GSEC Linux Security and Hardening — All Questions With Answers

Question 1

A security engineer needs to manage Mandatory Access Control (MAC) settings on a Red Hat Enterprise Linux (RHEL) system. Which TWO commands are most essential for viewing and modifying the state and file labeling of SELinux?

Accepted Answer

setenforce. Mandatory Access Control provides an additional layer of security by restricting how processes interact with files and other processes, even if they have root privileges. In SELinux-based distributions, managing the operational mode and ensuring files have the correct security context labels is vital for maintaining system stability while enforcing security policies.

Answer

umask

Answer

iptables

Answer

sysctl

Question 2

Refer to the exhibit. An analyst is reviewing the /etc/shadow file to verify account security policies. Based on the entry for the user 'jdoe', what is the current password expiration policy?

Accepted Answer

The password must be changed every 90 days.. The /etc/shadow file stores sensitive account information, including hashed passwords and aging parameters. Security professionals must be able to parse this file to ensure that password rotation policies are being enforced. Each field between the colons represents a specific attribute that dictates how the system handles the user's authentication credentials.

Answer

The account is currently locked and cannot log in.

Answer

The user must wait 7 days between password changes.

Answer

The password expires exactly 19,000 days after creation.

Question 3

A system administrator wants to review recent authentication failures on a modern Linux distribution that uses systemd. Which command is the most efficient way to view these logs in real-time?

Accepted Answer

journalctl -f -u ssh. Logging is a critical component of the 'Detect' function in security. Modern Linux systems have moved away from traditional text-based logs in /var/log/ for many services, instead utilizing the journald binary format. Knowing how to query this journal is essential for responding to active security incidents and monitoring system health.

Answer

tail -f /var/log/messages

Answer

cat /etc/rsyslog.conf

Answer

grep 'fail' /var/log/auth.log

Question 4

Refer to the exhibit. What is the effect of this entry in the /etc/sudoers file for a user who belongs to the 'webadmins' group?

Accepted Answer

Users can only run the specific apt-get commands listed as root.. The sudoers file is the primary mechanism for implementing delegated administration in Linux. Poorly configured sudo rules can lead to unintended privilege escalation. Security professionals must understand how to read and write these rules to ensure that users have only the permissions they need to perform their specific job functions.

Answer

Users can update any software without providing a password.

Answer

The group 'webadmins' has full root access to the entire system.

Answer

The rule allows webadmins to change their own passwords to root.

Question 5

A security engineer is hardening an Ubuntu 22.04 web server that hosts a public Apache site. The site's document root is /var/www/html, owned by root:root with mode 755. Developers need to upload files without SSH access, so the engineer wants to ensure that any file or directory created inside /var/www/html by the apache user cannot be executed as a program, while still allowing PHP files to be served by the web server. Which control best accomplishes this?

Accepted Answer

Mount the /var/www/html filesystem with the noexec option, and configure Apache to pass PHP files to the PHP-FPM service over a Unix socket.. The only control that reliably prevents execution of files placed in the document root is mounting that filesystem with noexec. Because Apache delegates PHP parsing to PHP-FPM rather than executing the script as a binary, legitimate PHP still renders while uploaded binaries or shell scripts cannot run. Ownership inheritance, immutable attributes, and permissive MAC policies do not stop execution of newly created files.

Answer

Apply chattr +i to every existing file in /var/www/html and set the default umask to 0777 so new uploads cannot contain execute permissions.

Answer

Enable SELinux with the httpd_sys_content_t type on /var/www/html and enforce the targeted policy in permissive mode.

Answer

Set the SGID bit on /var/www/html so new files inherit the apache group, then rely on group permissions to deny execution.

Question 6

A security administrator is configuring SSH access on a Debian 12 bastion host used by contractors. Contractors must authenticate with SSH keys, but the administrator wants to ensure that contractor keys cannot be used to open additional channels such as port forwarding or agent forwarding into the internal network, even if a contractor adds directives to their own client configuration. Which sshd_config approach enforces this server-side?

Accepted Answer

Use a Match Group block for contractors and set AllowTcpForwarding no, AllowAgentForwarding no, and PermitOpen none within it.. Server-side enforcement through a Match Group block is the correct approach because Match applies directives conditionally to a defined set of users. Within that block, disabling TCP and agent forwarding with AllowTcpForwarding, AllowAgentForwarding, and PermitOpen none prevents contractors from creating tunnels regardless of their client configuration. Global directives that only harden authentication or limit a single forwarding destination do not stop forwarding channels.

Answer

Set PermitRootLogin no and PasswordAuthentication no globally, then require contractors to use keys.

Answer

Configure PermitOpen localhost:22 in the global section so all forwarding is limited to the SSH port, and instruct contractors not to change it.

Answer

Deploy a ForceCommand internal-sftp directive for the contractor group so their sessions can only transfer files.

Question 7

A security analyst is reviewing a Linux server's auditd configuration. The goal is to monitor all attempts to modify the /etc/passwd file, including successful and failed write attempts. Which audit rule correctly achieves this?

Accepted Answer

-w /etc/passwd -p wa -k passwd_changes. The auditd subsystem on Linux allows administrators to monitor file access using watch rules. The -w option creates a watch on a file or directory, and the -p flag specifies the permissions to monitor. For modification attempts, the mask should include write (w) and attribute change (a). This captures both successful and failed attempts, as auditd logs all matching events. The key (-k) helps in searching logs. This is the most efficient and precise rule for the stated requirement.

Answer

-a always,exit -F path=/etc/passwd -F perm=rw -k passwd_changes

Answer

-w /etc/passwd -p rwxa -k passwd_changes

Answer

-a always,exit -F arch=b64 -S open -F path=/etc/passwd -k passwd_changes

Question 8

A security administrator is hardening a Linux server that uses systemd. The administrator wants to restrict the ability of users to escalate privileges via the su command. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Configure the /etc/pam.d/su file to include 'auth required pam_wheel.so use_uid'.. To restrict su usage to authorized users, the administrator should leverage PAM's pam_wheel module. By adding authorized users to the 'wheel' group and configuring /etc/pam.d/su to require wheel membership, only those users can escalate privileges via su. This provides granular control without disabling the command entirely. Removing setuid or changing permissions would break su for everyone, which is not desired. Therefore, the two correct actions are adding users to the wheel group and configuring PAM accordingly.

Answer

Set the 'su' command to be executable only by root using file ACLs.

Answer

Set the su binary's permissions to 700 and owned by root.

Answer

Remove the setuid bit from the su binary.

Question 9

A system administrator needs to harden a public-facing Linux server against automated brute-force attacks. Which configuration change in the /etc/ssh/sshd_config file provides the most significant reduction in the attack surface regarding credential stuffing?

Accepted Answer

PasswordAuthentication no. Securing the Secure Shell daemon is a foundational step in Linux hardening, especially for internet-accessible systems. While multiple settings contribute to a defense-in-depth strategy, moving away from knowledge-based authentication to key-based authentication represents the single most impactful change. This reduces the attack surface by requiring a digital token that cannot be guessed or easily intercepted via network sniffing techniques.

Answer

PermitRootLogin no

Answer

MaxAuthTries 3

Answer

AllowUsers admin

Question 10

An information security auditor discovers a custom compiled binary in a shared directory with the following permissions: -rwsr-xr-x. The file is owned by the root user. What is the primary security implication of this finding?

Accepted Answer

The binary executes with the privileges of the root user.. Understanding special permissions like SUID is critical for Linux security because they often lead to privilege escalation vulnerabilities. When the SUID bit is set on a file owned by root, any user who executes that file gains root-level privileges for the duration of the process. If the binary is poorly written, it can be exploited.

Answer

The file can be modified by any user in the group.

Answer

The file is encrypted and requires a password to run.

Answer

The binary is restricted to running only in runlevel 1.

Question 11

To ensure a Linux server is protected against unauthorized physical access or boot-level modifications, which THREE security controls should be implemented?

Accepted Answer

Setting a BIOS/UEFI password. Boot security is often overlooked but is a critical component of overall system hardening. If an attacker has physical access and the boot process is not secured, they can easily bypass operating system security controls by booting into single-user mode or using a live environment to mount and modify the local filesystem.

Answer

Enabling the sticky bit on /tmp

Answer

Disabling the IPv6 network stack

Question 12

A security administrator needs to block all incoming traffic to a server except for SSH (port 22) using the nftables framework. Which configuration approach best follows the principle of least privilege?

Accepted Answer

Set the default policy to DROP and add an allow rule for port 22.. Firewall management is a core skill for securing Linux systems. Moving from iptables to nftables offers more efficient rule processing and a cleaner syntax. Following the principle of least privilege in a firewall context means explicitly denying all traffic by default and only opening the specific ports necessary for business operations.

Answer

Create a rule to allow port 22 and log all other traffic.

Answer

Add a rule at the end of the chain that rejects all TCP traffic.

Answer

Set the default policy of the INPUT chain to ACCEPT.

Question 13

A security engineer is configuring a Linux server to enforce password quality for all local accounts. The requirement is that passwords must be at least 14 characters long, contain at least one uppercase letter, one lowercase letter, one digit, and one special character, and must not repeat any of the last 5 passwords. Which file should the engineer edit to enforce these settings?

Accepted Answer

/etc/security/pwquality.conf. Password complexity and history requirements on Linux are enforced by the pam_pwquality module, which reads its configuration from /etc/security/pwquality.conf. This file allows administrators to set minlen, character class requirements, and other constraints. While PAM configuration files like system-auth or common-password reference the module, the policy parameters themselves are defined in pwquality.conf. Therefore, editing /etc/security/pwquality.conf is the correct action to meet the stated password policy.

Answer

/etc/pam.d/login

Answer

/etc/login.defs

Answer

/etc/shadow

Question 14

A security administrator is hardening a Linux web server that hosts customer data. During a review of mount options, the administrator notes that the /tmp and /var/tmp directories are mounted with the 'noexec' and 'nosuid' options, but /home is not. A developer complains that scripts in /home are being executed by a scheduled process. Which action best maintains security while addressing the developer's need?

Accepted Answer

Leave /home mounted without 'noexec' and instead enforce execution control through SELinux booleans or AppArmor profiles that restrict which binaries the scheduled process may run.. The scenario requires balancing operational need with hardening. Mount options like noexec and nosuid are valuable for directories that should never host executables, but /home may legitimately need to run scripts. Applying mandatory access control lets specific processes execute approved files while blocking everything else, preserving security without breaking the developer's scheduled process. A blanket noexec on /home is too restrictive, and moving execution to world-writable temporary directories undermines the server's defenses.

Answer

Remove the 'noexec' option from /tmp and /var/tmp so the developer can move scripts there and execute them, keeping /home locked down.

Answer

Add the 'nosuid' option to /home only, because nosuid prevents all executable files from running and resolves the developer's concern.

Answer

Remount /home with the 'noexec' option and require the developer to store and execute scripts from /var/tmp instead.

Question 15

A junior administrator is preparing a new Ubuntu server for production. The security policy states that the root account must not be usable for direct interactive logon, and that administrative tasks must be performed through a named account with elevated privileges. Which configuration change best enforces this policy?

Accepted Answer

Lock the root account password with 'passwd -l root' and grant administrative rights to named accounts via sudo.. The policy demands that root cannot be used for interactive logon and that administrative work be done through named accounts with elevated privileges. Locking the root password prevents password-based interactive authentication while sudo allows auditable, per-user elevation. Disabling only SSH root logon leaves console access open, and deleting root from /etc/shadow risks breaking the system. A long password still permits direct root logon and is not a technical enforcement of the policy.

Answer

Change root's shell to /sbin/nologin in /etc/passwd and delete the root entry from /etc/shadow.

Answer

Set a very long, complex password for root and store it in a sealed envelope in a safe.

Answer

Add 'PermitRootLogin no' to /etc/ssh/sshd_config and restart the SSH service, leaving local console root logon enabled.

Question 16

A security engineer is reviewing a production RHEL 9 server and finds that several users have entries in /etc/sudoers granting them NOPASSWD for specific commands. The engineer wants to verify which users can run commands as root without a password and also check for any syntax errors in the sudoers configuration. Which approach provides the most reliable verification?

Accepted Answer

Use 'visudo -c' to check syntax and 'grep -r NOPASSWD /etc/sudoers /etc/sudoers.d/' to enumerate passwordless entries.. To reliably verify passwordless sudo grants, the engineer needs to enumerate all NOPASSWD entries across the main sudoers file and any drop-in files, and to validate syntax. visudo -c performs a syntax check on all included files, while a recursive grep captures every NOPASSWD occurrence. Approaches that rely on individual user sessions or logs are either incomplete or reactive, and checking group membership alone misses per-user and per-command grants.

Answer

Run 'sudo -v' to validate the sudoers file and then use 'getent group sudo' to list all privileged users.

Answer

Run 'sudo -l' as each user to list their allowed commands and visually inspect /etc/sudoers for NOPASSWD entries.

Answer

Check the file permissions on /etc/sudoers and /etc/sudoers.d, then review the sudo log in /var/log/secure for NOPASSWD usage.

Question 17

A security analyst is hardening a fleet of Linux servers and wants to reduce the risk of privilege escalation through file capabilities and setuid binaries. The analyst plans to audit and restrict these mechanisms. Which two actions best support this goal? (Choose two.)

Accepted Answer

Search for setuid binaries with 'find / -perm -4000 -type f' and remove the setuid bit from any binary not strictly required.. Reducing privilege escalation risk from setuid binaries and file capabilities requires discovering and minimizing them. Recursively enumerating capabilities with getcap and locating setuid files with find allows the analyst to identify unnecessary privilege grants and remove them. Blanket measures such as noexec mounts or immutable attributes are overly broad and break systems, while disabling sudo and using direct root logon weakens accountability instead of strengthening security.

Answer

Mount all filesystems with the 'noexec' option to prevent any binary from running.

Answer

Set the immutable attribute on all files owned by root using 'chattr +i' recursively.

Answer

Disable the sudo service and require all administrators to log in directly as root for administrative tasks.

Question 18

A security administrator is configuring auditd on a Linux server to meet a compliance requirement that all changes to user and group files be logged. The administrator adds a watch on /etc/passwd and /etc/group. After applying the rules, the administrator notices that modifications made using the 'vipw' and 'vigr' commands are not generating audit events, even though direct edits with a text editor are logged. Which explanation best describes why this occurs?

Accepted Answer

vipw and vigr use a temporary file and rename it over the original, so a file watch on /etc/passwd sees a different inode and misses the change.. Audit watches in auditd are bound to the inode of the target file. The vipw and vigr utilities create a temporary file and rename it over the original, so the original inode is replaced and the watch no longer covers the new file. Direct edits modify the existing inode and are logged. To reliably capture these changes, administrators should watch the containing directory or use audit rules that account for renames.

Answer

vipw and vigr run as setuid root and bypass the kernel audit subsystem entirely, so no audit rules can capture their activity.

Answer

The audit rules were not loaded because auditd requires a reboot after adding watches to /etc/passwd and /etc/group.

Answer

vipw and vigr write to /etc/shadow and /etc/gshadow instead of /etc/passwd and /etc/group, so the watches never trigger.

Question 19

A system administrator is hardening a Linux server and wants to ensure that users cannot log in with empty passwords. Which command should the administrator use to check for accounts with empty password fields in /etc/shadow?

Accepted Answer

awk -F: '($2 == "") {print $1}' /etc/shadow. To identify accounts with empty passwords, the most direct method is to parse /etc/shadow and check if the password hash field is empty. The awk command with field separator ':' and condition $2 == "" accomplishes this by printing the username for any line where the second field is empty. This is a common security audit technique. Other methods may work but are less precise or efficient. Ensuring no accounts have empty passwords is a fundamental Linux hardening step.

Answer

cut -d: -f1,2 /etc/shadow | grep ':$'

Answer

passwd -S $(cut -d: -f1 /etc/shadow) | grep 'NP'

Answer

grep -v '^[^:]*:[^:]*:' /etc/shadow

Question 20

A security engineer is implementing file integrity monitoring on a Linux server. The engineer wants to use AIDE to detect unauthorized changes to critical system files. After initializing the AIDE database, which command should be used to perform a manual check and compare the current file system state against the baseline?

Accepted Answer

aide --check. AIDE (Advanced Intrusion Detection Environment) is a file integrity checker. After initializing the baseline database with aide --init, the administrator uses aide --check to compare the current file system against that baseline. The check reports any discrepancies, which can indicate unauthorized changes. The --update option is used to accept changes and update the database, while --init creates a new baseline. There is no --compare option. Therefore, aide --check is the correct command for a manual integrity verification.

Answer

aide --update

Answer

aide --compare

Answer

aide --init

GSEC Linux Security and Hardening — All Questions With Answers

A security engineer needs to manage Mandatory Access Control (MAC) settings on a Red Hat Enterprise Linux (RHEL) system. Which TWO commands are most essential for viewing and modifying the state and file labeling of SELinux?

Refer to the exhibit. An analyst is reviewing the /etc/shadow file to verify account security policies. Based on the entry for the user 'jdoe', what is the current password expiration policy?

Exhibit

A system administrator wants to review recent authentication failures on a modern Linux distribution that uses systemd. Which command is the most efficient way to view these logs in real-time?

Refer to the exhibit. What is the effect of this entry in the /etc/sudoers file for a user who belongs to the 'webadmins' group?

Exhibit

A security analyst is reviewing a Linux server's auditd configuration. The goal is to monitor all attempts to modify the /etc/passwd file, including successful and failed write attempts. Which audit rule correctly achieves this?

A security administrator is hardening a Linux server that uses systemd. The administrator wants to restrict the ability of users to escalate privileges via the su command. Which TWO actions should the administrator take? (Choose two.)

A system administrator needs to harden a public-facing Linux server against automated brute-force attacks. Which configuration change in the /etc/ssh/sshd_config file provides the most significant reduction in the attack surface regarding credential stuffing?

An information security auditor discovers a custom compiled binary in a shared directory with the following permissions: -rwsr-xr-x. The file is owned by the root user. What is the primary security implication of this finding?

To ensure a Linux server is protected against unauthorized physical access or boot-level modifications, which THREE security controls should be implemented?

A security administrator needs to block all incoming traffic to a server except for SSH (port 22) using the nftables framework. Which configuration approach best follows the principle of least privilege?

A security analyst is hardening a fleet of Linux servers and wants to reduce the risk of privilege escalation through file capabilities and setuid binaries. The analyst plans to audit and restrict these mechanisms. Which two actions best support this goal? (Choose two.)

A system administrator is hardening a Linux server and wants to ensure that users cannot log in with empty passwords. Which command should the administrator use to check for accounts with empty password fields in /etc/shadow?

GSEC Linux Security and Hardening — All Questions With Answers

A security engineer needs to manage Mandatory Access Control (MAC) settings on a Red Hat Enterprise Linux (RHEL) system. Which TWO commands are most essential for viewing and modifying the state and file labeling of SELinux?

Refer to the exhibit. An analyst is reviewing the /etc/shadow file to verify account security policies. Based on the entry for the user 'jdoe', what is the current password expiration policy?

Exhibit

A system administrator wants to review recent authentication failures on a modern Linux distribution that uses systemd. Which command is the most efficient way to view these logs in real-time?

Refer to the exhibit. What is the effect of this entry in the /etc/sudoers file for a user who belongs to the 'webadmins' group?

Exhibit

A security analyst is reviewing a Linux server's auditd configuration. The goal is to monitor all attempts to modify the /etc/passwd file, including successful and failed write attempts. Which audit rule correctly achieves this?

A security administrator is hardening a Linux server that uses systemd. The administrator wants to restrict the ability of users to escalate privileges via the su command. Which TWO actions should the administrator take? (Choose two.)

A system administrator needs to harden a public-facing Linux server against automated brute-force attacks. Which configuration change in the /etc/ssh/sshd_config file provides the most significant reduction in the attack surface regarding credential stuffing?

An information security auditor discovers a custom compiled binary in a shared directory with the following permissions: -rwsr-xr-x. The file is owned by the root user. What is the primary security implication of this finding?

To ensure a Linux server is protected against unauthorized physical access or boot-level modifications, which THREE security controls should be implemented?

A security administrator needs to block all incoming traffic to a server except for SSH (port 22) using the nftables framework. Which configuration approach best follows the principle of least privilege?

A security analyst is hardening a fleet of Linux servers and wants to reduce the risk of privilege escalation through file capabilities and setuid binaries. The analyst plans to audit and restrict these mechanisms. Which two actions best support this goal? (Choose two.)

A system administrator is hardening a Linux server and wants to ensure that users cannot log in with empty passwords. Which command should the administrator use to check for accounts with empty password fields in /etc/shadow?