ITForMe Sign in
LINUX+ XK0-006 V8 Security and troubleshooting Runs in your browser · no setup Preview · not independently reviewed

Separate firewalld and SELinux failures

Use service, socket, firewall, and audit evidence to fix two controls without disabling either one.

Estimated14 min
DifficultyAdvanced
Points9
Scenario brief

Silverline Archives moved an NGINX reverse proxy to TCP 8443. Local TLS works, but remote clients time out and proxied requests return 502. Security policy requires SELinux enforcing and firewalld active; diagnose each symptom independently.

Content record

Preview · not independently reviewed

Mapped to CompTIA XK0-006 objectives · Internal validation 2026-08-13 · Available as preview practice, but a named independent subject-matter expert has not yet verified the question and answer key.

Community review →
3.2Given a scenario, configure and implement firewalls on a Linux system. 5.4Given a scenario, analyze and troubleshoot security issues on a Linux system. 3.3Given a scenario, apply operating system hardening techniques on a Linux system.
Show review record and official sources

Method: Mapped to XK0-006 V8 firewall and security troubleshooting objectives 3.2 and 5.4; firewalld persistence, SELinux boolean evidence, and least-disruptive remediation were checked against Red Hat documentation.

Current-profile check: 2026-08-12 · Next review due 2027-02-08

01

Inspect the evidence

Use only the information provided to complete the tasks.

Host evidence

code
$ systemctl is-active nginx firewalld
active
active
$ sudo ss -lntp | grep 8443
LISTEN 0 511 0.0.0.0:8443 users:(("nginx",pid=912,fd=6))
$ curl -sk https://127.0.0.1:8443/health
proxy-ready
$ firewall-cmd --get-active-zones
public
  interfaces: ens192
$ firewall-cmd --zone=public --list-ports

$ semanage port -l | grep http_port_t
http_port_t tcp 80, 443, 488, 8008, 8009, 8443, 9000
$ getsebool httpd_can_network_connect
httpd_can_network_connect --> off
$ ausearch -m AVC -ts recent | tail -1
denied { name_connect } comm="nginx" dest=9000 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:http_port_t:s0

Approved flow

list
  • ›Remote clients → WEB-04:8443/tcp through the public zone
  • ›NGINX on WEB-04 → application service 10.70.20.40:9000/tcp
  • ›No request to disable SELinux, stop firewalld, or open unrelated ports
02

Complete the response

Partial credit is available for matching, ordering, and multi-select tasks.

01
matching

Match each symptom or observation to the controlling layer it implicates.

3 pts
Need a hint?

Start with the row and choice that have the most distinctive purpose, then use that pair to narrow the rest.

Show another hint

For each remaining pair, explain the relationship in one sentence before selecting it.

02
command

Enter the command that adds the approved persistent 8443/tcp rule to the active public zone. A controlled reload will follow.

3 pts

Whitespace and capitalization are ignored when grading.

Need a hint?

Break the request into three parts: the action, the target, and the required constraint or verification.

Show another hint

Check the tool and subcommand first, then add only the flags, values, and paths the prompt requires.

03
multi select

Select the THREE actions that complete the secure remediation.

3 pts
Need a hint?

Evaluate each option independently against the scenario evidence instead of treating the list as one decision.

Show another hint

Choose only options that directly satisfy the prompt; being generally true is not enough.

Ready to check your work?Submit to finish this session and review your feedback. Extra practice is optional.
Persistent progress

Attempt history

Every submission is retained. Starting another attempt never replaces or unlocks the previous one.

No attempts yet

Your first submitted score and detailed answer review will appear here.

Community quality control

Question or answer look wrong?

Proposals and votes help staff prioritize review. They never change the scoring key automatically.

Full review queue →
No community corrections yet

Be the first to flag unclear wording, an answer-key issue, or a source that needs another look.

Propose a correction