GSEC Linux Security and Hardening — 10 Questions

Question 1

A security engineer needs to manage Mandatory Access Control (MAC) settings on a Red Hat Enterprise Linux (RHEL) system. Which TWO commands are most essential for viewing and modifying the state and file labeling of SELinux?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

setenforce. Mandatory Access Control provides an additional layer of security by restricting how processes interact with files and other processes, even if they have root privileges. In SELinux-based distributions, managing the operational mode and ensuring files have the correct security context labels is vital for maintaining system stability while enforcing security policies.

Answer

umask

Answer

iptables

Answer

sysctl

Question 2

Refer to the exhibit. An analyst is reviewing the /etc/shadow file to verify account security policies. Based on the entry for the user 'jdoe', what is the current password expiration policy?

Accepted Answer

The password must be changed every 90 days.. The /etc/shadow file stores sensitive account information, including hashed passwords and aging parameters. Security professionals must be able to parse this file to ensure that password rotation policies are being enforced. Each field between the colons represents a specific attribute that dictates how the system handles the user's authentication credentials.

Answer

The account is currently locked and cannot log in.

Answer

The user must wait 7 days between password changes.

Answer

The password expires exactly 19,000 days after creation.

Question 3

A system administrator wants to review recent authentication failures on a modern Linux distribution that uses systemd. Which command is the most efficient way to view these logs in real-time?

Accepted Answer

journalctl -f -u ssh. Logging is a critical component of the 'Detect' function in security. Modern Linux systems have moved away from traditional text-based logs in /var/log/ for many services, instead utilizing the journald binary format. Knowing how to query this journal is essential for responding to active security incidents and monitoring system health.

Answer

tail -f /var/log/messages

Answer

cat /etc/rsyslog.conf

Answer

grep 'fail' /var/log/auth.log

Question 4

Refer to the exhibit. What is the effect of this entry in the /etc/sudoers file for a user who belongs to the 'webadmins' group?

Accepted Answer

Users can only run the specific apt-get commands listed as root.. The sudoers file is the primary mechanism for implementing delegated administration in Linux. Poorly configured sudo rules can lead to unintended privilege escalation. Security professionals must understand how to read and write these rules to ensure that users have only the permissions they need to perform their specific job functions.

Answer

Users can update any software without providing a password.

Answer

The group 'webadmins' has full root access to the entire system.

Answer

The rule allows webadmins to change their own passwords to root.

Question 5

A security engineer is hardening an Ubuntu 22.04 web server that hosts a public Apache site. The site's document root is /var/www/html, owned by root:root with mode 755. Developers need to upload files without SSH access, so the engineer wants to ensure that any file or directory created inside /var/www/html by the apache user cannot be executed as a program, while still allowing PHP files to be served by the web server. Which control best accomplishes this?

Accepted Answer

Mount the /var/www/html filesystem with the noexec option, and configure Apache to pass PHP files to the PHP-FPM service over a Unix socket.. The only control that reliably prevents execution of files placed in the document root is mounting that filesystem with noexec. Because Apache delegates PHP parsing to PHP-FPM rather than executing the script as a binary, legitimate PHP still renders while uploaded binaries or shell scripts cannot run. Ownership inheritance, immutable attributes, and permissive MAC policies do not stop execution of newly created files.

Answer

Apply chattr +i to every existing file in /var/www/html and set the default umask to 0777 so new uploads cannot contain execute permissions.

Answer

Enable SELinux with the httpd_sys_content_t type on /var/www/html and enforce the targeted policy in permissive mode.

Answer

Set the SGID bit on /var/www/html so new files inherit the apache group, then rely on group permissions to deny execution.

Question 6

A security administrator is configuring SSH access on a Debian 12 bastion host used by contractors. Contractors must authenticate with SSH keys, but the administrator wants to ensure that contractor keys cannot be used to open additional channels such as port forwarding or agent forwarding into the internal network, even if a contractor adds directives to their own client configuration. Which sshd_config approach enforces this server-side?

Accepted Answer

Use a Match Group block for contractors and set AllowTcpForwarding no, AllowAgentForwarding no, and PermitOpen none within it.. Server-side enforcement through a Match Group block is the correct approach because Match applies directives conditionally to a defined set of users. Within that block, disabling TCP and agent forwarding with AllowTcpForwarding, AllowAgentForwarding, and PermitOpen none prevents contractors from creating tunnels regardless of their client configuration. Global directives that only harden authentication or limit a single forwarding destination do not stop forwarding channels.

Answer

Set PermitRootLogin no and PasswordAuthentication no globally, then require contractors to use keys.

Answer

Configure PermitOpen localhost:22 in the global section so all forwarding is limited to the SSH port, and instruct contractors not to change it.

Answer

Deploy a ForceCommand internal-sftp directive for the contractor group so their sessions can only transfer files.

Question 7

A security analyst is reviewing a Linux server's auditd configuration. The goal is to monitor all attempts to modify the /etc/passwd file, including successful and failed write attempts. Which audit rule correctly achieves this?

Accepted Answer

-w /etc/passwd -p wa -k passwd_changes. The auditd subsystem on Linux allows administrators to monitor file access using watch rules. The -w option creates a watch on a file or directory, and the -p flag specifies the permissions to monitor. For modification attempts, the mask should include write (w) and attribute change (a). This captures both successful and failed attempts, as auditd logs all matching events. The key (-k) helps in searching logs. This is the most efficient and precise rule for the stated requirement.

Answer

-a always,exit -F path=/etc/passwd -F perm=rw -k passwd_changes

Answer

-w /etc/passwd -p rwxa -k passwd_changes

Answer

-a always,exit -F arch=b64 -S open -F path=/etc/passwd -k passwd_changes

Question 8

A security administrator is hardening a Linux server that uses systemd. The administrator wants to restrict the ability of users to escalate privileges via the su command. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Configure the /etc/pam.d/su file to include 'auth required pam_wheel.so use_uid'.. To restrict su usage to authorized users, the administrator should leverage PAM's pam_wheel module. By adding authorized users to the 'wheel' group and configuring /etc/pam.d/su to require wheel membership, only those users can escalate privileges via su. This provides granular control without disabling the command entirely. Removing setuid or changing permissions would break su for everyone, which is not desired. Therefore, the two correct actions are adding users to the wheel group and configuring PAM accordingly.

Answer

Set the 'su' command to be executable only by root using file ACLs.

Answer

Set the su binary's permissions to 700 and owned by root.

Answer

Remove the setuid bit from the su binary.

Question 9

A system administrator needs to harden a public-facing Linux server against automated brute-force attacks. Which configuration change in the /etc/ssh/sshd_config file provides the most significant reduction in the attack surface regarding credential stuffing?

Accepted Answer

PasswordAuthentication no. Securing the Secure Shell daemon is a foundational step in Linux hardening, especially for internet-accessible systems. While multiple settings contribute to a defense-in-depth strategy, moving away from knowledge-based authentication to key-based authentication represents the single most impactful change. This reduces the attack surface by requiring a digital token that cannot be guessed or easily intercepted via network sniffing techniques.

Answer

PermitRootLogin no

Answer

MaxAuthTries 3

Answer

AllowUsers admin

Question 10

An information security auditor discovers a custom compiled binary in a shared directory with the following permissions: -rwsr-xr-x. The file is owned by the root user. What is the primary security implication of this finding?

Accepted Answer

The binary executes with the privileges of the root user.. Understanding special permissions like SUID is critical for Linux security because they often lead to privilege escalation vulnerabilities. When the SUID bit is set on a file owned by root, any user who executes that file gains root-level privileges for the duration of the process. If the binary is poorly written, it can be exploited.

Answer

The file can be modified by any user in the group.

Answer

The file is encrypted and requires a password to run.

Answer

The binary is restricted to running only in runlevel 1.