LPIC-2 System Security Practice Test 3 — 15 Questions

Question 1

Which TWO of the following are effective methods to secure SSH access on a Linux server? (Choose two.)

Accepted Answer

Disable password authentication and use only key-based authentication.. Disabling password authentication and enforcing key-based authentication eliminates the risk of brute-force password guessing attacks. SSH keys use asymmetric cryptography (RSA, ECDSA, or Ed25519) and are resistant to credential stuffing and dictionary attacks, provided private keys are kept secure. This is a foundational security hardening step recommended by the CIS Benchmarks for Linux.

Answer

Disable root login over SSH.

Answer

Use FTP over SSH (SFTP) for file transfers.

Answer

Require users to change their passwords every 30 days.

Question 2

Which iptables command is necessary to allow incoming SSH connections (port 22) from the subnet 192.168.1.0/24 while dropping all other incoming traffic? Assume the INPUT chain has a default policy of DROP.

Accepted Answer

iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT. It explicitly allows SSH traffic from the specified subnet before the default DROP policy drops everything else. Option B is not necessary because the INPUT chain already has a default policy of DROP, which drops all unmatched packets. Adding an explicit DROP rule at the end is redundant and not required by the question, which asks for the 'necessary' command.

Answer

iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j DROP

Answer

iptables -A INPUT -j DROP

Answer

iptables -A INPUT -j ACCEPT

Answer

iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

Question 3

Which THREE of the following actions are recommended as initial security hardening steps after installing a new Linux server? (Choose three.)

Accepted Answer

Update all packages using the package manager.. Immediately updating all packages via the package manager (e.g., `apt upgrade` or `yum update`) applies the latest security patches to the kernel, libraries, and services, closing known vulnerabilities that could be exploited by attackers. This is a foundational step in the initial hardening process, as a newly installed system often ships with outdated packages that have published CVEs.

Answer

Install a graphical desktop environment for easier administration.

Answer

Set up a web server to monitor system status.

Question 4

Refer to the exhibit. The user 'user' reports that they are able to run 'sudo apt-get update' without a password, but 'sudo apt-get upgrade' prompts for a password. What is the most likely cause?

Accepted Answer

The second rule does not include the NOPASSWD tag, so password is required.. The sudoers rule for 'apt-get upgrade' lacks the NOPASSWD tag, so sudo defaults to requiring a password. The first rule for 'apt-get update' includes NOPASSWD, which allows passwordless execution, but each command specification in sudoers is independent unless explicitly grouped. The absence of NOPASSWD on the second rule means sudo will prompt for the user's password as per its default behavior.

Answer

The 'Defaults:user !requiretty' setting affects password prompting.

Answer

The command 'apt-get upgrade' is being run as the user, not as root.

Answer

The rules are in the wrong order, causing the second to be overridden.

Question 5

Refer to the exhibit. An administrator has applied these iptables rules. Users can still SSH into the server from any IP address, which is unexpected because the administrator intended to restrict SSH to only a specific subnet. What is the most likely reason the restriction is not working?

Accepted Answer

The SSH rule does not specify a source IP, so it accepts connections from any IP.. The SSH ACCEPT rule does not include a source IP specification, so by default iptables matches any source address. The administrator intended to restrict SSH to a specific subnet, but without a `-s` parameter, the rule accepts all incoming SSH connections regardless of origin. The DROP rule for other subnets is never reached because the ACCEPT rule matches first for all SSH traffic.

Answer

The default policy is ACCEPT, so the DROP rule is ignored.

Answer

The conntrack module is not loaded, so the state matching fails.

Answer

The rules are in the wrong order; the DROP rule should be before the SSH rule.

Question 6

Refer to the exhibit. What type of attack is indicated by the log entries?

Accepted Answer

Brute-force attack on SSH. The log entries show repeated SSH authentication failures from the same IP address with different usernames and passwords, which is characteristic of a brute-force attack. Attackers systematically try many credential combinations to gain unauthorized access to the SSH service, as indicated by the 'Failed password' messages.

Answer

Privilege escalation attempt

Answer

Man-in-the-middle attack

Answer

Distributed denial-of-service (DDoS) attack

Question 7

An administrator wants to allow user 'john' to execute any command as root without a password. Which sudoers entry is correct?

Accepted Answer

john ALL=(ALL) NOPASSWD:ALL. The sudoers entry 'john ALL=(ALL) NOPASSWD:ALL' grants user 'john' permission to run any command as any user (including root) on any host, and the 'NOPASSWD' tag overrides the default password requirement, allowing execution without a password. The syntax follows the sudoers format: 'user host=(runas) TAG:command', where 'ALL' in each field matches any value.

Answer

john ALL=(ALL) NOPASSWD:/bin/ls

Answer

john ALL=(ALL) ALL

Answer

john ALL=(ALL) PASSWD:ALL

Question 8

An administrator wants to drop incoming TCP packets on port 22 from IP 10.0.0.5 using iptables. Which command is correct?

Accepted Answer

iptables -A INPUT -s 10.0.0.5 -p tcp --dport 22 -j DROP. It adds a rule to the INPUT chain, which processes packets destined for the local system. The `-s 10.0.0.5` flag specifies the source IP address, `-p tcp --dport 22` matches TCP packets destined for port 22 (SSH), and `-j DROP` silently discards matching packets. This configuration drops incoming SSH traffic from the specified host before it reaches any local service.

Answer

iptables -A INPUT -d 10.0.0.5 -p tcp --dport 22 -j DROP

Answer

iptables -A FORWARD -s 10.0.0.5 -p tcp --dport 22 -j DROP

Answer

iptables -A OUTPUT -s 10.0.0.5 -p tcp --dport 22 -j DROP

Question 9

An administrator is configuring nftables to log and drop packets from a specific IP. The rule must be added to the input hook. Which command accomplishes this?

Accepted Answer

nft add rule inet filter input ip saddr 10.0.0.5 log drop. Both options B and C are syntactically valid nftables rules that log and drop packets from the specified IP. Option B uses 'log drop' which logs the packet with default settings and then drops it. Option C adds a custom prefix for more descriptive logging. The question does not require a prefix, so both B and C are correct. Option A logs with 'accept', which contradicts the drop requirement. Option D logs without a verdict, which is incomplete.

Answer

nft add rule inet filter input ip saddr 10.0.0.5 log accept

Answer

nft add rule ip filter input ip saddr 10.0.0.5 drop

Question 10

A company requires two-factor authentication for SSH logins. Which PAM module can be used to implement this if the system uses a time-based one-time password (TOTP)?

Accepted Answer

pam_google_authenticator.so. `pam_google_authenticator.so` is a PAM module specifically designed to implement time-based one-time password (TOTP) authentication as defined in RFC 6238. It integrates with SSH by requiring users to provide a six-digit code generated by the Google Authenticator app (or compatible TOTP client) in addition to their regular password, enabling two-factor authentication.

Answer

pam_radius.so

Answer

pam_ldap.so

Answer

pam_krb5.so

Question 11

An administrator wants to encrypt a file so that only a specific recipient can decrypt it. Which GPG command should be used?

Accepted Answer

gpg --encrypt --recipient key-id file. The `--encrypt` flag with `--recipient key-id` uses the recipient's public key to encrypt the file, ensuring that only the holder of the corresponding private key can decrypt it. This is the standard asymmetric encryption workflow in GPG for targeted confidentiality.

Answer

gpg --symmetric file

Answer

gpg --clearsign file

Answer

gpg --sign file

Question 12

An administrator configures AIDE to monitor /etc. After initializing the database, what command updates the database with current file hashes without removing old entries?

Accepted Answer

aide --update. AIDE's --update option performs a check and then updates the database with any new or changed file hashes while preserving existing entries. This is the correct way to refresh the database after legitimate changes to monitored files, as it combines --check and --init in a single operation without losing the baseline.

Answer

aide --init

Answer

aide --compare

Answer

aide --check

Question 13

To ensure that OpenVPN clients authenticate the server, which configuration directive should be present on the client side?

Accepted Answer

ca. The `ca` directive on the client side specifies the Certificate Authority (CA) certificate file that the client uses to verify the server's certificate during the TLS handshake. This ensures the client authenticates the server's identity, preventing man-in-the-middle attacks. Without this, the client cannot validate that it is connecting to a trusted OpenVPN server.

Answer

tls-verify

Answer

tls-auth

Answer

cert

Question 14

An administrator uses logwatch to send daily summaries to root. Which configuration file controls the default logwatch behavior?

Accepted Answer

/etc/logwatch/conf/logwatch.conf. Logwatch uses a modular configuration system where the main configuration file is located at /etc/logwatch/conf/logwatch.conf. This file overrides the default settings found in /usr/share/logwatch/default.conf/logwatch.conf, allowing administrators to customize logwatch behavior without modifying the distribution's default files.

Answer

/etc/logwatch.conf

Answer

/usr/share/logwatch/default.conf

Answer

/etc/logwatch/logwatch.conf

Question 15

A security analyst notices that an /etc/pam.d/common-auth file contains the line 'auth required pam_tally2.so deny=5'. What is the effect?

Accepted Answer

Account lockout after 5 failed login attempts. The `pam_tally2.so` module tracks login attempts and, when used with `deny=5`, locks the account after five consecutive failed authentication attempts. The `required` control ensures that if the tally threshold is exceeded, authentication fails immediately, preventing further access until the count is reset by an administrator or via `pam_tally2` reset.

Answer

Log failed attempts only

Answer

Password expiration after 5 days

Answer

Maximum 5 concurrent sessions