CompTIA Linux+ Practice Questions: Security

39 free, exam-style CompTIA Linux+ (XK0-006) practice questions covering Security, each with the correct answer and an explanation. Start a timed exam below, or scroll on to read through the questions.

🧠

Mini Exam

25 Questions · 50 minutes

Start Quiz 🚀
🏆

Mock Linux+ Exam

85 Questions · 165 minutes

Start Quiz 🚀
📅

Daily Quiz

10 Questions · 20 minutes

Start Quiz 🚀
🎯

Standard Practice

50 Questions · 100 minutes

Start Quiz 🚀

Security practice questions

Answers and explanations are shown. Take the timed exam above to test yourself first.

Q1. What is the default SSH configuration file location?

  • A./etc/ssh/sshd_config✓ Correct
  • B./etc/ssh/ssh_config
  • C.~/.ssh/config
  • D./var/log/ssh.log
Explanation: sshd_config controls the SSH server settings. Learn more.

Q2. Which file controls sudo privileges?

  • A./etc/sudoers✓ Correct
  • B./etc/passwd
  • C./etc/group
  • D./etc/shadow
Explanation: sudoers defines user/group sudo permissions. Learn more.

Q3. Which command restores default SELinux file contexts?

  • A.restorecon✓ Correct
  • B.fixfiles
  • C.semanage
  • D.setsebool
Explanation: restorecon resets SELinux contexts based on policy. Learn more.

Q4. What is the purpose of /etc/login.defs?

  • A.Define user password policies✓ Correct
  • B.Configure SSH login settings
  • C.List sudo privileges
  • D.Store encrypted passwords
Explanation: Sets defaults for useradd like password aging and UID ranges. Learn more.

Q5. Which directory contains Kerberos configuration files?

  • A./etc/krb5✓ Correct
  • B./etc/ssh
  • C./var/kerberos
  • D./usr/lib/kerberos
Explanation: /etc/krb5.conf is the main Kerberos config file. Learn more.

Q6. Which firewall frontend uses zones?

  • A.iptables
  • B.firewalld✓ Correct
  • C.ufw
  • D.nftables
Explanation: firewalld manages zones (public, internal, etc.) for dynamic rules. Learn more.

Q7. What is the purpose of /etc/hosts.allow?

  • A.Define permitted SSH users
  • B.Control TCP Wrapper access✓ Correct
  • C.List allowed firewall ports
  • D.Configure sudo access
Explanation: TCP Wrappers use hosts.allow/hosts.deny for service access control. Learn more.

Q8. What is the purpose of 'visudo'?

  • A.Edit sudoers file safely✓ Correct
  • B.View sudo logs
  • C.Create sudo aliases
  • D.Reset sudo cache
Explanation: visudo locks the sudoers file and checks syntax. Learn more.

Q9. Which file controls PAM authentication?

  • A./etc/pam.conf
  • B./etc/pam.d/*✓ Correct
  • C./etc/security/pam
  • D./etc/shadow
Explanation: PAM uses service-specific configs in /etc/pam.d/. Learn more.

Q10. Which command generates SSH keys?

  • A.ssh-keygen✓ Correct
  • B.ssh-add
  • C.ssh-copy-id
  • D.ssh-agent
Explanation: ssh-keygen creates public/private key pairs. Learn more.

Q11. What does 'find / -perm /4000' locate?

  • A.SUID files✓ Correct
  • B.World-writable files
  • C.SGID files
  • D.Sticky bit files
Explanation: perm /4000 matches files with SUID bit set. Learn more.

Q12. Which file controls sudo lecture messages?

  • A./etc/sudoers✓ Correct
  • B./etc/motd
  • C./etc/issue
  • D./etc/sudo_lecture
Explanation: sudoers uses 'lecture' directive for educational messages. Learn more.

Q13. Which command decrypts a LUKS partition?

  • A.cryptsetup luksOpen✓ Correct
  • B.luksdecrypt
  • C.gpg --decrypt
  • D.openssl des3
Explanation: luksOpen unlocks encrypted devices for mapping. Learn more.

Q14. Which file controls SSH client settings?

  • A.~/.ssh/config
  • B./etc/ssh/ssh_config
  • C./etc/ssh/sshd_config
  • D.Both A and B✓ Correct
Explanation: Client settings: global (/etc/ssh/ssh_config) and user (~/.ssh/config). Learn more.

Q15. What is the purpose of 'passwd -l'?

  • A.Lock user account✓ Correct
  • B.List password policies
  • C.Change password hash
  • D.Log password changes
Explanation: Lock account by prepending '!' to password hash. Learn more.

Q16. What does 'ssh-copy-id' do?

  • A.Generate SSH keys
  • B.Copy public key to remote host✓ Correct
  • C.Test SSH connection
  • D.Encrypt SSH traffic
Explanation: Installs public key in remote ~/.ssh/authorized_keys. Learn more.

Q17. Which file controls PAM password policies?

  • A./etc/pam.d/passwd
  • B./etc/login.defs
  • C./etc/security/pwquality.conf
  • D.All of the above✓ Correct
Explanation: All contribute to password policy configuration. Learn more.

Q18. What is the purpose of the 'auditd' service?

  • A.Monitor file integrity
  • B.Track system calls and security events✓ Correct
  • C.Encrypt disk partitions
  • D.Manage user audit logs
Explanation: Linux audit subsystem logs security-relevant events. Learn more.

Q19. Which command shows SELinux boolean values?

  • A.getsebool✓ Correct
  • B.sestatus
  • C.semodule
  • D.seinfo
Explanation: getsebool -a lists all SELinux booleans. Learn more.

Q20. What is the purpose of '/etc/securetty'?

  • A.Define allowed root login TTYs✓ Correct
  • B.Secure cron jobs
  • C.Encrypt terminal sessions
  • D.Configure SSH TTY allocation
Explanation: Restricts terminals where root can log in directly. Learn more.

Q21. Which command decrypts an OpenSSL-encrypted file?

  • A.openssl enc -d -aes256 -in file.enc -out file.txt✓ Correct
  • B.gpg --decrypt file.enc
  • C.decrypt file.enc
  • D.unenc -a aes256 file.enc
Explanation: openssl enc handles symmetric encryption/decryption. Learn more.

Q22. What does 'firewall-cmd --permanent --add-rich-rule' do?

  • A.Add temporary rule
  • B.Create complex firewall rules✓ Correct
  • C.Enable port forwarding
  • D.Reload firewall
Explanation: Rich rules allow advanced firewalld configurations. Learn more.

Q23. Which file controls PAM password complexity?

  • A./etc/pam.d/system-auth
  • B./etc/security/pwquality.conf
  • C./etc/login.defs
  • D.All of the above✓ Correct
Explanation: Multiple files contribute to password policies. Learn more.

Q24. Which file defines sudo lecture messages?

  • A./etc/sudoers✓ Correct
  • B./etc/motd
  • C./etc/issue
  • D./etc/sudo_lecture
Explanation: sudoers uses 'lecture' parameter. Learn more.

Q25. What is the purpose of 'aide'?

  • A.Intrusion detection via file integrity checks✓ Correct
  • B.Automated system updates
  • C.Disk encryption
  • D.Network intrusion prevention
Explanation: Advanced Intrusion Detection Environment monitors file changes. Learn more.

Q26. What is the purpose of 'apparmor_status'?

  • A.Show loaded AppArmor profiles✓ Correct
  • B.Check application versions
  • C.Monitor CPU usage
  • D.List installed packages
Explanation: Displays enforcement status of AppArmor profiles. Learn more.

Q27. Which command encrypts swap space?

  • A.cryptsetup luksFormat
  • B.mkswap -c
  • C.swapencrypt
  • D.Not typically encrypted by default✓ Correct
Explanation: Swap encryption requires manual setup via dm-crypt/LUKS. Learn more.

Q28. Which command changes the SELinux context of a file?

  • A.chcon✓ Correct
  • B.chage
  • C.chgrp
  • D.chkconfig
Explanation: chcon changes SELinux security context labels on files. Learn more.

Q29. Which command safely edits the sudoers file with syntax checking?

  • A.visudo✓ Correct
  • B.nano /etc/shadow
  • C.chmod 777 /etc/sudoers
  • D.userdel root
Explanation: visudo locks and validates the sudoers file to reduce the risk of syntax errors that break sudo access. Learn more.

Q30. Which command shows recent authentication-related log entries on a systemd host?

  • A.journalctl _COMM=sshd✓ Correct
  • B.mkfs -t xfs
  • C.lsblk -f
  • D.passwd -S root only
Explanation: journalctl can filter logs by fields such as command name, making SSH authentication investigation easier. Learn more.

Q31. Which command locks a Linux user account password?

  • A.passwd -l username✓ Correct
  • B.chown -l username
  • C.mount -l username
  • D.tar -l username
Explanation: passwd -l locks the password for an account, preventing password-based login. Learn more.

Q32. Which command adds a rule to allow SSH with firewalld?

  • A.firewall-cmd --add-service=ssh --permanent✓ Correct
  • B.iptables --format ssh
  • C.ssh-keygen --firewall
  • D.nmcli ssh allow
Explanation: firewall-cmd manages firewalld rules, and --add-service=ssh permits the predefined SSH service. Learn more.

Q33. Which command changes the active SELinux mode temporarily?

  • A.setenforce✓ Correct
  • B.getenforce -w
  • C.restorecon -m
  • D.semanage mode
Explanation: setenforce changes SELinux enforcing or permissive mode until reboot or configuration change. Learn more.

Q34. Which command restores default SELinux contexts on files?

  • A.restorecon✓ Correct
  • B.setfacl
  • C.chage
  • D.modprobe
Explanation: restorecon reapplies default SELinux context labels based on policy. Learn more.

Q35. Which command reports whether UEFI Secure Boot is enabled on a Linux system?

  • A.lsmod --secure
  • B.grub-install --state
  • C.mokutil --sb-state✓ Correct
  • D.uname --uefi
Explanation: mokutil --sb-state queries the platform and reports the current Secure Boot state. Learn more.

Q36. Which command displays the complete active nftables ruleset?

  • A.nft list ruleset✓ Correct
  • B.iptables-save --nft-only
  • C.firewall-cmd --nft-dump
  • D.ss --ruleset
Explanation: nft list ruleset prints the active nftables tables, chains, rules, sets, and related objects. Learn more.

Q37. Which firewalld command displays the active zone's interfaces, services, ports, and rich rules?

  • A.firewall-cmd --panic-off
  • B.nft flush ruleset
  • C.firewall-cmd --list-all✓ Correct
  • D.ss --firewall
Explanation: firewall-cmd --list-all summarizes the configuration of the active or selected firewalld zone. Learn more.

Q38. A web file has the wrong SELinux context after being moved from a home directory. Which command restores the expected policy-defined context?

  • A.setenforce FILE
  • B.getenforce FILE
  • C.semanage login FILE
  • D.restorecon FILE✓ Correct
Explanation: restorecon applies the default SELinux context defined by policy for the file path. Learn more.

Q39. Which command searches the Linux audit log specifically for recent SELinux AVC denial records?

  • A.ausearch -m AVC✓ Correct
  • B.journalctl --vacuum-avc
  • C.getenforce --log
  • D.restorecon -n AVC
Explanation: ausearch queries audit records, and the AVC message type filters for SELinux access-vector-cache denials. Learn more.

More CompTIA Linux+ practice topics

Keep studying CompTIA Linux+

Full CompTIA Linux+ practice exam · CompTIA Linux+ study guide · All CompTIA practice questions

Last updated