days
Why it's wrong here
The provided PAM configuration snippet, which includes `pam_tally2`, is solely focused on managing account lockouts based on failed login attempts. It contains no parameters or modules that enforce password aging, complexity requirements, or history policies. Password change mandates are typically handled by other PAM modules like `pam_unix.so` or `pam_pwquality.so` with specific parameters, or by system-wide settings defined in `/etc/login.defs`.
- ✓
Users are locked out after 5 failed login attempts, and automatically unlocked after 5 minutes
Why this is correct
The `deny=5` parameter in the `pam_tally2` configuration explicitly instructs the system to lock a user's account after five consecutive unsuccessful authentication attempts, thereby preventing further brute-force efforts. Simultaneously, the `unlock_time=300` parameter ensures that the locked account is automatically re-enabled after 300 seconds, which precisely translates to five minutes, negating the need for any manual administrative intervention.
- ✗
Users are locked out after 5 failed attempts until manually unlocked
Why it's wrong here
While the `deny=5` parameter correctly specifies a lockout after five failed login attempts, the presence of `unlock_time=300` directly contradicts the assertion that accounts remain locked until manually unlocked. This parameter is specifically configured to automatically clear the failed login count and re-enable the account after the designated duration of 300 seconds (five minutes), eliminating the requirement for an administrator to intervene.
Go deeper
Related to this question
About these practice questions
One of 816 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.