Q1. What is the default SSH configuration file location?
- A./etc/ssh/sshd_config✓ Correct
- B./etc/ssh/ssh_config
- C.~/.ssh/config
- D./var/log/ssh.log
Explanation: sshd_config controls the SSH server settings. Learn more.
CompTIA Linux+ Practice Questions: Security
40 free, exam-style CompTIA Linux+ (XK0-006) practice questions covering Security. Each question shows the correct answer and a clear explanation. Ready for the real thing? Take the full timed quiz below.
Q2. Which file controls sudo privileges?
- A./etc/sudoers✓ Correct
- B./etc/passwd
- C./etc/group
- D./etc/shadow
Explanation: sudoers defines user/group sudo permissions. Learn more.
Q3. Which command restores default SELinux file contexts?
- A.restorecon✓ Correct
- B.fixfiles
- C.semanage
- D.setsebool
Explanation: restorecon resets SELinux contexts based on policy. Learn more.
Q4. What is the purpose of /etc/login.defs?
- A.Define user password policies✓ Correct
- B.Configure SSH login settings
- C.List sudo privileges
- D.Store encrypted passwords
Explanation: Sets defaults for useradd like password aging and UID ranges. Learn more.
Q5. Which directory contains Kerberos configuration files?
- A./etc/krb5✓ Correct
- B./etc/ssh
- C./var/kerberos
- D./usr/lib/kerberos
Explanation: /etc/krb5.conf is the main Kerberos config file. Learn more.
Q6. Which firewall frontend uses zones?
- A.iptables
- B.firewalld✓ Correct
- C.ufw
- D.nftables
Explanation: firewalld manages zones (public, internal, etc.) for dynamic rules. Learn more.
Q7. What is the purpose of /etc/hosts.allow?
- A.Define permitted SSH users
- B.Control TCP Wrapper access✓ Correct
- C.List allowed firewall ports
- D.Configure sudo access
Explanation: TCP Wrappers use hosts.allow/hosts.deny for service access control. Learn more.
Q8. What is the purpose of 'visudo'?
- A.Edit sudoers file safely✓ Correct
- B.View sudo logs
- C.Create sudo aliases
- D.Reset sudo cache
Explanation: visudo locks the sudoers file and checks syntax. Learn more.
Q9. Which file controls PAM authentication?
- A./etc/pam.conf
- B./etc/pam.d/*✓ Correct
- C./etc/security/pam
- D./etc/shadow
Explanation: PAM uses service-specific configs in /etc/pam.d/. Learn more.
Q10. Which command generates SSH keys?
- A.ssh-keygen✓ Correct
- B.ssh-add
- C.ssh-copy-id
- D.ssh-agent
Explanation: ssh-keygen creates public/private key pairs. Learn more.
Q11. What does 'find / -perm /4000' locate?
- A.SUID files✓ Correct
- B.World-writable files
- C.SGID files
- D.Sticky bit files
Explanation: perm /4000 matches files with SUID bit set. Learn more.
Q12. Which file controls sudo lecture messages?
- A./etc/sudoers✓ Correct
- B./etc/motd
- C./etc/issue
- D./etc/sudo_lecture
Explanation: sudoers uses 'lecture' directive for educational messages. Learn more.
Q13. Which command decrypts a LUKS partition?
- A.cryptsetup luksOpen✓ Correct
- B.luksdecrypt
- C.gpg --decrypt
- D.openssl des3
Explanation: luksOpen unlocks encrypted devices for mapping. Learn more.
Q14. Which file controls SSH client settings?
- A.~/.ssh/config
- B./etc/ssh/ssh_config
- C./etc/ssh/sshd_config
- D.Both A and B✓ Correct
Explanation: Client settings: global (/etc/ssh/ssh_config) and user (~/.ssh/config). Learn more.
Q15. What is the purpose of 'passwd -l'?
- A.Lock user account✓ Correct
- B.List password policies
- C.Change password hash
- D.Log password changes
Explanation: Lock account by prepending '!' to password hash. Learn more.
Q16. What is the purpose of 'visudo'?
- A.Edit sudoers safely✓ Correct
- B.View sudo logs
- C.Create sudo users
- D.Reset sudo cache
Explanation: Locks sudoers file and validates syntax. Learn more.
Q17. What does 'ssh-copy-id' do?
- A.Generate SSH keys
- B.Copy public key to remote host✓ Correct
- C.Test SSH connection
- D.Encrypt SSH traffic
Explanation: Installs public key in remote ~/.ssh/authorized_keys. Learn more.
Q18. Which file controls PAM password policies?
- A./etc/pam.d/passwd
- B./etc/login.defs
- C./etc/security/pwquality.conf
- D.All of the above✓ Correct
Explanation: All contribute to password policy configuration. Learn more.
Q19. What is the purpose of the 'auditd' service?
- A.Monitor file integrity
- B.Track system calls and security events✓ Correct
- C.Encrypt disk partitions
- D.Manage user audit logs
Explanation: Linux audit subsystem logs security-relevant events. Learn more.
Q20. Which command shows SELinux boolean values?
- A.getsebool✓ Correct
- B.sestatus
- C.semodule
- D.seinfo
Explanation: getsebool -a lists all SELinux booleans. Learn more.
Q21. What is the purpose of '/etc/securetty'?
- A.Define allowed root login TTYs✓ Correct
- B.Secure cron jobs
- C.Encrypt terminal sessions
- D.Configure SSH TTY allocation
Explanation: Restricts terminals where root can log in directly. Learn more.
Q22. Which command decrypts an OpenSSL-encrypted file?
- A.openssl enc -d -aes256 -in file.enc -out file.txt✓ Correct
- B.gpg --decrypt file.enc
- C.decrypt file.enc
- D.unenc -a aes256 file.enc
Explanation: openssl enc handles symmetric encryption/decryption. Learn more.
Q23. What does 'firewall-cmd --permanent --add-rich-rule' do?
- A.Add temporary rule
- B.Create complex firewall rules✓ Correct
- C.Enable port forwarding
- D.Reload firewall
Explanation: Rich rules allow advanced firewalld configurations. Learn more.
Q24. Which file controls PAM password complexity?
- A./etc/pam.d/system-auth
- B./etc/security/pwquality.conf
- C./etc/login.defs
- D.All of the above✓ Correct
Explanation: Multiple files contribute to password policies. Learn more.
Q25. Which file defines sudo lecture messages?
- A./etc/sudoers✓ Correct
- B./etc/motd
- C./etc/issue
- D./etc/sudo_lecture
Explanation: sudoers uses 'lecture' parameter. Learn more.
Q26. What is the purpose of 'aide'?
- A.Intrusion detection via file integrity checks✓ Correct
- B.Automated system updates
- C.Disk encryption
- D.Network intrusion prevention
Explanation: Advanced Intrusion Detection Environment monitors file changes. Learn more.
Q27. What is the purpose of 'apparmor_status'?
- A.Show loaded AppArmor profiles✓ Correct
- B.Check application versions
- C.Monitor CPU usage
- D.List installed packages
Explanation: Displays enforcement status of AppArmor profiles. Learn more.
Q28. Which command encrypts swap space?
- A.cryptsetup luksFormat
- B.mkswap -c
- C.swapencrypt
- D.Not typically encrypted by default✓ Correct
Explanation: Swap encryption requires manual setup via dm-crypt/LUKS. Learn more.
Q29. Which command changes the SELinux context of a file?
- A.chcon✓ Correct
- B.chage
- C.chgrp
- D.chkconfig
Explanation: chcon changes SELinux security context labels on files. Learn more.
Q30. Which command safely edits the sudoers file with syntax checking?
- A.visudo✓ Correct
- B.nano /etc/shadow
- C.chmod 777 /etc/sudoers
- D.userdel root
Explanation: visudo locks and validates the sudoers file to reduce the risk of syntax errors that break sudo access. Learn more.
Q31. Which command shows recent authentication-related log entries on a systemd host?
- A.journalctl _COMM=sshd✓ Correct
- B.mkfs -t xfs
- C.lsblk -f
- D.passwd -S root only
Explanation: journalctl can filter logs by fields such as command name, making SSH authentication investigation easier. Learn more.
Q32. Which command locks a Linux user account password?
- A.passwd -l username✓ Correct
- B.chown -l username
- C.mount -l username
- D.tar -l username
Explanation: passwd -l locks the password for an account, preventing password-based login. Learn more.
Q33. Which command adds a rule to allow SSH with firewalld?
- A.firewall-cmd --add-service=ssh --permanent✓ Correct
- B.iptables --format ssh
- C.ssh-keygen --firewall
- D.nmcli ssh allow
Explanation: firewall-cmd manages firewalld rules, and --add-service=ssh permits the predefined SSH service. Learn more.
Q34. Which command changes the active SELinux mode temporarily?
- A.setenforce✓ Correct
- B.getenforce -w
- C.restorecon -m
- D.semanage mode
Explanation: setenforce changes SELinux enforcing or permissive mode until reboot or configuration change. Learn more.
Q35. Which command restores default SELinux contexts on files?
- A.restorecon✓ Correct
- B.setfacl
- C.chage
- D.modprobe
Explanation: restorecon reapplies default SELinux context labels based on policy. Learn more.
Q36. Which command reports whether UEFI Secure Boot is enabled on a Linux system?
- A.lsmod --secure
- B.grub-install --state
- C.mokutil --sb-state✓ Correct
- D.uname --uefi
Explanation: mokutil --sb-state queries the platform and reports the current Secure Boot state. Learn more.
Q37. Which command displays the complete active nftables ruleset?
- A.nft list ruleset✓ Correct
- B.iptables-save --nft-only
- C.firewall-cmd --nft-dump
- D.ss --ruleset
Explanation: nft list ruleset prints the active nftables tables, chains, rules, sets, and related objects. Learn more.
Q38. Which firewalld command displays the active zone's interfaces, services, ports, and rich rules?
- A.firewall-cmd --panic-off
- B.nft flush ruleset
- C.firewall-cmd --list-all✓ Correct
- D.ss --firewall
Explanation: firewall-cmd --list-all summarizes the configuration of the active or selected firewalld zone. Learn more.
Q39. A web file has the wrong SELinux context after being moved from a home directory. Which command restores the expected policy-defined context?
- A.setenforce FILE
- B.getenforce FILE
- C.semanage login FILE
- D.restorecon FILE✓ Correct
Explanation: restorecon applies the default SELinux context defined by policy for the file path. Learn more.
Q40. Which command searches the Linux audit log specifically for recent SELinux AVC denial records?
- A.ausearch -m AVC✓ Correct
- B.journalctl --vacuum-avc
- C.getenforce --log
- D.restorecon -n AVC
Explanation: ausearch queries audit records, and the AVC message type filters for SELinux access-vector-cache denials. Learn more.