CompTIA Updated XK0-005 Exam Questions and Answers by maverick

The correct answer is A. semanage port -a -t ssh_port_t -p tcp 2222

This command will allow the SSH server to bind to port 2222 by adding it to the SELinux policy. The semanage command is a utility for managing SELinux policies. The port subcommand is used to manage network port definitions. The -a option is used to add a new record, the -t option is used to specify the SELinux type, the -p option is used to specify the protocol, and the tcp 2222 argument is used to specify the port number. The ssh_port_t type is the default type for SSH ports in SELinux.

The other options are incorrect because:

B. chcon system_u:object_r:ssh_home_t /etc/ssh/*

This command will change the SELinux context of all files under /etc/ssh/ to system_u:object_r:ssh_home_t, which is not correct. The ssh_home_t type is used for user home directories that are accessed by SSH, not for SSH configuration files. The correct type for SSH configuration files is sshd_config_t.

C. iptables -A INPUT -p tcp --dport 2222 -j ACCEPT

This command will add a rule to the iptables firewall to accept incoming TCP connections on port 2222. However, this is not enough to fix the issue, as SELinux will still block the SSH server from binding to that port. Moreover, iptables may not be the default firewall service on some Linux distributions, such as Fedora or CentOS, which use firewalld instead.

D. firewall-cmd --zone=public --add-port=2222/tcp

This command will add a rule to the firewalld firewall to allow incoming TCP connections on port 2222 in the public zone. However, this is not enough to fix the issue, as SELinux will still block the SSH server from binding to that port. Moreover, firewalld may not be installed or enabled on some Linux distributions, such as Ubuntu or Debian, which use iptables instead.

References:

How to configure SSH to use a non-standard port with SELinux set to enforcing

Change SSH Port on CentOS/RHEL/Fedora With SELinux Enforcing

How to change SSH port when SELinux policy is enabled

The tuned application is the best tool for dynamic tuning of kernel parameters, as it monitors the system and optimizes the performance under different workloads. It provides a number of predefined profiles for typical use cases, such as power saving, low latency, high throughput, virtual machine performance, and so on. It also allows users to create, modify, and delete profiles, and to switch between them on the fly. The tuned application uses the sysctl command and the configuration files in the /etc/sysctl.d/ directory to adjust the kernel parameters at runtime.

References

Chapter 2. Getting started with TuneD - Red Hat Customer Portal, paragraph 1

Kernel tuning with sysctl - Linux.com, paragraph 1

The best command to use to prevent the httpd web service from being started both manually and automatically on a server is A. systemctl mask httpd. This command will create a symbolic link from the httpd service unit file to /dev/null, which will make the service impossible to start or enable. This is different from systemctl disable httpd, which will only prevent the service from starting automatically on boot, but not manually. The other commands are either not relevant or not sufficient for this task. For example:

C. systemctl stop httpd will only stop the service if it is currently running, but it will not prevent it from being started again.

D. systemctl reload httpd will only reload the configuration files of the service, but it will not stop or disable it.

The error indicates that SELinux is preventing Apache from connecting to the database. The command setsebool -F httpd_can_network_connect_db on allows the Apache web server to make network connections to the database, resolving the permission denied error without disabling SELinux entirely.