LPIC-2 System Security — 40 Questions

Question 1

A system administrator notices that the SSH service on a Linux server is failing to start. The log shows: 'sshd: error: Could not load host key: /etc/ssh/ssh_host_rsa_key'. What is the most likely cause and solution?

Accepted Answer

The host key file is missing or corrupt. Run 'ssh-keygen -A' to regenerate all missing host keys.. The error message indicates that the SSH daemon cannot load the RSA host key file. Host keys are generated during package installation or manually via ssh-keygen. Option D is correct because running 'ssh-keygen -A' automatically generates all missing host key types (RSA, ECDSA, Ed25519) that are configured for use, resolving the missing or corrupt key issue without manual intervention.

Answer

The sshd_config file has a syntax error. Run 'sshd -t' to check it.

Answer

The SSH service is managed by xinetd and the configuration is missing. Edit /etc/xinetd.d/ssh.

Answer

The /etc/ssh/sshd_config file has incorrect permissions. Change them to 600.

Question 2

A security policy requires that all users must change their passwords every 90 days. Which command enforces maximum password age for an existing user 'jdoe'?

Accepted Answer

chage -M 90 jdoe. The `chage -M 90 jdoe` command sets the maximum number of days a password is valid for user 'jdoe' to 90 days, enforcing the security policy. The `-M` option directly controls the password aging parameter that defines when the password must be changed, as stored in `/etc/shadow`.

Answer

passwd -f jdoe

Answer

usermod -e 90 jdoe

Answer

chage -E 90 jdoe

Question 3

A security audit reveals that the /var/log directory contains world-readable log files that may contain sensitive information. The administrator wants to ensure new files created in /var/log are not readable by others, without affecting existing file permissions. Which umask value should be set system-wide?

Accepted Answer

umask 026. Option D (umask 026) is correct because it sets the default permissions for new files to 640 (rw-r-----), which removes read access for 'others' while preserving read access for group members. The umask value is subtracted from the base permissions (666 for files), so a umask of 026 results in 666 - 026 = 640, meeting the requirement that new files in /var/log are not world-readable without altering existing file permissions.

Answer

umask 027

Answer

umask 022

Answer

umask 077

Question 4

Which TWO commands can be used to display the current iptables rules for the filter table?

Accepted Answer

iptables -L. Option A is correct because `iptables -L` lists the current rules in the default filter table without needing to specify the table explicitly. Option C is correct because `iptables -t filter -L` explicitly selects the filter table and lists its rules, which is functionally equivalent to the default behavior of `iptables -L`.

Answer

iptables -S

Answer

iptables -t nat -L

Answer

iptables -t mangle -L

Question 5

Which THREE of the following are valid methods to restrict access to the su command on a Linux system?

Accepted Answer

Edit the /etc/suauth file to specify allowed users.. Option D is correct because the /etc/suauth file (used by some Linux distributions with the 'su' command from the 'shadow' suite) allows you to specify which users or groups are permitted to use su, providing a direct access control mechanism. Option E is correct because configuring pam_wheel.so in /etc/pam.d/su with the 'wheel' group restricts su access to only members of that group, a standard PAM-based method.

Answer

Set the SU_WHEEL_ONLY variable in /etc/login.defs.

Answer

Modify /etc/shells to include only approved shells.

Answer

Configure sudoers to allow only specific users to run su.

Question 6

Based on the iptables output, what is the expected behavior for incoming SSH connections on eth0?

Accepted Answer

SSH connections from any source to port 22 on eth0 are allowed if they are new.. The iptables output shows a rule on the INPUT chain for eth0 that accepts TCP packets destined for port 22 (SSH) with the state NEW. This means that any incoming SSH connection attempt (SYN packet) that is not part of an existing connection is explicitly allowed. The default policy for the INPUT chain is ACCEPT (not shown as DROP), so even without this rule, SSH would be allowed, but the rule ensures it is explicitly permitted for new connections.

Answer

SSH connections are only allowed if they are part of an established connection.

Answer

SSH connections are dropped because the default policy is DROP.

Answer

SSH connections are only allowed from the loopback interface.

Question 7

Based on the sshd configuration, user 'charlie' attempts to log in using public key authentication. What will happen?

Accepted Answer

Login is denied because the DenyUsers directive explicitly blocks charlie.. The DenyUsers directive in sshd_config explicitly blocks the user 'charlie' from logging in, regardless of the authentication method. Since DenyUsers takes precedence over AllowUsers and other authentication settings, public key authentication will still be denied for charlie. The correct answer is A because the directive explicitly denies charlie, overriding any other configuration.

Answer

Login is allowed because PasswordAuthentication is disabled, but public key authentication is enabled.

Answer

Login is allowed because AllowUsers includes other users but does not deny charlie.

Answer

Login is denied because charlie's IP address is not in the allowed list.

Question 8

A system administrator wants to ensure that all commands executed by root are logged to a remote syslog server. Which rsyslog configuration directive should be used?

Accepted Answer

authpriv.* @192.168.1.100. Option B is correct because the `authpriv` facility in rsyslog is specifically designated for security and authorization messages, including all commands executed by root via `sudo` or direct login. The directive `authpriv.* @192.168.1.100` sends all messages from this facility to the remote syslog server at UDP port 514. This matches the requirement to log root's commands, as Linux systems typically log such events under the `authpriv` facility.

Answer

auth.* @192.168.1.100

Answer

user.* @192.168.1.100

Answer

kern.* @192.168.1.100

Question 9

An organization requires that all email traffic from their mail server must be encrypted in transit. Which of the following is the most appropriate solution?

Accepted Answer

Enable STARTTLS on the SMTP server to encrypt connections.. STARTTLS is the standard method for upgrading a plaintext SMTP connection to an encrypted one using TLS, as defined in RFC 3207. It allows the mail server to negotiate encryption on the standard SMTP port (25) or submission port (587), ensuring that email traffic is encrypted in transit without requiring a separate port or protocol. This is the most appropriate solution because it is widely supported, interoperable, and aligns with modern email security best practices.

Answer

Implement IPsec to encrypt all traffic between mail servers.

Answer

Use SMTPS (SMTP over SSL) on port 465.

Answer

Configure the mail server to use SSH tunneling for all SMTP connections.

Question 10

Which file is used to configure which users and groups are allowed to use the 'cron' daemon?

Accepted Answer

/etc/cron.allow. The /etc/cron.allow file explicitly lists users and groups permitted to schedule cron jobs. If this file exists, only those entries can use crontab; all others are denied, regardless of /etc/cron.deny. This provides a whitelist-based access control mechanism for the cron daemon.

Answer

/var/spool/cron/

Answer

/etc/cron.d/

Answer

/etc/crontab

Question 11

Based on the ACL output, which user(s) can write to the file /var/www/html/index.html?

Accepted Answer

Only root.. The correct answer is C because the ACL output shows that the mask is set to r--, which limits the effective permissions of named users and groups to read-only, regardless of their ACL entries. However, the root user is not subject to ACL restrictions and always has full access to any file, including write permission, making root the only user who can write to the file.

Answer

Only the user www-data.

Answer

No one, because the mask is r--.

Answer

Any user in the www-data group.

Question 12

A company runs a web application on a Linux server that uses Apache, MySQL, and PHP. The application stores sensitive user data in a MySQL database. The security team has detected that the MySQL service is listening on port 3306 on all interfaces (0.0.0.0). The application and database are on the same server, so there is no need for remote database access. The administrator must secure the MySQL service without breaking the application. Which of the following is the most appropriate course of action?

Accepted Answer

Edit the MySQL configuration file (my.cnf) and set bind-address = 127.0.0.1, then restart the MySQL service.. Setting bind-address = 127.0.0.1 in the MySQL configuration file (my.cnf) instructs the MySQL server to listen only on the loopback interface, which prevents remote connections while still allowing local applications (Apache/PHP) to connect via the local socket or TCP to 127.0.0.1. This directly addresses the security concern of exposing the database on all interfaces without breaking the application, as the application and database reside on the same server.

Answer

Change the MySQL default port to a non-standard port to avoid automated scans.

Answer

Disable the MySQL network entirely by commenting out the 'skip-networking' directive in my.cnf.

Answer

Use iptables to add a rule dropping incoming packets to port 3306 from all IPs except 127.0.0.1.

Question 13

A system administrator needs to ensure that all users must change their passwords every 90 days and that passwords must be at least 12 characters long. The administrator modifies /etc/login.defs and /etc/pam.d/common-password. Which additional step is required to enforce these settings for existing users?

Accepted Answer

Run 'chage -M 90' for each existing user. Modifying /etc/login.defs sets default password aging parameters for new users, and /etc/pam.d/common-password enforces password length via pam_pwquality. However, these changes do not retroactively apply to existing users. The chage command modifies the /etc/shadow file directly, and running 'chage -M 90' for each existing user sets their maximum password age to 90 days, enforcing the policy.

Answer

Run 'passwd -x 90' for each existing user

Answer

Run 'pwconv' to synchronize password aging

Answer

Run 'pwunconv' then 'pwconv' to update shadow file

Question 14

Which TWO commands can be used to list all currently listening TCP ports and the associated processes?

Accepted Answer

ss -tlnp. Option B (ss -tlnp) is correct because the ss command with -t (TCP), -l (listening), -n (numeric), and -p (process) shows all listening TCP ports and their associated processes. Option C (netstat -tlnp) is correct because netstat with the same flags provides equivalent output, though ss is the modern replacement on many distributions.

Answer

lsof -i TCP -s TCP:LISTEN

Answer

fuser -v 80/tcp

Answer

nmap -sT localhost

Question 15

Given the exhibit, what is the most likely reason for the GPG error, and what is the correct way to fix it permanently?

Accepted Answer

The public key is missing; obtain and add it with 'apt-key add' or 'wget -O- | apt-key add -'. The GPG error indicates that the repository's Release file is signed but the system lacks the corresponding public key to verify the signature. This is a common issue when adding third-party repositories. The correct permanent fix is to obtain the missing public key and add it to the APT keyring using 'apt-key add' or by piping the key with 'wget -O- | apt-key add -', which allows APT to authenticate the repository's metadata.

Answer

The repository is not signed; use '--allow-unauthenticated' permanently in /etc/apt/apt.conf.d/

Answer

The repository URL is incorrect; change 'http://deb.example.com' to 'https://deb.example.com'

Answer

The InRelease file is corrupted; remove it and run 'apt-get update' again

Question 16

You are the security administrator for a company that runs a web application on a Linux server. The application runs under the user 'www-data' and listens on TCP port 8080. The server also runs an SSH service on port 22. Recently, an external penetration test revealed that an attacker could exploit a vulnerability in the web application to execute commands as the 'www-data' user, and from there, the attacker could escalate privileges to root due to a misconfigured sudo rule. You need to implement a defense-in-depth approach to limit the impact of such an attack. Which single action would be the most effective in preventing privilege escalation from the 'www-data' user to root, while still allowing the application to function normally?

Accepted Answer

Review and remove any sudo privileges granted to the 'www-data' user in /etc/sudoers, and ensure the application does not require sudo.. Option A is correct because the core issue is a misconfigured sudo rule that allows the 'www-data' user to execute commands as root. By reviewing and removing any sudo privileges for 'www-data' in /etc/sudoers, you directly eliminate the privilege escalation path without affecting the web application's normal operation, as the application itself does not require sudo to function on its designated port 8080.

Answer

Change the SSH port to a non-standard port to reduce the attack surface.

Answer

Run the web application in a chroot jail to isolate it from the rest of the filesystem.

Answer

Implement mandatory access control with AppArmor profiles for the web application.

Question 17

An administrator is reviewing the audit rules on a Linux server. The current rules are shown in the exhibit. The administrator needs to ensure that any failed attempts to open files are logged, while also monitoring for successful outbound connections. Which of the following describes the effect of the current rules?

Accepted Answer

The first rule logs only failed openat calls, and the second rule logs all connect calls.. The first rule uses the `-F exit=-EACCES` filter, which matches only failed `openat` calls (those returning the EACCES error). The second rule uses `-S connect` without an exit filter, so it logs all `connect` syscalls regardless of success or failure. Therefore, option A correctly describes the effect: failed openat calls and all connect calls are logged.

Answer

The first rule logs only successful openat calls, and the second rule logs only failed connect calls.

Answer

The first rule logs all openat calls, and the second rule logs all connect calls.

Answer

The first rule logs only failed openat calls, and the second rule logs only failed connect calls.

Question 18

An administrator wants to enhance the security of a web server running Apache. Which TWO of the following actions are recommended best practices?

Accepted Answer

Disable directory listing in the Apache configuration using Options -Indexes.. Option B is correct because disabling directory listing with `Options -Indexes` prevents Apache from generating a list of files in directories that lack an index file (e.g., index.html). This is a fundamental security hardening step that reduces information disclosure about the web server's file structure, which could be leveraged by an attacker to find sensitive files or configuration details.

Answer

Enable the mod_info module to monitor server configuration.

Answer

Enable .htaccess files to allow per-directory configuration changes.

Answer

Enable the HTTP TRACE method for debugging purposes.

Question 19

A company runs a critical database server on a Linux system. The server is subject to a strict compliance policy that requires all commands executed by the database administrator (user 'dbadmin') to be logged. Additionally, any attempt to change the system time must be logged regardless of the user. The administrator has configured auditd and added the following rules: -w /usr/bin -p x -k binary_exec, -a always,exit -F arch=b64 -S adjtimex -F key=time_change. However, during a compliance audit, it is discovered that not all commands executed by dbadmin are being logged. Which of the following is the most likely cause?

Accepted Answer

The rule -w /usr/bin -p x only monitors executables in /usr/bin, not commands in other directories or built-in shell commands.. Option D is correct because the rule `-w /usr/bin -p x` only monitors execution of binaries located in `/usr/bin`. Commands executed from other directories (e.g., `/usr/local/bin`, `/opt`, or built-in shell commands like `cd` or `alias`) are not captured. Additionally, the rule does not log commands run via absolute paths outside `/usr/bin` or scripts executed by interpreters, leaving gaps in the audit trail for dbadmin's activities.

Answer

The auditd logs are being overwritten because the audit log file size is too small.

Answer

The auditd service is not running because the kernel was not compiled with audit support.

Answer

The adjtimex syscall rule is incorrect and prevents other rules from being processed.

Question 20

Order the steps to configure a Linux system as a router using iptables.