LPIC-2 System Security Practice Test 3 — 15 Questions

Question 1

Which TWO files are commonly used to configure PAM authentication for the 'login' service on a Linux system? (Choose two.)

Accepted Answer

/etc/pam.d/login. Option D, /etc/pam.d/login, is correct because on modern Linux systems PAM service-specific configuration files live under /etc/pam.d/, and the file named 'login' defines the PAM module stack (auth, account, password, session) applied to the login service. Option E, /etc/security/access.conf, is correct because it is the configuration file for the pam_access module, which is commonly referenced from the login PAM stack to enforce host/user/origin-based access restrictions for logins. Option A, /etc/default/login, is not a PAM configuration file; it is a Solaris-style file for login defaults and is not used to define PAM module stacks. Option B, /etc/login.defs, configures shadow-suite defaults such as UID/GID ranges, password aging, and umask, not PAM authentication modules. Option C, /etc/pam.conf, is the legacy monolithic PAM configuration file, but on systems using /etc/pam.d/ it is generally ignored or absent, so it is not the commonly used file for the login service.

Answer

/etc/default/login

Answer

/etc/login.defs

Answer

/etc/pam.conf

Question 2

A new client with IP 10.0.1.15 tries to connect to HTTPS on the server. Based on the exhibit, what happens?

Accepted Answer

The connection is accepted because 10.0.1.15 is in 10.0.0.0/8.. The iptables rule set includes a rule that accepts traffic from the 10.0.0.0/8 subnet. The client IP 10.0.1.15 falls within this range, so the HTTPS connection matches the rule and is accepted. This occurs before any later rules that might drop or reject the traffic.

Answer

The connection is dropped by rule 5.

Answer

The connection is rejected with an ICMP error.

Answer

The connection is accepted only if state RELATED.

Question 3

A Linux server in a DMZ hosts a custom web application that listens on TCP port 8080. The server is also configured with SSH on port 22 for remote administration. Recently, the security team noticed an increase in brute-force attacks against SSH from various external IPs. The server runs Fedora with firewalld as the firewall service. The current firewalld default zone is 'public', and the SSH service is allowed in the 'public' zone. The administrator wants to mitigate the brute-force attacks without blocking legitimate users. Additionally, the administrator wants to ensure that only specific administrative IP addresses can initiate SSH connections, and that SSH connections are rate-limited to prevent flooding. The administrator also needs to keep the web application accessible from any external IP. Which course of action best meets these requirements?

Accepted Answer

Add a firewalld rich rule to allow SSH only from specific source IPs, and add a rich rule to limit connection rate for SSH. Keep the web application in the same zone with the appropriate service.. Firewalld rich rules allow granular control: you can specify source IPs for SSH access and apply a connection rate limit (e.g., using 'limit' in the rich rule) to mitigate brute-force attacks without blocking legitimate users. The web application on port 8080 remains accessible from any external IP because the 'public' zone still has the appropriate service allowed, and the rich rules only restrict SSH. This approach avoids changing the default zone or using external tools like fail2ban, keeping the solution within firewalld's native capabilities.

Answer

Move SSH to a non-standard port (e.g., 2222) and update the firewalld service definition accordingly.

Answer

Use iptables to create a whitelist for SSH, and install fail2ban to rate-limit after 3 failures.

Answer

Change the default zone to 'drop', then add a rich rule to allow SSH only from the administrative network.

Question 4

A system administrator wants to enforce key-based SSH authentication for all users on a server, disabling password authentication. Which two commands must be executed to achieve this? (Choose TWO.)

Accepted Answer

ssh-keygen -t rsa -b 4096. Option C (ssh-keygen -t rsa -b 4096) is correct because it generates the RSA key pair (private and public key) that forms the basis of key-based authentication; the public key is what gets installed on the server so users can authenticate without a password. Option E (ssh-copy-id user@server) is correct because it copies the user's public key into the remote server's ~/.ssh/authorized_keys file with the proper permissions, which is the essential step that enables key-based login for that user. The remaining options do not accomplish the goal: A (sshd -T) only dumps the effective sshd configuration for testing, B (visudo) edits the sudoers file and is unrelated to SSH authentication, and D (chmod 600 ~/.ssh/authorized_keys) sets permissions on the file but does not itself create or install the key, so it is not one of the two required commands to establish key-based authentication.

Answer

sshd -T

Answer

visudo

Answer

chmod 600 ~/.ssh/authorized_keys

Question 5

An administrator wants to chroot SSH users in the 'jailed' group to their home directories. Which configuration in /etc/ssh/sshd_config achieves this?

Accepted Answer

Match Group jailed
  ChrootDirectory %h. The Match directive in sshd_config allows conditional configuration blocks based on criteria like group membership. The ChrootDirectory %h directive chroots the user to their home directory, which is the standard method for restricting SSH users to a specific filesystem area. This configuration applies only to users in the 'jailed' group, as required.

Answer

Subsystem sftp internal-sftp
  Match Group jailed
    ChrootDirectory %h

Answer

Match User jailed
  ChrootDirectory %h

Answer

ChrootGroup jailed
  ChrootDirectory %h

Answer

Match Group jailed
  ChrootJail %h

Question 6

Your company runs a web application on a Linux server that uses Apache HTTPD with mod_ssl for HTTPS. Recently, after a security audit, it was discovered that the server is vulnerable to the POODLE attack on SSLv3. The server is running RHEL 8 with Apache 2.4. The SSL configuration file /etc/httpd/conf.d/ssl.conf currently has the line 'SSLProtocol all -SSLv2'. You need to disable SSLv3 and also disable all versions of TLS below 1.2, while still allowing TLS 1.2 and 1.3. The server must remain available immediately. Which action should you take?

Accepted Answer

Change 'SSLProtocol all -SSLv2' to 'SSLProtocol TLSv1.2 TLSv1.3'. The directive 'SSLProtocol TLSv1.2 TLSv1.3' explicitly enables only TLS 1.2 and TLS 1.3, thereby disabling SSLv3 and all TLS versions below 1.2 (i.e., TLS 1.0 and TLS 1.1). This directly addresses the POODLE vulnerability (which exploits SSLv3) and enforces the required minimum TLS version, while keeping the server immediately available without restarting Apache (a graceful reload is sufficient).

Answer

Change 'SSLProtocol all -SSLv2' to 'SSLProtocol all -SSLv2 -SSLv3'

Answer

Add 'SSLProtocol -SSLv3' after the existing line

Answer

Change the line to 'SSLProtocol TLSv1.2 TLSv1.3 -SSLv2 -SSLv3'

Question 7

A financial institution uses a Linux server with a custom application that runs as the 'appuser' and writes logs to /var/log/app/. The security team recently detected that the application is vulnerable to a local privilege escalation via log injection. To mitigate, they decide to implement mandatory access control (MAC) using SELinux. The system is CentOS 7 with SELinux in enforcing mode. The current context of /var/log/app is 'unconfined_u:object_r:var_log_t:s0'. The application should only be allowed to write to logs in that directory, and no other processes should modify them. Which SELinux policy change should be made?

Accepted Answer

Create a custom SELinux policy module that defines a new type for the log directory and transitions for the application domain.. The application needs a dedicated SELinux type for its log directory and a domain transition so that only the 'appuser' process running in the 'app_t' domain can write to that directory. Creating a custom policy module with a new type (e.g., 'app_log_t') and a file transition rule ensures that other processes (even those with 'var_log_t' access) cannot modify the logs, meeting the strict confinement requirement.

Answer

Use 'semanage permissive -a app_t' to put the application domain in permissive mode.

Answer

Run 'chcon -t var_log_t /var/log/app' to set the correct context.

Answer

Use 'audit2allow' to create a local policy module based on current denials.

Question 8

A system administrator is setting up mutual TLS (mTLS) for communication between a web server and a backend application on a Linux server. The security team requires encryption and proper certificate management with automated renewal using open-source tools on a small budget. Which solution should the administrator implement?

Accepted Answer

Set up a private CA with easy-rsa and configure a cron job for certificate renewal.. Easy-rsa provides a simple wrapper around OpenSSL to create a private CA, and a cron job can automate certificate renewal, meeting the budget and open-source requirements. This is a common approach for internal mTLS in Linux environments.

Answer

Generate self-signed certificates using OpenSSL and manually distribute them via SCP.

Answer

Deploy Hashicorp Vault with PKI backend.

Answer

Use Let's Encrypt with an ACME client to issue internal certificates.

Question 9

A government agency runs a classified application on a Linux server with strict auditing requirements. The application writes sensitive data to a MySQL database. The auditor requires that all SQL queries executed by the application be logged with timestamps, user, and the full query text. Additionally, the audit logs must be immutable (cannot be altered by the application or any user except a designated auditor account). The database runs on the same server. Which combination of tools and configurations should the administrator deploy?

Accepted Answer

Enable MySQL's general query log, direct it to a file on a separate filesystem mounted with the 'noexec' and 'append' options, and set the file immutable with chattr +a.. It combines MySQL's general query log (which captures full query text, timestamps, and user) with filesystem-level immutability via `chattr +a` (append-only) on a separate filesystem mounted with `noexec` and `append` options. This ensures logs cannot be modified or deleted by the application or any non-auditor user, meeting the strict auditing requirement for immutable logs.

Answer

Enable auditd to monitor the MySQL process and log all system calls.

Answer

Enable the MySQL audit log plugin and configure rsyslog to forward logs to a remote log server.

Answer

Use tcpdump to capture all network traffic to port 3306 and save to a file with packet captures.

Question 10

Which TWO of the following actions are recommended to improve SSH server security?

Accepted Answer

PermitEmptyPasswords no. Option A, 'PermitEmptyPasswords no', is correct because it prevents accounts with blank passwords from authenticating over SSH, closing a trivial unauthorized-access vector that sshd would otherwise allow. Option B, 'PasswordAuthentication no', is correct because disabling password authentication forces key-based (or other non-password) authentication, eliminating brute-force and credential-guessing attacks against SSH logins. Option C, 'AllowUsers *.example.com', is not recommended as written because AllowUsers matches user names, not hostnames, so a wildcard domain pattern is invalid and would not restrict access as intended. Option D, 'PermitRootLogin yes', is wrong because it allows direct root logins over SSH, which should be disabled (e.g., 'PermitRootLogin no' or 'prohibit-password') to reduce risk. Option E, 'UsePAM yes', is not a hardening action; it simply enables PAM integration for authentication and account handling and is unrelated to improving SSH security in this scenario.

Answer

AllowUsers *.example.com

Answer

PermitRootLogin yes

Answer

UsePAM yes

Question 11

A production server runs a custom backup script as the user 'backup'. The script needs to access a restricted directory owned by root:root with mode 0700, but the administrator does not want to grant full root privileges. Which command should be used to allow the 'backup' user to run only the script /usr/local/bin/backup.sh with root privileges?

Accepted Answer

Edit /etc/sudoers and add: backup ALL=(root) NOPASSWD: /usr/local/bin/backup.sh. The correct approach is to add a specific sudoers rule that permits the backup user to run only the backup script as root. This grants the necessary privilege without providing full root access, adhering to the principle of least privilege. Other methods either do not configure persistent permissions or are insecure.

Answer

chmod u+s /usr/local/bin/backup.sh

Answer

visudo

Answer

sudo -u root /usr/local/bin/backup.sh

Question 12

An administrator configures a firewall with iptables and wants to log only packets that are dropped by the INPUT chain, using a custom prefix, before the final DROP rule. The administrator adds a rule with the LOG target immediately before the DROP rule. Which statement describes what actually happens for a packet that matches neither an earlier ACCEPT rule nor the DROP rule?

Accepted Answer

The packet is logged by the LOG rule, then evaluated by subsequent rules in the chain.. The LOG target is deliberately non-terminating so that it can record a packet without changing filtering decisions. Placing it immediately before a DROP rule therefore logs exactly the packets that survive earlier ACCEPT rules and are about to be dropped, while traversal continues to the DROP that actually discards them. The default policy is only consulted after full chain traversal.

Answer

The LOG target requires the NFLOG module and will fail to load without it.

Answer

The packet bypasses the remaining rules and is accepted by the default policy.

Answer

The packet is logged and then silently dropped because the LOG target also terminates chain traversal.

Question 13

A small office uses a Linux gateway (eth0 to ISP, eth1 to LAN). The administrator needs to allow LAN clients to access web servers on the internet and must ensure that return traffic is permitted. Which single iptables rule, added to the filter table, accomplishes this for established and related connections?

Accepted Answer

iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT. For LAN clients to reach external web servers, the gateway must forward outbound new connections and also permit the returning packets. A stateful rule on the FORWARD chain that matches ESTABLISHED and RELATED traffic on the inbound interface (eth0) and outbound interface (eth1) allows responses to pass while blocking unsolicited inbound connections. This is the standard approach for a stateful firewall on a Linux router.

Answer

iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

Answer

iptables -A FORWARD -i eth1 -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Answer

iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

Question 14

A Linux server is being hardened, and the administrator wants to restrict which users can run privileged commands via sudo and log all sudo activity. Which two actions correctly apply sudo policy and auditing on a current system? (Choose two.)

Accepted Answer

Add a line such as Defaults logfile=/var/log/sudo.log to direct sudo logging to a dedicated file.. Applying sudo policy safely means editing the sudoers file with visudo, which validates syntax and prevents lockouts, and ensuring activity is logged. Directing logs to a dedicated file via the Defaults logfile option complements the default journal/syslog logging. World-writable sudoers or relying on group membership alone would break security or functionality.

Answer

Edit /etc/sudoers directly with a text editor and save changes to apply the policy immediately.

Answer

Run chmod 777 /etc/sudoers so all administrators can update the policy without using sudo.

Answer

Disable the sudoers file and rely on the wheel group membership alone for privilege escalation.

Question 15

A Linux administrator is tuning a server's kernel parameters to harden it against TCP SYN flood attacks. The administrator adds the following line to /etc/sysctl.conf:
net.ipv4.tcp_syncookies = 1
After running sysctl -p, the setting appears active. However, the administrator wants to verify that the kernel is actually using SYN cookies when the SYN backlog overflows. Which command should be used to confirm this?

Accepted Answer

nstat -az TcpExtSyncookiesSent TcpExtSyncookiesRecv. The nstat utility reads kernel SNMP counters, and TcpExtSyncookiesSent and TcpExtSyncookiesRecv specifically track SYN cookie generation and reception. Using -az shows absolute values including zero, allowing direct verification of whether cookies are sent when the SYN backlog overflows. This is the only option that provides runtime evidence of SYN cookie usage, not just the configuration state.

Answer

cat /proc/net/netstat | grep -i syncookies

Answer

sysctl net.ipv4.tcp_syncookies

Answer

ss -s | grep syncookies