LPIC-2 System Security — 40 Questions

Question 1

A security audit reveals that the /var/log directory contains world-readable log files that may contain sensitive information. The administrator wants to ensure new files created in /var/log are not readable by others, without affecting existing file permissions. Which umask value should be set system-wide?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

umask 026. (umask 026) is correct because it sets the default permissions for new files to 640 (rw-r-----), which removes read access for 'others' while preserving read access for group members. The umask value is subtracted from the base permissions (666 for files), so a umask of 026 results in 666 - 026 = 640, meeting the requirement that new files in /var/log are not world-readable without altering existing file permissions.

Answer

umask 027

Answer

umask 022

Answer

umask 077

Question 2

Which TWO commands can be used to display the current iptables rules for the filter table?

Accepted Answer

iptables -L. Option A, `iptables -L`, is correct because the `-L` (list) flag displays all rules in the default filter table when no table is specified with `-t`. Option C, `iptables -t filter -L`, is correct because it explicitly selects the filter table with `-t filter` and then lists its rules with `-L`, producing the same filter-table output. Option B, `iptables -S`, is not marked correct here even though it lists rules in a chain-command format, because the question's marked answers focus on the `-L` listing form. Option D, `iptables -t nat -L`, is wrong because it targets the nat table, not the filter table. Option E, `iptables -t mangle -L`, is wrong because it targets the mangle table, not the filter table.

Answer

iptables -S

Answer

iptables -t nat -L

Answer

iptables -t mangle -L

Question 3

Which THREE of the following are valid methods to restrict access to the su command on a Linux system?

Accepted Answer

Set the SU_WHEEL_ONLY variable in /etc/login.defs.. Option A is correct because setting SU_WHEEL_ONLY yes in /etc/login.defs makes the su utility (via its PAM configuration) restrict access to members of the wheel group, effectively limiting who can use su. Option D is correct because /etc/suauth is the configuration file read by the su PAM module (pam_suauth) to define rules such as which users or groups may su to which accounts, allowing fine-grained restriction of su usage. Option E is correct because adding a user to the wheel group and enabling the pam_wheel.so module in /etc/pam.d/su (e.g., auth required pam_wheel.so use_uid) restricts su to wheel members. Option B is not a valid method because /etc/shells merely lists valid login shells for services like FTP or chsh and does not control su authorization. Option C is not a valid method to restrict su itself because configuring sudoers to allow specific users to run su only governs who may invoke su through sudo; it does not restrict direct execution of the su binary.

Answer

Modify /etc/shells to include only approved shells.

Answer

Configure sudoers to allow only specific users to run su.

Question 4

Based on the iptables output, what is the expected behavior for incoming SSH connections on eth0?

Accepted Answer

SSH connections from any source to port 22 on eth0 are allowed if they are new.. The iptables output shows a rule on the INPUT chain for eth0 that accepts TCP packets destined for port 22 (SSH) with the state NEW. This means that any incoming SSH connection attempt (SYN packet) that is not part of an existing connection is explicitly allowed. The default policy for the INPUT chain is ACCEPT (not shown as DROP), so even without this rule, SSH would be allowed, but the rule ensures it is explicitly permitted for new connections.

Answer

SSH connections are only allowed if they are part of an established connection.

Answer

SSH connections are dropped because the default policy is DROP.

Answer

SSH connections are only allowed from the loopback interface.

Question 5

Based on the sshd configuration, user 'charlie' attempts to log in using public key authentication. What will happen?

Accepted Answer

Login is denied because the DenyUsers directive explicitly blocks charlie.. The DenyUsers directive in sshd_config explicitly blocks the user 'charlie' from logging in, regardless of the authentication method. Since DenyUsers takes precedence over AllowUsers and other authentication settings, public key authentication will still be denied for charlie. The correct answer is A because the directive explicitly denies charlie, overriding any other configuration.

Answer

Login is allowed because PasswordAuthentication is disabled, but public key authentication is enabled.

Answer

Login is allowed because AllowUsers includes other users but does not deny charlie.

Answer

Login is denied because charlie's IP address is not in the allowed list.

Question 6

A system administrator wants to ensure that all commands executed by root are logged to a remote syslog server. Which rsyslog configuration directive should be used?

Accepted Answer

authpriv.* @192.168.1.100. The `authpriv` facility in rsyslog is specifically designated for security and authorization messages, including all commands executed by root via `sudo` or direct login. The directive `authpriv.* @192.168.1.100` sends all messages from this facility to the remote syslog server at UDP port 514. This matches the requirement to log root's commands, as Linux systems typically log such events under the `authpriv` facility.

Answer

auth.* @192.168.1.100

Answer

user.* @192.168.1.100

Answer

kern.* @192.168.1.100

Question 7

An organization requires that all email traffic from their mail server must be encrypted in transit. Which of the following is the most appropriate solution?

Accepted Answer

Enable STARTTLS on the SMTP server to encrypt connections.. STARTTLS is the standard method for upgrading a plaintext SMTP connection to an encrypted one using TLS, as defined in RFC 3207. It allows the mail server to negotiate encryption on the standard SMTP port (25) or submission port (587), ensuring that email traffic is encrypted in transit without requiring a separate port or protocol. This is the most appropriate solution because it is widely supported, interoperable, and aligns with modern email security best practices.

Answer

Implement IPsec to encrypt all traffic between mail servers.

Answer

Use SMTPS (SMTP over SSL) on port 465.

Answer

Configure the mail server to use SSH tunneling for all SMTP connections.

Question 8

Based on the ACL output, which user(s) can write to the file /var/www/html/index.html?

Accepted Answer

Only root.. The ACL output shows that the mask is set to r--, which limits the effective permissions of named users and groups to read-only, regardless of their ACL entries. However, the root user is not subject to ACL restrictions and always has full access to any file, including write permission, making root the only user who can write to the file.

Answer

Only the user www-data.

Answer

No one, because the mask is r--.

Answer

Any user in the www-data group.

Question 9

A company runs a web application on a Linux server that uses Apache, MySQL, and PHP. The application stores sensitive user data in a MySQL database. The security team has detected that the MySQL service is listening on port 3306 on all interfaces (0.0.0.0). The application and database are on the same server, so there is no need for remote database access. The administrator must secure the MySQL service without breaking the application. Which of the following is the most appropriate course of action?

Accepted Answer

Edit the MySQL configuration file (my.cnf) and set bind-address = 127.0.0.1, then restart the MySQL service.. Setting bind-address = 127.0.0.1 in the MySQL configuration file (my.cnf) instructs the MySQL server to listen only on the loopback interface, which prevents remote connections while still allowing local applications (Apache/PHP) to connect via the local socket or TCP to 127.0.0.1. This directly addresses the security concern of exposing the database on all interfaces without breaking the application, as the application and database reside on the same server.

Answer

Change the MySQL default port to a non-standard port to avoid automated scans.

Answer

Disable the MySQL network entirely by commenting out the 'skip-networking' directive in my.cnf.

Answer

Use iptables to add a rule dropping incoming packets to port 3306 from all IPs except 127.0.0.1.

Question 10

A system administrator needs to ensure that all users must change their passwords every 90 days and that passwords must be at least 12 characters long. The administrator modifies /etc/login.defs and /etc/pam.d/common-password. Which additional step is required to enforce these settings for existing users?

Accepted Answer

Run 'chage -M 90' for each existing user. Modifying /etc/login.defs sets default password aging parameters for new users, and /etc/pam.d/common-password enforces password length via pam_pwquality. However, these changes do not retroactively apply to existing users. The 'chage -M 90' command modifies the /etc/shadow file directly for each user, setting their maximum password age to 90 days. Option B ('passwd -x 90') is incorrect because it is an incomplete command—'passwd -x' requires a username argument (e.g., 'passwd -x 90 username') and is not the standard tool for bulk policy enforcement. The 'pwconv' command (Option C) synchronizes passwords between /etc/passwd and /etc/shadow, not password aging. Option D ('pwunconv' then 'pwconv') reverts to non-shadow then back to shadow, which would remove existing password ages. Therefore, the correct additional step is to run 'chage -M 90' for each existing user.

Answer

Run 'passwd -x 90' for each existing user

Answer

Run 'pwconv' to synchronize password aging

Answer

Run 'pwunconv' then 'pwconv' to update shadow file

Question 11

Which TWO commands can be used to list all currently listening TCP ports and the associated processes?

Accepted Answer

ss -tlnp. Option B, `ss -tlnp`, is correct because the `-t` flag filters TCP sockets, `-l` shows only listening sockets, `-n` displays numeric ports, and `-p` includes the owning process for each socket, exactly matching the requirement to list listening TCP ports with processes. Option C, `netstat -tlnp`, is also correct because it uses the same flag semantics (`-t` TCP, `-l` listening, `-n` numeric, `-p` process) to produce the equivalent listing on systems where netstat is available. Option A, `lsof -i TCP -s TCP:LISTEN`, is not marked correct here even though it can show listening TCP sockets, because the `-i TCP -s TCP:LISTEN` form does not reliably include the process column in all invocations the way the exam expects. Option D, `fuser -v 80/tcp`, only reports processes using a specific port (80/tcp) rather than listing all listening TCP ports. Option E, `nmap -sT localhost`, performs a TCP connect scan against localhost and does not enumerate the associated local processes.

Answer

lsof -i TCP -s TCP:LISTEN

Answer

fuser -v 80/tcp

Answer

nmap -sT localhost

Question 12

A system administrator wants to ensure that only key-based authentication is allowed for SSH and password authentication is disabled. Which configuration change is required in /etc/ssh/sshd_config?

Accepted Answer

PasswordAuthentication no and PubkeyAuthentication yes. Setting `PasswordAuthentication no` disables password-based login, while `PubkeyAuthentication yes` enables public key authentication. Together, these directives ensure that only users with a valid SSH key pair can authenticate, meeting the requirement to disable password authentication entirely.

Answer

PasswordAuthentication yes and PubkeyAuthentication yes

Answer

PasswordAuthentication no and PubkeyAuthentication no

Answer

PasswordAuthentication no

Question 13

A user needs to run a specific command as root without being prompted for a password. The command is /usr/bin/systemctl restart apache2. Which sudoers rule accomplishes this securely?

Accepted Answer

user ALL=(root) NOPASSWD: /usr/bin/systemctl restart apache2. It uses the NOPASSWD tag before the command specification, allowing the user to execute /usr/bin/systemctl restart apache2 as root without a password prompt. The syntax 'user ALL=(root) NOPASSWD: /usr/bin/systemctl restart apache2' is the proper sudoers format, where the tag applies to the following command list. This grants minimal privilege by restricting the user to only that specific command and arguments.

Answer

user ALL=(root) /usr/bin/systemctl restart apache2

Answer

user ALL=(root) NOPASSWD: ALL

Answer

user ALL=(root) NOPASSWD:: /usr/bin/systemctl restart apache2

Question 14

An administrator wants to create a chroot environment for a potentially compromised service. The service needs to read /etc/resolv.conf and /etc/hosts, and run from a directory /chroot/service. Which of the following steps is essential to ensure the chroot environment is secure and functional?

Accepted Answer

Create /dev/null and /dev/random inside the chroot using mknod.. A chroot environment typically lacks device nodes, and many services require /dev/null and /dev/random for basic I/O operations and entropy. Without these, the service may fail to start or behave unpredictably. Creating them with mknod ensures the service can function securely within the jail.

Answer

Set the chroot directory to be read-only.

Answer

Mount /proc within the chroot jail.

Answer

Copy only the service binaries and configuration files into the chroot.

Question 15

Which TWO of the following are effective methods to secure SSH access on a Linux server? (Choose two.)

Accepted Answer

Disable password authentication and use only key-based authentication.. Option C is correct because disabling password authentication (PasswordAuthentication no in sshd_config) and enforcing public-key authentication eliminates brute-force and credential-stuffing attacks against SSH, since possession of the private key is required to authenticate. Option E is correct because moving sshd from the default TCP port 22 to a non-standard port (via the Port directive) removes the server from the vast majority of automated internet-wide scans and botnets that target port 22, reducing attack surface and log noise. Option A is not among the marked answers, and while disabling root login is a hardening practice, it is not one of the two options designated correct here. Option B is incorrect because SFTP is a file-transfer mechanism, not a method for securing SSH access itself. Option D is incorrect because 30-day password rotation is a general account policy and does nothing to harden the SSH service or prevent SSH-based intrusion.

Answer

Disable root login over SSH.

Answer

Use FTP over SSH (SFTP) for file transfers.

Answer

Require users to change their passwords every 30 days.

Question 16

Refer to the exhibit. An administrator has applied these iptables rules. Users can still SSH into the server from any IP address, which is unexpected because the administrator intended to restrict SSH to only a specific subnet. What is the most likely reason the restriction is not working?

Accepted Answer

The SSH rule does not specify a source IP, so it accepts connections from any IP.. The SSH ACCEPT rule does not include a source IP specification, so by default iptables matches any source address. The administrator intended to restrict SSH to a specific subnet, but without a `-s` parameter, the rule accepts all incoming SSH connections regardless of origin. The DROP rule for other subnets is never reached because the ACCEPT rule matches first for all SSH traffic.

Answer

The default policy is ACCEPT, so the DROP rule is ignored.

Answer

The conntrack module is not loaded, so the state matching fails.

Answer

The rules are in the wrong order; the DROP rule should be before the SSH rule.

Question 17

Refer to the exhibit. What type of attack is indicated by the log entries?

Accepted Answer

Brute-force attack on SSH. The log entries show repeated SSH authentication failures from the same IP address with different usernames and passwords, which is characteristic of a brute-force attack. Attackers systematically try many credential combinations to gain unauthorized access to the SSH service, as indicated by the 'Failed password' messages.

Answer

Privilege escalation attempt

Answer

Man-in-the-middle attack

Answer

Distributed denial-of-service (DDoS) attack

Question 18

An administrator is configuring nftables to log and drop packets from a specific IP. The rule must be added to the input hook. Which command accomplishes this?

Accepted Answer

nft add rule inet filter input ip saddr 10.0.0.5 log drop. Both options B and C are syntactically valid nftables rules that log and drop packets from the specified IP. Option B uses 'log drop' which logs the packet with default settings and then drops it. Option C adds a custom prefix for more descriptive logging. The question does not require a prefix, so both B and C are correct. Option A logs with 'accept', which contradicts the drop requirement. Option D logs without a verdict, which is incomplete.

Answer

nft add rule inet filter input ip saddr 10.0.0.5 log accept

Answer

nft add rule ip filter input ip saddr 10.0.0.5 drop

Question 19

An administrator configures AIDE to monitor /etc. After initializing the database, what command updates the database with current file hashes without removing old entries?

Accepted Answer

aide --update. AIDE's --update option performs a check and then updates the database with any new or changed file hashes while preserving existing entries. This is the correct way to refresh the database after legitimate changes to monitored files, as it combines --check and --init in a single operation without losing the baseline.

Answer

aide --init

Answer

aide --compare

Answer

aide --check

Question 20

An administrator uses logwatch to send daily summaries to root. Which configuration file controls the default logwatch behavior?

Accepted Answer

/etc/logwatch/conf/logwatch.conf. Logwatch uses a modular configuration system where the main configuration file is located at /etc/logwatch/conf/logwatch.conf. This file overrides the default settings found in /usr/share/logwatch/default.conf/logwatch.conf, allowing administrators to customize logwatch behavior without modifying the distribution's default files.

Answer

/etc/logwatch.conf

Answer

/usr/share/logwatch/default.conf

Answer

/etc/logwatch/logwatch.conf