GSEC Linux Fundamentals — Timed 15 Questions

Question 1

You are auditing a Linux server and need to determine which group a user belongs to. Which command will list the groups for the current user?

Accepted Answer

id. The 'groups' command is the standard Linux utility to display all group memberships for a specified user or the current account. Group membership determines access rights to files and services. Improper group assignments can lead to privilege escalation or unauthorized data access, making verification of these permissions a key component of regular security audits and hardening efforts.

Answer

whoami

Answer

ls -g

Answer

cat /etc/passwd

Question 2

Refer to the exhibit. The user is logged in as a standard user and attempts to view the /etc/shadow file using 'sudo'. Why does the command still result in a 'Permission denied' error?

Accepted Answer

The current user is not listed in the /etc/sudoers file.. The user is running 'sudo cat /etc/shadow', which should work if the user has sudo privileges. However, the shell interprets the redirection if the command was written differently, or more likely, the user is not in the 'sudoers' file. In this specific exhibit, the command is 'sudo cat', implying the shell executes cat with root privileges, but if the user lacks sudo rights, access to the file is blocked by the OS.

Answer

The /etc/shadow file is immutable and cannot be read even by root.

Answer

The cat command does not have sufficient permissions to open protected files.

Answer

The /etc/shadow file is encrypted and cannot be viewed as plain text.

Question 3

An administrator wants to search for specific files within the system to identify potential data exfiltration or unauthorized files. Which THREE commands are effective for locating files based on criteria like name, type, or modification time?

Accepted Answer

find / -name 'secret.txt'. Efficiently locating files is crucial for security forensics and system maintenance. The 'find' utility is the most powerful tool for granular searches based on metadata. 'locate' provides a faster, index-based search for names. 'which' is essential for finding executable paths in the system's PATH variable. Mastering these tools enables admins to quickly audit system integrity and track down hidden or misplaced malicious binaries or sensitive data during a security incident.

Answer

which secret.txt

Answer

grep -r 'secret' /

Question 4

A security analyst is reviewing a Linux server that was recently compromised. The analyst needs to determine which user accounts have UID 0 and therefore possess root-equivalent privileges. Which command will list all accounts with UID 0?

Accepted Answer

awk -F: '$3 == 0 {print $1}' /etc/passwd. The correct approach parses /etc/passwd, where each line represents a user account and the third colon-delimited field is the UID. Filtering for UID 0 reveals all accounts with root-equivalent privileges, which is essential for detecting unauthorized backdoor accounts after a compromise. Other commands either search the wrong field, omit usernames, or target the wrong file entirely.

Answer

cat /etc/shadow | awk -F: '$3 == 0 {print $1}'

Answer

cut -d: -f3 /etc/passwd | sort -u

Answer

grep ':0:' /etc/passwd

Question 5

A security analyst notices repeated failed SSH login attempts for the account 'deploy' on a production Linux server. The analyst wants to inspect the failed authentication records and the source IP addresses of those attempts. Which file should the analyst review?

Accepted Answer

/var/log/auth.log. Failed SSH authentication attempts are logged by sshd through PAM into the system's authentication log. On Debian and Ubuntu systems this is /var/log/auth.log, which records timestamps, usernames, and source IP addresses. Reviewing this file lets the analyst identify brute-force patterns and block offending addresses. The other files either store unrelated data or are distribution-specific alternatives.

Answer

/var/log/secure

Answer

/etc/shadow

Answer

/var/log/syslog

Question 6

A security administrator needs to grant a contractor temporary access to a sensitive directory '/projects/secret'. The contractor must be able to read and write files but must not be able to change permissions or delete the directory itself. The contractor is already a member of the group 'contractors'. Which command should the administrator use to set the directory's permissions accordingly?

Accepted Answer

chmod 2770 /projects/secret. The administrator needs to provide read and write access to the 'contractors' group while preventing others from accessing the directory. Mode 2770 achieves this by granting rwx to owner and group, no access to others, and setting the setgid bit so new files inherit the group. The setgid bit also helps maintain group ownership for collaboration. Other modes either grant excessive permissions or lack necessary write access.

Answer

chmod 1777 /projects/secret

Answer

chmod 2755 /projects/secret

Answer

chmod 0770 /projects/secret

Question 7

A security administrator is configuring a Linux server to meet security benchmarks. The administrator needs to ensure that only authorized users can execute the 'passwd' command to change their own passwords, while preventing them from changing other users' passwords. Which TWO commands or configurations should the administrator use to verify and enforce this? (Choose two.)

Accepted Answer

Check the permissions on /usr/bin/passwd using ls -l /usr/bin/passwd. To ensure that users can change only their own passwords, the administrator should verify the setuid permissions on /usr/bin/passwd and review the PAM configuration in /etc/pam.d/passwd. These steps confirm that the passwd command runs with necessary privileges and that PAM enforces proper restrictions. Other actions like setting immutable attributes or adding users to the shadow group would either break functionality or weaken security.

Answer

Use the command chmod u+s /usr/bin/passwd to set the setuid bit

Answer

Add all users to the 'shadow' group to allow password changes

Answer

Set the immutable attribute on /etc/passwd using chattr +i /etc/passwd

Question 8

A security engineer is performing a forensic review of a Linux server and finds that a file named 'evidence.tar.gz' was created in a shared directory. The engineer needs to preserve the original file's timestamps while making a byte-for-byte working copy to analyze on a separate system. Which command should the engineer use to create the copy while retaining the original access, modification, and change times?

Accepted Answer

cp -a evidence.tar.gz /mnt/analysis/. The archive flag for cp is designed to preserve as much file metadata as possible, including permissions, ownership, timestamps, and extended attributes. In a forensic duplication scenario, maintaining the original timestamps is crucial for timeline analysis and evidentiary integrity. While the change time cannot be perfectly preserved by any user-space copy, the archive flag is the standard method to retain the access and modification times, which are the primary timestamps used in file system forensics. Other options either do not preserve timestamps or create a different type of artifact.

Answer

cp --preserve=all evidence.tar.gz /mnt/analysis/

Answer

tar -cvf /mnt/analysis/evidence.tar.gz evidence.tar.gz

Answer

rsync -aHAX evidence.tar.gz /mnt/analysis/

Question 9

A security administrator needs to ensure that a newly created script, 'cleanup.sh', can only be executed by the file owner, while preventing any other users from reading or writing the file. Which command achieves this configuration?

Accepted Answer

chmod 700 cleanup.sh. The chmod command with the octal value 700 applies read, write, and execute permissions exclusively to the owner (7), while setting no permissions for the group (0) and others (0). This follows the principle of least privilege by isolating the script's execution to the authorized user. Restricting access is critical in Linux security to prevent unauthorized execution of potentially sensitive maintenance utilities by standard users or attackers.

Answer

chmod 777 cleanup.sh

Answer

chmod 755 cleanup.sh

Answer

chmod 600 cleanup.sh

Question 10

Refer to the exhibit. A user attempts to delete a file located inside '/opt/backup', but the operation fails with a 'Permission denied' error. Given the directory permissions shown, what is the most likely cause?

Accepted Answer

The user lacks write permission on the /opt/backup directory.. The directory permissions 'drwxr-xr-x' indicate that the owner (root) has full control, while others have read and execute access. However, because the user is neither root nor the directory owner, they lack write permission (w) on the parent directory. In Linux, deleting a file requires write and execute permissions on the directory containing it, not just the file itself. This mechanism protects directory integrity from unauthorized modifications by non-privileged users.

Answer

The user lacks the execute permission on the /opt/backup directory.

Answer

The file inside the directory is owned by root and is immutable.

Answer

The user does not have the 'sudo' command available in their path.

Question 11

An administrator is reviewing system logs to identify potential unauthorized access attempts. Which TWO commands are commonly used to view the last few lines of a log file in real-time?

Accepted Answer

tail -f /var/log/auth.log. Monitoring logs in real-time is a fundamental skill for GSEC professionals to detect ongoing attacks or system errors. The 'tail -f' command is the standard utility for following a file's growth. Alternatively, 'less +F' offers a more robust interface that allows the admin to toggle between real-time monitoring and static analysis, providing better flexibility when investigating complex log entries during an active incident response scenario.

Answer

head -n 20 /var/log/auth.log

Answer

cat /var/log/auth.log | grep -v 'accepted'

Answer

more /var/log/auth.log

Question 12

A Linux administrator needs to identify which processes are currently consuming the most CPU resources. Which command provides an interactive, real-time view of system performance and process activity?

Accepted Answer

top. The 'top' command (or its modern alternative 'htop') is the primary utility for real-time monitoring of system resources, including CPU, memory, and running tasks. Understanding how to interpret and interact with these utilities is vital for identifying rogue processes or system bottlenecks that could indicate a malware infection or a resource-exhaustion attack, allowing administrators to terminate suspicious processes immediately using built-in command signals.

Answer

ps aux

Answer

ls -l /proc

Answer

df -h

Question 13

A security analyst needs to determine which network ports are currently listening for incoming connections on a Linux server. Which command is best suited for this task?

Accepted Answer

ss -tulpn. Identifying open ports is a critical step in reducing the attack surface of a Linux server. The 'ss' (socket statistics) command is the modern, high-performance replacement for the deprecated 'netstat'. It provides detailed information about active connections, listening ports, and the associated process IDs, helping administrators quickly spot unauthorized services that might serve as entry points for malicious actors.

Answer

ifconfig -a

Answer

ping -c 5 localhost

Answer

dig @localhost

Question 14

A security analyst is reviewing a compromised Linux web server. The attacker escalated to root and then ran a script that unlinked the file /var/log/auth.log to hide their tracks. The analyst runs `lsof | grep auth.log` and sees the file is still open by the rsyslogd process, but `ls /var/log/auth.log` reports that the file does not exist. Which of the following best explains why the file content is still accessible through the open file descriptor?

Accepted Answer

The Linux kernel maintains the inode and data blocks until the last open file descriptor referencing the inode is closed, even after the directory entry is removed.. When a file is unlinked on Linux, the directory entry is removed but the inode persists as long as a process holds an open file descriptor. rsyslogd keeps auth.log open for writing, so the kernel cannot free the inode or data blocks. The analyst can recover the contents via /proc//fd/, even though the pathname no longer resolves. Restarting rsyslogd would close the descriptor and finally reclaim the inode.

Answer

The rsyslogd process has the file memory-mapped with mmap, so the page cache keeps a copy that ls can still resolve by inode lookup.

Answer

The file was moved to a hidden directory by the attacker, and lsof is resolving the path from the process's current working directory rather than the real inode.

Answer

The ext4 filesystem journals file deletions, and lsof reads the journal to reconstruct the file contents until the journal is overwritten by subsequent writes.

Question 15

A Linux server has the setuid bit set on /usr/bin/passwd. A security engineer notices that a custom binary /opt/tools/backup_tool also has the setuid bit set and is owned by root. The engineer wants to determine whether executing backup_tool will run with root privileges regardless of which user invokes it. Which of the following is the most accurate statement about how the setuid bit affects process credentials on Linux?

Accepted Answer

The process runs with the effective UID of the file owner, but the real UID remains that of the invoking user, and the saved set-user-ID is set to the file owner's UID.. Executing a setuid binary causes the kernel to set the process's effective UID to the file owner's UID while preserving the real UID of the invoking user. The saved set-user-ID is also set to the file owner's UID, which lets the program temporarily drop and reacquire elevated privileges. This mechanism is why setuid root binaries are high-value targets: any vulnerability in backup_tool could yield root-level access to an unprivileged attacker.

Answer

The process runs with the effective UID of the file owner only if the binary is also executable by the invoking user; otherwise the kernel silently falls back to the invoking user's UID.

Answer

The setuid bit is ignored on Linux unless the filesystem is mounted with the suid option, so the behavior depends entirely on the mount options of the filesystem holding the binary.

Answer

The process runs with the real UID, effective UID, and saved set-user-ID all set to the file owner's UID, so the invoking user's identity is completely lost to the kernel.