GSEC Linux Fundamentals — 10 Questions

Question 1

You are auditing a Linux server and need to determine which group a user belongs to. Which command will list the groups for the current user?

Accepted Answer

id. The 'groups' command is the standard Linux utility to display all group memberships for a specified user or the current account. Group membership determines access rights to files and services. Improper group assignments can lead to privilege escalation or unauthorized data access, making verification of these permissions a key component of regular security audits and hardening efforts.

Answer

whoami

Answer

ls -g

Answer

cat /etc/passwd

Question 2

Refer to the exhibit. The user is logged in as a standard user and attempts to view the /etc/shadow file using 'sudo'. Why does the command still result in a 'Permission denied' error?

Accepted Answer

The current user is not listed in the /etc/sudoers file.. The user is running 'sudo cat /etc/shadow', which should work if the user has sudo privileges. However, the shell interprets the redirection if the command was written differently, or more likely, the user is not in the 'sudoers' file. In this specific exhibit, the command is 'sudo cat', implying the shell executes cat with root privileges, but if the user lacks sudo rights, access to the file is blocked by the OS.

Answer

The /etc/shadow file is immutable and cannot be read even by root.

Answer

The cat command does not have sufficient permissions to open protected files.

Answer

The /etc/shadow file is encrypted and cannot be viewed as plain text.

Question 3

An administrator wants to search for specific files within the system to identify potential data exfiltration or unauthorized files. Which THREE commands are effective for locating files based on criteria like name, type, or modification time?

Accepted Answer

find / -name 'secret.txt'. Efficiently locating files is crucial for security forensics and system maintenance. The 'find' utility is the most powerful tool for granular searches based on metadata. 'locate' provides a faster, index-based search for names. 'which' is essential for finding executable paths in the system's PATH variable. Mastering these tools enables admins to quickly audit system integrity and track down hidden or misplaced malicious binaries or sensitive data during a security incident.

Answer

which secret.txt

Answer

grep -r 'secret' /

Question 4

A security analyst is reviewing a Linux server that was recently compromised. The analyst needs to determine which user accounts have UID 0 and therefore possess root-equivalent privileges. Which command will list all accounts with UID 0?

Accepted Answer

awk -F: '$3 == 0 {print $1}' /etc/passwd. The correct approach parses /etc/passwd, where each line represents a user account and the third colon-delimited field is the UID. Filtering for UID 0 reveals all accounts with root-equivalent privileges, which is essential for detecting unauthorized backdoor accounts after a compromise. Other commands either search the wrong field, omit usernames, or target the wrong file entirely.

Answer

cat /etc/shadow | awk -F: '$3 == 0 {print $1}'

Answer

cut -d: -f3 /etc/passwd | sort -u

Answer

grep ':0:' /etc/passwd

Question 5

A security analyst notices repeated failed SSH login attempts for the account 'deploy' on a production Linux server. The analyst wants to inspect the failed authentication records and the source IP addresses of those attempts. Which file should the analyst review?

Accepted Answer

/var/log/auth.log. Failed SSH authentication attempts are logged by sshd through PAM into the system's authentication log. On Debian and Ubuntu systems this is /var/log/auth.log, which records timestamps, usernames, and source IP addresses. Reviewing this file lets the analyst identify brute-force patterns and block offending addresses. The other files either store unrelated data or are distribution-specific alternatives.

Answer

/var/log/secure

Answer

/etc/shadow

Answer

/var/log/syslog

Question 6

A security administrator needs to grant a contractor temporary access to a sensitive directory '/projects/secret'. The contractor must be able to read and write files but must not be able to change permissions or delete the directory itself. The contractor is already a member of the group 'contractors'. Which command should the administrator use to set the directory's permissions accordingly?

Accepted Answer

chmod 2770 /projects/secret. The administrator needs to provide read and write access to the 'contractors' group while preventing others from accessing the directory. Mode 2770 achieves this by granting rwx to owner and group, no access to others, and setting the setgid bit so new files inherit the group. The setgid bit also helps maintain group ownership for collaboration. Other modes either grant excessive permissions or lack necessary write access.

Answer

chmod 1777 /projects/secret

Answer

chmod 2755 /projects/secret

Answer

chmod 0770 /projects/secret

Question 7

A security administrator is configuring a Linux server to meet security benchmarks. The administrator needs to ensure that only authorized users can execute the 'passwd' command to change their own passwords, while preventing them from changing other users' passwords. Which TWO commands or configurations should the administrator use to verify and enforce this? (Choose two.)

Accepted Answer

Check the permissions on /usr/bin/passwd using ls -l /usr/bin/passwd. To ensure that users can change only their own passwords, the administrator should verify the setuid permissions on /usr/bin/passwd and review the PAM configuration in /etc/pam.d/passwd. These steps confirm that the passwd command runs with necessary privileges and that PAM enforces proper restrictions. Other actions like setting immutable attributes or adding users to the shadow group would either break functionality or weaken security.

Answer

Use the command chmod u+s /usr/bin/passwd to set the setuid bit

Answer

Add all users to the 'shadow' group to allow password changes

Answer

Set the immutable attribute on /etc/passwd using chattr +i /etc/passwd

Question 8

A security engineer is performing a forensic review of a Linux server and finds that a file named 'evidence.tar.gz' was created in a shared directory. The engineer needs to preserve the original file's timestamps while making a byte-for-byte working copy to analyze on a separate system. Which command should the engineer use to create the copy while retaining the original access, modification, and change times?

Accepted Answer

cp -a evidence.tar.gz /mnt/analysis/. The archive flag for cp is designed to preserve as much file metadata as possible, including permissions, ownership, timestamps, and extended attributes. In a forensic duplication scenario, maintaining the original timestamps is crucial for timeline analysis and evidentiary integrity. While the change time cannot be perfectly preserved by any user-space copy, the archive flag is the standard method to retain the access and modification times, which are the primary timestamps used in file system forensics. Other options either do not preserve timestamps or create a different type of artifact.

Answer

cp --preserve=all evidence.tar.gz /mnt/analysis/

Answer

tar -cvf /mnt/analysis/evidence.tar.gz evidence.tar.gz

Answer

rsync -aHAX evidence.tar.gz /mnt/analysis/

Question 9

A security administrator needs to ensure that a newly created script, 'cleanup.sh', can only be executed by the file owner, while preventing any other users from reading or writing the file. Which command achieves this configuration?

Accepted Answer

chmod 700 cleanup.sh. The chmod command with the octal value 700 applies read, write, and execute permissions exclusively to the owner (7), while setting no permissions for the group (0) and others (0). This follows the principle of least privilege by isolating the script's execution to the authorized user. Restricting access is critical in Linux security to prevent unauthorized execution of potentially sensitive maintenance utilities by standard users or attackers.

Answer

chmod 777 cleanup.sh

Answer

chmod 755 cleanup.sh

Answer

chmod 600 cleanup.sh

Question 10

Refer to the exhibit. A user attempts to delete a file located inside '/opt/backup', but the operation fails with a 'Permission denied' error. Given the directory permissions shown, what is the most likely cause?

Accepted Answer

The user lacks write permission on the /opt/backup directory.. The directory permissions 'drwxr-xr-x' indicate that the owner (root) has full control, while others have read and execute access. However, because the user is neither root nor the directory owner, they lack write permission (w) on the parent directory. In Linux, deleting a file requires write and execute permissions on the directory containing it, not just the file itself. This mechanism protects directory integrity from unauthorized modifications by non-privileged users.

Answer

The user lacks the execute permission on the /opt/backup directory.

Answer

The file inside the directory is owned by root and is immutable.

Answer

The user does not have the 'sudo' command available in their path.