Overview
Security is 18% of the XK0-006 exam and has six objectives. They cover authorization, authentication and accounting (Polkit, PAM, SSSD and Winbind, LDAP, Kerberos, Samba, journalctl, rsyslog, logrotate and auditd), firewalls (firewalld zones and rich rules, ufw, nftables, iptables, ipset, NAT and IP forwarding), OS hardening (sudo, file attributes, permissions and special bits, ACLs, SELinux, SSH configuration, fail2ban and Secure Boot), account hardening, cryptography for data at rest and in transit, and compliance work such as vulnerability scanning, OpenSCAP, CIS Benchmarks, file integrity checking and secure data destruction.
The domain applies controls to everything built in Domains 1 and 2. Its counterpart is objective 5.4, where the same controls appear as the cause of an outage, so learning both what each control does and how it fails pays off twice.
How it's tested
Questions are scenario-based and usually ask for the BEST or MOST secure action that still meets a business need. Some are command-level, such as a firewall-cmd or semanage line; others are conceptual, such as which control provides accounting or which algorithm should be removed. Favour answers that are narrow, persistent and leave existing protections enabled.
-
Fix without weakening
Something is blocked by SELinux, a firewall or permissions. The right answer adjusts the specific rule, label or permission rather than disabling the control.
-
Runtime versus persistent
A change works until reboot or reload. You identify the missing --permanent, -P, configuration file or rebuild step.
-
Choose the control category
You decide whether a need is authentication, authorization, accounting, encryption or integrity, and pick the tool that provides it, such as auditd for accounting or AIDE for integrity.
Apache is moved to listen on TCP 8081, and SELinux now blocks it even though the firewall allows the port. Options include setenforce 0, chcon on the binary, and semanage port -a -t http_port_t -p tcp 8081. Disabling enforcement removes protection system-wide, and the binary's label is not the problem. Adding 8081 to the http_port_t type tells the policy that web servers may bind there, which is narrow and persistent.
Objectives 6
Official objectives from the CompTIA outline, in outline order.
3.1 Summarize authorization, authentication, and accounting methods.Polkit, PAM, SSSD/Winbind, LDAP, Kerberos, Samba and system logging and auditing.
- What it means
- Covers how Linux proves identity and grants rights: PAM stacks in /etc/pam.d, Polkit rules for unprivileged access to privileged actions, directory integration through SSSD or Winbind and realm joins, LDAP directories, Kerberos tickets and Samba; and accounting through journalctl, rsyslog, logrotate, /var/log and auditd with audit.rules.
- What to understand
- PAM modules are grouped by type (auth, account, password, session) and their control flags (required, requisite, sufficient, optional) decide how a failure affects the stack. Kerberos depends on synchronised clocks, so time drift breaks logins. auditd records security-relevant events defined by watch and syscall rules, which ordinary application logging does not capture.
- How it shows up
- A domain user cannot log in after a server's clock drifts, or an auditor wants a record of every change to /etc/shadow, which points to an auditd watch rule searchable with ausearch.
- Common confusion
- Treating rsyslog and auditd as interchangeable. rsyslog routes application and system messages; auditd is the kernel audit trail for who did what to which object.
3.2 Given a scenario, configure and implement firewalls on a Linux system.firewalld, ufw, nftables, iptables, ipset, NAT and IP forwarding.
- What it means
- Covers firewalld with firewall-cmd (zones, services versus ports, rich rules, runtime versus permanent configuration), ufw, nftables, iptables and ipset as interfaces to the kernel's Netfilter framework, address translation (NAT, PAT, SNAT, DNAT), stateful versus stateless filtering and enabling IP forwarding with net.ipv4.ip_forward.
- What to understand
- firewall-cmd without --permanent changes only the running rules; with --permanent it changes saved rules that apply after --reload. SNAT (or masquerade) rewrites the source of outbound traffic; DNAT rewrites the destination for port forwarding inbound. A Linux router or NAT gateway also needs ip_forward set to 1, persisted in /etc/sysctl.d.
- How it shows up
- A rule works until reboot, a port-forward to an internal web server fails, or only one subnet should reach SSH, which calls for a rich rule or a source-limited zone.
- Common confusion
- Mixing SNAT and DNAT. Ask which address changes: the sender's (SNAT, outbound sharing) or the target's (DNAT, inbound forwarding).
3.3 Given a scenario, apply operating system (OS) hardening techniques on a Linux system.sudo, attributes, permissions, ACLs, SELinux, SSH, insecure services and Secure Boot.
- What it means
- Covers privilege escalation through sudo (visudo, /etc/sudoers.d, NOPASSWD and NOEXEC, wheel and sudo groups) and su -, chattr and lsattr, chmod, chown, chgrp and umask, setuid, setgid and sticky bits, ACLs with setfacl and getfacl, SELinux modes, contexts and booleans, sshd settings and fail2ban, avoiding Telnet, FTP and TFTP, disabling unused filesystems, removing unneeded SUID bits and UEFI Secure Boot.
- What to understand
- SELinux fixes should persist: semanage fcontext plus restorecon for file labels, setsebool -P for booleans; chcon changes vanish on a relabel. The sticky bit on a shared directory stops users deleting each other's files, and setgid on a directory makes new files inherit its group. chattr +i blocks changes even by root until removed.
- How it shows up
- A team share needs group-owned files that only their creators can delete, or a web root moved to /srv shows SELinux denials, or SSH must refuse root and password logins.
- Common confusion
- Using chcon as the permanent SELinux fix. It works until the next restorecon or relabel, when the policy's default label returns.
3.4 Explain account hardening techniques and best practices.Password policy, MFA, breach lists, restricted shells, lockout and avoiding root.
- What it means
- Covers password complexity, length, expiration, reuse and history rules, multifactor authentication, checking passwords against known breach lists, restricted shells such as /bin/rbash and /sbin/nologin, failed-login lockout through PAM (the objectives name pam_tally2) and the practice of working as an unprivileged user rather than root.
- What to understand
- Length and breach-list screening add more resistance than forced frequent changes, which tend to produce predictable passwords. Lockout after repeated failures slows online guessing but can be abused to lock out legitimate users. Restricted shells limit what an interactive user can run; nologin denies a shell entirely for service accounts.
- How it shows up
- A policy question asks which combination best resists credential attacks, or which shell to assign to a service account that must never log in interactively.
- Common confusion
- Assuming pam_tally2 is present everywhere. Newer distributions replaced it with pam_faillock, so know the concept of lockout, not only one module name.
3.5 Explain cryptographic concepts and technologies in a Linux environment.Encryption at rest and in transit, hashing, weak algorithm removal and certificates.
- What it means
- Covers data at rest with GPG file encryption and LUKS2 volume encryption (using the Argon2 key-derivation function), data in transit with OpenSSL, LibreSSL, WireGuard and TLS protocol versions, hashing with SHA-256 and HMAC, removing weak algorithms, and certificate management with trusted roots from no-cost or commercial authorities instead of self-signed certificates.
- What to understand
- Hashing proves integrity but anyone can recompute a plain hash; HMAC adds a secret key, so it also proves the sender held the key. Argon2 is deliberately memory-hard, slowing brute-force attempts on a LUKS2 passphrase. Disable SSLv3, TLS 1.0 and TLS 1.1 and prefer TLS 1.2 or 1.3.
- How it shows up
- Protect a laptop disk if stolen (LUKS2), send one encrypted file to a partner (GPG), link two sites securely (WireGuard), or replace a self-signed certificate that browsers reject.
- Common confusion
- Calling hashing a form of encryption. A hash is one-way and cannot be decrypted; it verifies data rather than hiding it.
3.6 Explain the importance of compliance and audit procedures.Vulnerability scanning, standards, file integrity, secure destruction, supply chain and banners.
- What it means
- Covers anti-malware and indicators of compromise, vulnerability management with CVEs, CVSS scores and backported patches, port scanners and protocol analyzers, OpenSCAP and CIS Benchmarks, file integrity with AIDE, rkhunter and package verification, secure data destruction (shred, badblocks -w, dd from /dev/urandom, cryptographic erasure), software supply chain risk and login banners in /etc/issue, /etc/issue.net and /etc/motd.
- What to understand
- Distributions often backport security fixes into an older version number, so a scanner that only compares versions can flag a patched package; check the changelog or vendor advisory. AIDE compares files against a baseline database you must create and protect. Overwrite tools such as shred are unreliable on SSDs and copy-on-write filesystems, where cryptographic erasure is the dependable choice.
- How it shows up
- A scan reports a CVE on a package that the vendor says is patched, an auditor asks for evidence that system binaries have not changed, or encrypted disks must be retired securely.
- Common confusion
- Mixing up banner files: /etc/issue is shown before a local console login, /etc/issue.net is used for network logins when configured, and /etc/motd appears after login.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
PAM control flags
Each line in a PAM stack has a flag: required fails the stack but keeps evaluating, requisite fails immediately, sufficient succeeds immediately if nothing required has failed, and optional matters only when it is the only module.
- Remember
- Stack order and flags together decide the outcome, so a misplaced sufficient line can bypass later checks.
- Tested as
- Authentication and lockout questions reference /etc/pam.d files.
- Trap
- Treating required and requisite as identical.
-
Kerberos and time
Kerberos issues time-stamped tickets from a key distribution centre, and by default rejects requests when client and server clocks differ by more than about five minutes.
- Remember
- Fix NTP or chrony first when domain logins suddenly fail on one host.
- Tested as
- Directory login failures on a single server with clock drift.
- Trap
- Resetting passwords when the real cause is clock skew.
-
auditd rules
auditd writes kernel audit events, and rules such as a watch on /etc/shadow with write and attribute permissions record every modification along with the user responsible.
- Remember
- Persistent rules live in /etc/audit/rules.d; ausearch and aureport query the log.
- Tested as
- Accounting and compliance evidence scenarios.
- Trap
- Expecting rsyslog to provide a tamper-evident record of file access.
-
firewalld runtime versus permanent
Rules added without --permanent apply immediately but are lost on reload or reboot, while --permanent rules are saved but do not apply until firewall-cmd --reload.
- Remember
- Add both, or use --runtime-to-permanent after testing.
- Tested as
- Rules that "disappear after reboot" or "do not take effect".
- Trap
- Adding a permanent rule and testing before reloading.
-
SNAT, DNAT and masquerade
SNAT changes the source address of outgoing packets, masquerade is SNAT using the outbound interface's current address, and DNAT changes the destination address to forward inbound traffic to an internal host.
- Remember
- Any NAT gateway also needs net.ipv4.ip_forward=1.
- Tested as
- Gateway and port-forwarding scenarios.
- Trap
- Configuring DNAT and forgetting IP forwarding.
-
Special permission bits
setuid (4000) runs a file as its owner, setgid (2000) runs as the group or makes a directory's new files inherit its group, and the sticky bit (1000) lets only owners delete their files in a shared directory.
- Remember
- chmod 2770 plus a sticky bit (3770) suits a collaborative team directory.
- Tested as
- Shared directory and privilege escalation questions.
- Trap
- Leaving unnecessary setuid bits on binaries, a known escalation path.
-
umask
The umask removes permission bits from the defaults of 666 for files and 777 for directories when new objects are created.
- Remember
- umask 027 yields 640 files and 750 directories; 022 yields 644 and 755.
- Tested as
- Default-permission calculations.
- Trap
- Subtracting the umask from 777 for regular files, which never receive execute by default.
-
ACL mask
POSIX ACLs add named user and group entries with setfacl, and the mask entry caps the effective permissions of every named entry and the owning group.
- Remember
- getfacl shows effective rights; ls -l shows a + when an ACL exists.
- Tested as
- A user granted rw through an ACL still cannot write.
- Trap
- Ignoring a restrictive mask after a chmod changed it.
-
SELinux persistent fixes
semanage fcontext defines the correct label for a path in policy, restorecon applies it, setsebool -P saves a boolean, and semanage port allows a service type to use a new port.
- Remember
- chcon and setsebool without -P are temporary; setenforce does not survive reboot.
- Tested as
- Most SELinux scenarios test whether your fix persists.
- Trap
- Using setenforce 0 or audit2allow as a first response.
-
sshd hardening directives
PermitRootLogin no, PasswordAuthentication no with key-based login, AllowUsers or AllowGroups, and X11Forwarding no reduce the SSH attack surface, with fail2ban banning hosts after repeated failures.
- Remember
- Validate with sshd -t and keep an open session before restarting sshd remotely.
- Tested as
- Remote access hardening scenarios.
- Trap
- Disabling password authentication before confirming key login works.
-
LUKS2 and Argon2
LUKS2 is the Linux standard for block-device encryption, and it uses the Argon2 key-derivation function to make each passphrase guess expensive in memory and time.
- Remember
- Destroying all key slots (cryptographic erase) makes the data unrecoverable.
- Tested as
- Data-at-rest and secure disposal scenarios.
- Trap
- Thinking LUKS protects data while the volume is unlocked and mounted.
-
HMAC versus plain hash
A SHA-256 hash detects any change to data, while an HMAC combines the data with a shared secret key so the receiver can also confirm the message came from a key holder.
- Remember
- Hashes give integrity; HMAC gives integrity and authenticity.
- Tested as
- Asked when a scenario needs proof that a message was not forged.
- Trap
- Choosing a plain hash when an attacker could recompute it.
-
Backported patches
Enterprise distributions apply security fixes to the version they ship instead of upgrading, so the package version number can look vulnerable while the fix is present.
- Remember
- Confirm against the distribution's advisory or package changelog for the CVE.
- Tested as
- Vulnerability scan false positives.
- Trap
- Installing an upstream build to satisfy a version-based scanner.
-
AIDE and package verification
AIDE stores a baseline of file hashes and attributes and reports differences on later checks, while rpm -V or dpkg verification compares installed files with package metadata.
- Remember
- Initialise the AIDE database on a known-good system and store a copy off the host.
- Tested as
- Integrity monitoring and suspected tampering scenarios.
- Trap
- Building the baseline after a suspected compromise.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
chcon vs. semanage fcontext + restorecon vs. setenforce
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| chcon | Sets an SELinux context directly on a file | Temporary; lost on restorecon or a full relabel | Using it as the permanent fix |
| semanage fcontext + restorecon | Records the correct label rule in policy, then applies it | Persistent and survives relabelling | Running semanage but forgetting restorecon |
| setenforce 0 | Switches SELinux to permissive until reboot | Removes enforcement system-wide; useful only to confirm a diagnosis | Leaving it as the solution |
firewalld vs. ufw vs. nftables vs. iptables
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| firewalld | Zone-based firewall manager driven by firewall-cmd | Runtime and permanent configuration sets; common on RHEL-family systems | Forgetting --reload after --permanent changes |
| ufw | Simplified front end common on Ubuntu | Straightforward allow and deny syntax | Running it alongside firewalld and getting conflicting rules |
| nftables | Current Netfilter rule framework using the nft command | Replaces iptables with one syntax for IPv4, IPv6 and more | Assuming it is unrelated to Netfilter |
| iptables | Legacy Netfilter tool with chains and first-match rules | Rule order matters; -I inserts at the top, -A appends | Appending an allow rule below an existing drop rule |
Hashing vs. symmetric encryption vs. asymmetric encryption
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Hashing (SHA-256) | One-way fixed-length digest of data | Cannot be reversed; used for integrity | Calling it encryption |
| Symmetric (LUKS2 volume key, WireGuard session keys) | Same secret key encrypts and decrypts | Fast, suited to bulk data | Overlooking how the key is shared or protected |
| Asymmetric (GPG keypairs, TLS certificates) | Public key encrypts or verifies; private key decrypts or signs | Solves key exchange and provides signatures | Sharing the private key with the recipient |
/etc/issue vs. /etc/issue.net vs. /etc/motd
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| /etc/issue | Text shown before a local console login | Pre-login, local terminals | Expecting SSH users to see it by default |
| /etc/issue.net | Pre-login text for network logins | Shown over SSH when the sshd Banner directive points to it | Editing it without setting Banner in sshd_config |
| /etc/motd | Message of the day after successful login | Post-login, so it cannot serve as a pre-access warning | Placing the legal warning here |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Disable the control
- What candidates pick
- setenforce 0, stopping firewalld, or chmod 777 to make an application work.
- Why it looks right
- The application starts working immediately, which looks like a solved ticket.
- Why it's wrong
- It removes protection for the whole system; the exam expects the narrow fix such as a label, boolean, port type, firewall rule or specific permission.
Clue to watch for The question asks for the BEST or MOST secure way to restore function.
-
Permanent rule not active
- What candidates pick
- Conclude the service is down after adding a firewall rule with --permanent.
- Why it looks right
- The command returned success.
- Why it's wrong
- Permanent rules wait for firewall-cmd --reload; the running firewall has not changed yet.
Clue to watch for The rule was added with --permanent and nothing has been reloaded.
-
audit2allow first
- What candidates pick
- Generate and install a custom policy module from the denial log.
- Why it looks right
- It is a real SELinux tool and the denial goes away.
- Why it's wrong
- It allows whatever was denied, including mislabelled or malicious access; a wrong label or an off-the-shelf boolean is usually the right fix.
Clue to watch for Files were moved or copied into a new path, or a documented boolean exists for the behaviour.
-
Locking yourself out of SSH
- What candidates pick
- Set PasswordAuthentication no and restart sshd immediately.
- Why it looks right
- Key-only login is the hardening goal.
- Why it's wrong
- If key login has not been tested, the change can lock out every administrator; test keys, run sshd -t and keep a session open first.
Clue to watch for The admin is connected remotely and keys are not yet confirmed.
-
shred on modern storage
- What candidates pick
- shred to wipe data on an SSD or a copy-on-write filesystem.
- Why it looks right
- shred is the named overwrite tool.
- Why it's wrong
- Wear levelling and copy-on-write mean overwrites may not hit the original blocks; destroying the encryption key or a full-device method is more reliable.
Clue to watch for SSD, Btrfs or an encrypted volume being decommissioned.
-
Kerberos failure blamed on passwords
- What candidates pick
- Reset the user's directory password when Kerberos logins fail on one server.
- Why it looks right
- Login failure normally suggests credentials.
- Why it's wrong
- If other hosts work, clock skew is a common cause and resetting the password changes nothing.
Clue to watch for Only one server is affected and its time is off, or chrony is stopped.
-
Self-signed certificate in production
- What candidates pick
- Generate a self-signed certificate to fix a TLS warning on a public site.
- Why it looks right
- openssl can create one in seconds.
- Why it's wrong
- Clients do not trust it, so warnings persist and users learn to click through them; use a certificate from a trusted no-cost or commercial authority.
Clue to watch for External users or browsers must connect without warnings.
Answer framework
For a Linux security scenario, find the control involved and fix it narrowly and persistently.
- Classify the need as authentication, authorization, accounting, filtering, confidentiality or integrity, and name the Linux control that provides it.
- Read the evidence, such as an AVC denial, a firewall rule list, getfacl output or sshd configuration, to find the precise rule or attribute involved.
- Choose the narrowest change that meets the requirement, such as one port, one boolean, one ACL entry or one source subnet.
- Make the change persistent with --permanent and reload, setsebool -P, semanage, a file in /etc/sysctl.d or a validated sshd_config.
- Reject any option that disables SELinux, the firewall, signature checks or certificate validation, unless it is explicitly a temporary diagnostic step.
Practice question
Want more like this? The CompTIA Linux+ practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with OS hardening (3.3), because it carries the most named tools and it reappears as troubleshooting objective 5.4. On a RHEL-family lab VM with SELinux enforcing, move a web root to a new directory, read the denial with sealert or ausearch, then fix it with semanage fcontext and restorecon. Practise permissions until umask arithmetic, special bits and ACL masks are automatic, and harden sshd while keeping a second session open.
Next, cover firewalls hands-on: add runtime and permanent firewalld rules, write a rich rule for one subnet, then build a simple NAT gateway with masquerade and ip_forward. Read the same rules in nft list ruleset to see how firewalld maps onto nftables.
The commonly underestimated areas are objective 3.1 (PAM flags, SSSD, Kerberos time, auditd) and objective 3.6 (backported patches, AIDE baselines, banners and secure destruction). These are short to learn but easy to confuse.
Finish with cryptography by mapping each tool to its job: GPG for files, LUKS2 for volumes, WireGuard and TLS for traffic, HMAC for authenticated integrity. Afterwards, take mixed practice sets and, for each miss, ask whether you chose a fix that weakened a control.
FAQ
How much is the Security domain worth on Linux+ XK0-006?
Security is 18% of the exam with six official objectives. Against the 90-question maximum that is roughly 16 items, an editorial planning estimate rather than an official count.
How much SELinux do I need to know?
The objectives name modes, contexts and booleans plus getenforce, setenforce, getsebool, setsebool, semanage, restorecon, chcon, ls -Z, audit2allow and sealert. Be able to read a denial and pick the persistent fix.
Is AppArmor on the XK0-006 objectives?
The current objectives name SELinux as the mandatory access control system and do not list AppArmor among the hardening tools. Focus your MAC study time on SELinux.
What is the difference between firewalld and nftables?
nftables is the kernel-facing rule framework built on Netfilter, while firewalld is a management layer that writes rules into it using zones and services. You can manage rules either way, but mixing them on one host leads to confusion.
Why does the exam mention pam_tally2 if it is deprecated?
The objectives list pam_tally2 for login lockout, but many current distributions use pam_faillock for the same job. Learn the lockout concept and recognise both names.
Which banner file should hold a legal warning?
A pre-login warning belongs in /etc/issue for console logins and /etc/issue.net for SSH, with the sshd Banner directive pointing to it. /etc/motd appears only after login, too late to act as a warning before access.
How does Security relate to the Troubleshooting domain?
Objective 5.4 tests the same controls from the other side: SELinux denials, ACL and attribute problems, certificate errors and obsolete ciphers causing outages. Studying how each control fails is the best preparation for both domains.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 3 knowledge
You have covered PAM and auditing, firewalld and NAT, sudo, permissions, SELinux and SSH hardening, account policy, encryption and compliance tools. Test whether you can restore function without switching off a protection.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CompTIA Linux+ AI tutor Get any concept explained your way