LPIC-2 System Security Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. An administrator has applied these iptables rules. Users can still SSH into the server from any IP address, which is unexpected because the administrator intended to restrict SSH to only a specific subnet. What is the most likely reason the restriction is not working?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SSH rule does not specify a source IP, so it accepts connections from any IP.. The SSH ACCEPT rule does not include a source IP specification, so by default iptables matches any source address. The administrator intended to restrict SSH to a specific subnet, but without a `-s` parameter, the rule accepts all incoming SSH connections regardless of origin. The DROP rule for other subnets is never reached because the ACCEPT rule matches first for all SSH traffic.

Answer

The default policy is ACCEPT, so the DROP rule is ignored.

Answer

The conntrack module is not loaded, so the state matching fails.

Answer

The rules are in the wrong order; the DROP rule should be before the SSH rule.

Question 2

Refer to the exhibit. What type of attack is indicated by the log entries?

Accepted Answer

Brute-force attack on SSH. The log entries show repeated SSH authentication failures from the same IP address with different usernames and passwords, which is characteristic of a brute-force attack. Attackers systematically try many credential combinations to gain unauthorized access to the SSH service, as indicated by the 'Failed password' messages.

Answer

Privilege escalation attempt

Answer

Man-in-the-middle attack

Answer

Distributed denial-of-service (DDoS) attack

Question 3

An administrator is configuring nftables to log and drop packets from a specific IP. The rule must be added to the input hook. Which command accomplishes this?

Accepted Answer

nft add rule inet filter input ip saddr 10.0.0.5 log drop. Both options B and C are syntactically valid nftables rules that log and drop packets from the specified IP. Option B uses 'log drop' which logs the packet with default settings and then drops it. Option C adds a custom prefix for more descriptive logging. The question does not require a prefix, so both B and C are correct. Option A logs with 'accept', which contradicts the drop requirement. Option D logs without a verdict, which is incomplete.

Answer

nft add rule inet filter input ip saddr 10.0.0.5 log accept

Answer

nft add rule ip filter input ip saddr 10.0.0.5 drop

Question 4

An administrator configures AIDE to monitor /etc. After initializing the database, what command updates the database with current file hashes without removing old entries?

Accepted Answer

aide --update. AIDE's --update option performs a check and then updates the database with any new or changed file hashes while preserving existing entries. This is the correct way to refresh the database after legitimate changes to monitored files, as it combines --check and --init in a single operation without losing the baseline.

Answer

aide --init

Answer

aide --compare

Answer

aide --check

Question 5

An administrator uses logwatch to send daily summaries to root. Which configuration file controls the default logwatch behavior?

Accepted Answer

/etc/logwatch/conf/logwatch.conf. Logwatch uses a modular configuration system where the main configuration file is located at /etc/logwatch/conf/logwatch.conf. This file overrides the default settings found in /usr/share/logwatch/default.conf/logwatch.conf, allowing administrators to customize logwatch behavior without modifying the distribution's default files.

Answer

/etc/logwatch.conf

Answer

/usr/share/logwatch/default.conf

Answer

/etc/logwatch/logwatch.conf

Question 6

Which two commands correctly configure SSH to disable root login? (Select two.)

Accepted Answer

echo "DenyUsers root" >> /etc/ssh/sshd_config. Option C is correct because DenyUsers root is a valid sshd_config directive that explicitly blocks the root account from authenticating over SSH, effectively disabling root login for the daemon. Option E is correct because PermitRootLogin no is the canonical sshd_config setting that disables all root logins via SSH, including password and key-based authentication. Both directives are placed in /etc/ssh/sshd_config, the server-side configuration file read by sshd, so they properly affect incoming SSH connections. Option A is wrong because usermod -L root only locks the root password locally and does not govern SSH key-based root access. Option B is wrong because PermitRootLogin without-password still permits root login via public key authentication. Option D is wrong because PermitRootLogin yes enables root login and is written to /etc/ssh/ssh_config, which is the client-side configuration file, not the server daemon's config.

Answer

usermod -L root

Answer

echo "PermitRootLogin without-password" >> /etc/ssh/sshd_config

Answer

echo "PermitRootLogin yes" >> /etc/ssh/ssh_config

Question 7

Which two of the following are valid methods to authenticate with OpenVPN? (Select two.)

Accepted Answer

Static key. Option D (Static key) is correct because OpenVPN supports a pre-shared static key mode where both peers use the same secret key file (--secret) to authenticate and encrypt the tunnel, typically used in point-to-point configurations. Option E (TLS/SSL certificates) is correct because OpenVPN's standard and most secure mode uses TLS with X.509 certificates (--tls-auth/--ca/--cert/--key) for mutual authentication between client and server. Options A (LDAP) and B (RADIUS) are not native OpenVPN authentication methods; they are external directory/AAA services that can only be plugged in via plugins or management interfaces, not as built-in authentication mechanisms. Option C (NIS) is a legacy Unix directory service and is likewise not a native OpenVPN authentication method.

Answer

LDAP

Answer

RADIUS

Answer

NIS

Question 8

Refer to the exhibit. A security audit reveals that the server is not blocking SSH connections from unauthorized networks. What is the most likely cause?

Accepted Answer

The SSH rule does not restrict source IP, so it allows all incoming SSH connections.. The SSH rule in the exhibit uses `--dport 22` without any `-s` or `--source` parameter to restrict the source IP address. This means the rule matches any incoming TCP packet destined for port 22, regardless of its origin network. Without a source IP restriction, the firewall allows SSH connections from all networks, including unauthorized ones, which is the security issue identified by the audit.

Answer

The FORWARD chain is DROP, blocking all forwarded traffic.

Answer

The SSH rule uses --dport 22 but missing source IP restriction, allowing all sources.

Answer

The default policy for INPUT is DROP, which should block all, but SSH works due to the ESTABLISHED,RELATED rule.

Question 9

Refer to the exhibit. An administrator runs aide --check and receives a warning that /var/log/syslog has changed. Why is this expected?

Accepted Answer

The /var/log entry monitors the directory itself, not its contents; changes inside the directory are not tracked.. The AIDE configuration for /var/log typically monitors the directory entry itself (its metadata like permissions and ownership) rather than recursively tracking changes to files within it. When /var/log/syslog changes, AIDE does not detect it because the directory's inode metadata remains unchanged; only the file's content and metadata are altered. This is a common default behavior unless the configuration explicitly uses the 'R' or 'p+sha512' flags to recurse into subdirectories and hash file contents.

Answer

The SHA512 hash for /var/log is incorrect.

Answer

The /var/log entry includes permissions but not content hashes, so changes in file content are not monitored.

Answer

The +c flag checks for changes in the file's ctime, so syslog changes are detected.

Question 10

A system administrator wants to allow the user 'jdoe' to run the '/usr/bin/systemctl restart httpd' command on a specific server without a password prompt. Which sudoers entry achieves this?

Accepted Answer

jdoe ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart httpd. The NOPASSWD tag in the sudoers entry explicitly allows user 'jdoe' to execute the specified command '/usr/bin/systemctl restart httpd' without being prompted for a password. The syntax 'jdoe ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart httpd' grants passwordless execution for that exact command on any host, which matches the requirement.

Answer

jdoe ALL=(ALL) /usr/bin/systemctl restart httpd

Answer

user ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart httpd

Answer

jdoe ALL=(ALL) ALL

Question 11

A security audit reveals that a server with PAM authentication allows users to log in even when the '/etc/nologin' file exists, contrary to policy. Which PAM module is most likely misconfigured or missing?

Accepted Answer

pam_nologin.so. The pam_nologin.so module is specifically designed to check for the existence of /etc/nologin and, if found, prevent non-root users from logging in. If users can still log in despite this file existing, the module is either missing from the PAM stack (e.g., not included in /etc/pam.d/login or /etc/pam.d/sshd) or misconfigured (e.g., placed after the authentication phase instead of the account phase).

Answer

pam_securetty.so

Answer

pam_access.so

Answer

pam_lastlog.so

Question 12

A user's SSH public key has been added to '~/.ssh/authorized_keys' on a remote server, but the user is still prompted for a password. Which file permission is most likely causing the issue?

Accepted Answer

0660. SSH's authorized_keys file must have strict permissions to prevent unauthorized modifications. The correct permission is 0600 (owner read/write only) or more restrictive. Permission 0660 (group read/write) is too permissive because it allows group members to modify the file, which SSH interprets as a security risk and falls back to password authentication.

Answer

0644

Answer

0444

Answer

0600

Question 13

A system with SELinux in enforcing mode is running a custom application that needs to write to a file in /data. The application's context type is 'myapp_t', and the target file context is 'default_t'. The file's current context is 'var_t'. Which command changes the file's context to allow access?

Accepted Answer

chcon -t default_t /data/file. `chcon -t default_t /data/file` directly changes the SELinux type of the file to `default_t`, which matches the type expected by the `myapp_t` domain's access rules. Since the application runs in enforcing mode and needs to write to a file with type `default_t`, this command immediately sets the correct context without modifying the policy or requiring a relabel.

Answer

fixfiles -F relabel /data

Answer

semanage fcontext -a -t default_t /data/file

Answer

restorecon /data/file

Question 14

An administrator wants to restrict SSH access to a server so that only users from the domain 'example.com' can connect. Which file and syntax should be used with TCP Wrappers?

Accepted Answer

Add to /etc/hosts.allow: sshd: .example.com. TCP Wrappers uses the /etc/hosts.allow file to grant access based on daemon: client patterns. The syntax 'sshd: .example.com' restricts SSH access to clients whose hostnames end with '.example.com', which matches all hosts in the 'example.com' domain. This is the standard way to allow only users from a specific domain to connect via SSH using TCP Wrappers.

Answer

Add to /etc/hosts.deny: sshd: ALL

Answer

Add to /etc/hosts.allow: ALL: .example.com

Answer

Add to /etc/hosts.allow: sshd: ALLOW .example.com

Question 15

Which THREE conditions must be met for an SSH key-based login to succeed using the default settings on a OpenSSH server? (Choose three.)

Accepted Answer

The ~/.ssh directory on the remote server has permissions 0700. Option A is correct because OpenSSH's default StrictModes setting requires the remote user's ~/.ssh directory to be inaccessible to group and others, i.e. mode 0700, otherwise sshd refuses to use the keys. Option B is correct because the client's public key must be present in the remote account's ~/.ssh/authorized_keys (default AuthorizedKeysFile) for sshd to match and accept the offered key. Option E is correct because the client must possess the matching private key, by default ~/.ssh/id_rsa, to complete the public-key authentication challenge. Option C is not required for key-based login: the host key is used for server authentication and is generated automatically, and its absence would not by itself block user key auth. Option D is not required either: known_hosts only provides host-key verification and, with StrictHostKeyChecking=ask, an unknown host can still be accepted, so it is not a mandatory condition for the login to succeed.

Answer

The remote server has the host key /etc/ssh/ssh_host_rsa_key

Answer

The client has the server's public host key stored in ~/.ssh/known_hosts