LPIC-2 System Security Practice Test 4 — 15 Questions

Question 1

Which two commands correctly configure SSH to disable root login? (Select two.)

Accepted Answer

echo "DenyUsers root" >> /etc/ssh/sshd_config. `DenyUsers root` in `/etc/ssh/sshd_config` explicitly prevents the root user from logging in via SSH, regardless of other authentication methods. Option E is correct because `PermitRootLogin no` directly disables all root SSH logins (password, key, or otherwise) in the SSH server configuration. Both directives require a subsequent restart or reload of the sshd service to take effect.

Answer

usermod -L root

Answer

echo "PermitRootLogin without-password" >> /etc/ssh/sshd_config

Answer

echo "PermitRootLogin yes" >> /etc/ssh/ssh_config

Question 2

Which three PAM modules can be used to enforce password complexity? (Select three.)

Accepted Answer

pam_passwdqc.so. pam_passwdqc.so, pam_pwquality.so, and pam_cracklib.so are all PAM modules specifically designed to enforce password complexity policies, such as requiring a mix of character types, minimum length, or rejecting weak passwords. pam_passwdqc.so uses a configurable password quality checking framework, pam_pwquality.so (the successor to pam_cracklib.so) provides similar checks via the libpwquality library, and pam_cracklib.so (the original module) performs dictionary checks and complexity rules. These modules are typically stacked in the password authentication stack to validate new passwords against defined policies.

Answer

pam_securetty.so

Answer

pam_unix.so

Question 3

Which two of the following are valid methods to authenticate with OpenVPN? (Select two.)

Accepted Answer

Static key. OpenVPN supports static key authentication (option D) as a simple pre-shared secret method where both client and server use the same key to encrypt and authenticate traffic. This is valid but less secure than certificate-based methods, as it lacks perfect forward secrecy and individual revocation capabilities.

Answer

LDAP

Answer

RADIUS

Answer

NIS

Question 4

Refer to the exhibit. A security audit reveals that the server is not blocking SSH connections from unauthorized networks. What is the most likely cause?

Accepted Answer

The SSH rule does not restrict source IP, so it allows all incoming SSH connections.. The SSH rule in the exhibit uses `--dport 22` without any `-s` or `--source` parameter to restrict the source IP address. This means the rule matches any incoming TCP packet destined for port 22, regardless of its origin network. Without a source IP restriction, the firewall allows SSH connections from all networks, including unauthorized ones, which is the security issue identified by the audit.

Answer

The FORWARD chain is DROP, blocking all forwarded traffic.

Answer

The SSH rule uses --dport 22 but missing source IP restriction, allowing all sources.

Answer

The default policy for INPUT is DROP, which should block all, but SSH works due to the ESTABLISHED,RELATED rule.

Question 5

Refer to the exhibit. A user cannot log in via SSH even though the password is correct. What is the most likely issue?

Accepted Answer

The /etc/nologin file exists, preventing non-root logins.. The /etc/nologin file, when present, prevents all non-root users from logging into the system via any authentication method, including SSH. This is a common administrative mechanism to block user access during maintenance or security incidents. Since the password is correct but login fails, the existence of /etc/nologin is the most likely cause, as it overrides successful PAM authentication for non-root users.

Answer

The password module is not configured correctly.

Answer

pam_unix.so nullok allows blank passwords, causing authentication to fail.

Answer

pam_securetty.so restricts root login via SSH, but the user is not root.

Question 6

Refer to the exhibit. An administrator runs aide --check and receives a warning that /var/log/syslog has changed. Why is this expected?

Accepted Answer

The /var/log entry monitors the directory itself, not its contents; changes inside the directory are not tracked.. The AIDE configuration for /var/log typically monitors the directory entry itself (its metadata like permissions and ownership) rather than recursively tracking changes to files within it. When /var/log/syslog changes, AIDE does not detect it because the directory's inode metadata remains unchanged; only the file's content and metadata are altered. This is a common default behavior unless the configuration explicitly uses the 'R' or 'p+sha512' flags to recurse into subdirectories and hash file contents.

Answer

The SHA512 hash for /var/log is incorrect.

Answer

The /var/log entry includes permissions but not content hashes, so changes in file content are not monitored.

Answer

The +c flag checks for changes in the file's ctime, so syslog changes are detected.

Question 7

A system administrator wants to allow the user 'jdoe' to run the '/usr/bin/systemctl restart httpd' command on a specific server without a password prompt. Which sudoers entry achieves this?

Accepted Answer

jdoe ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart httpd. The NOPASSWD tag in the sudoers entry explicitly allows user 'jdoe' to execute the specified command '/usr/bin/systemctl restart httpd' without being prompted for a password. The syntax 'jdoe ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart httpd' grants passwordless execution for that exact command on any host, which matches the requirement.

Answer

jdoe ALL=(ALL) /usr/bin/systemctl restart httpd

Answer

user ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart httpd

Answer

jdoe ALL=(ALL) ALL

Question 8

A security audit reveals that a server with PAM authentication allows users to log in even when the '/etc/nologin' file exists, contrary to policy. Which PAM module is most likely misconfigured or missing?

Accepted Answer

pam_nologin.so. The pam_nologin.so module is specifically designed to check for the existence of /etc/nologin and, if found, prevent non-root users from logging in. If users can still log in despite this file existing, the module is either missing from the PAM stack (e.g., not included in /etc/pam.d/login or /etc/pam.d/sshd) or misconfigured (e.g., placed after the authentication phase instead of the account phase).

Answer

pam_securetty.so

Answer

pam_access.so

Answer

pam_lastlog.so

Question 9

A user's SSH public key has been added to '~/.ssh/authorized_keys' on a remote server, but the user is still prompted for a password. Which file permission is most likely causing the issue?

Accepted Answer

0660. SSH's authorized_keys file must have strict permissions to prevent unauthorized modifications. The correct permission is 0600 (owner read/write only) or more restrictive. Permission 0660 (group read/write) is too permissive because it allows group members to modify the file, which SSH interprets as a security risk and falls back to password authentication.

Answer

0644

Answer

0444

Answer

0600

Question 10

An administrator wants to block all incoming traffic from the IP address 203.0.113.55 except for SSH (port 22) using iptables. The current default policy for the INPUT chain is ACCEPT. Which set of commands achieves this?

Accepted Answer

iptables -A INPUT -s 203.0.113.55 -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -s 203.0.113.55 -j DROP. Iptables processes rules in order. The first rule accepts SSH traffic from 203.0.113.55, and the second rule drops all other traffic from that IP. Since the default INPUT policy is ACCEPT, the drop rule must be placed after the SSH allow rule to ensure SSH packets are accepted before being dropped by the subsequent rule.

Answer

iptables -A INPUT -p tcp --dport 22 -s 203.0.113.55 -j ACCEPT -m; iptables -A INPUT -s 203.0.113.55 -j DROP

Answer

iptables -A INPUT -s 203.0.113.55 -j DROP; iptables -A INPUT -s 203.0.113.55 -p tcp -j ACCEPT

Answer

iptables -A INPUT -s 203.0.113.55 -j DROP; iptables -A INPUT -s 203.0.113.55 -p tcp --dport 22 -j ACCEPT

Question 11

An administrator needs to encrypt a large file using GPG with a symmetric cipher and then decrypt it on another system. Which command encrypts the file using AES256 and prompts for a passphrase?

Accepted Answer

gpg --symmetric --cipher-algo AES256 file.txt. `--symmetric` tells GPG to encrypt the file using a symmetric cipher (i.e., a single passphrase shared between sender and receiver), and `--cipher-algo AES256` selects the AES-256 encryption algorithm. The command will prompt for a passphrase interactively, which is exactly what the scenario requires.

Answer

gpg --clearsign --cipher-algo AES256 file.txt

Answer

gpg --encrypt --cipher-algo AES256 file.txt

Answer

gpg --sign --cipher-algo AES256 file.txt

Question 12

A web server running Apache is receiving many failed login attempts. Which tool should be used to dynamically block IPs after a configurable number of failures?

Accepted Answer

fail2ban. fail2ban is the correct tool because it monitors log files (e.g., /var/log/apache2/error.log) for repeated failed login attempts and dynamically updates iptables or nftables rules to block the offending IP address after a configurable threshold (e.g., maxretry = 5). It is purpose-built for this task, offering flexible jails and ban actions, unlike static or system-wide mechanisms.

Answer

TCP Wrappers

Answer

/etc/hosts.deny

Answer

iptables

Question 13

A system with SELinux in enforcing mode is running a custom application that needs to write to a file in /data. The application's context type is 'myapp_t', and the target file context is 'default_t'. The file's current context is 'var_t'. Which command changes the file's context to allow access?

Accepted Answer

chcon -t default_t /data/file. `chcon -t default_t /data/file` directly changes the SELinux type of the file to `default_t`, which matches the type expected by the `myapp_t` domain's access rules. Since the application runs in enforcing mode and needs to write to a file with type `default_t`, this command immediately sets the correct context without modifying the policy or requiring a relabel.

Answer

fixfiles -F relabel /data

Answer

semanage fcontext -a -t default_t /data/file

Answer

restorecon /data/file

Question 14

An AppArmor profile for a database server is too restrictive and denies legitimate queries. The administrator wants to learn the required accesses by running the application in complain mode. Which command puts the profile into complain mode?

Accepted Answer

aa-complain /etc/apparmor.d/usr.sbin.mysqld. The `aa-complain` command places an AppArmor profile into complain mode, where policy violations are logged but not blocked. This allows the administrator to run the database server and observe which accesses are denied, then use the logs to update the profile with the required permissions. The correct syntax is `aa-complain /etc/apparmor.d/usr.sbin.mysqld` to target the specific profile file.

Answer

aa-disable /etc/apparmor.d/usr.sbin.mysqld

Answer

aa-enforce /etc/apparmor.d/usr.sbin.mysqld

Answer

aa-log /etc/apparmor.d/usr.sbin.mysqld

Question 15

An administrator wants to restrict SSH access to a server so that only users from the domain 'example.com' can connect. Which file and syntax should be used with TCP Wrappers?

Accepted Answer

Add to /etc/hosts.allow: sshd: .example.com. TCP Wrappers uses the /etc/hosts.allow file to grant access based on daemon: client patterns. The syntax 'sshd: .example.com' restricts SSH access to clients whose hostnames end with '.example.com', which matches all hosts in the 'example.com' domain. This is the standard way to allow only users from a specific domain to connect via SSH using TCP Wrappers.

Answer

Add to /etc/hosts.deny: sshd: ALL

Answer

Add to /etc/hosts.allow: ALL: .example.com

Answer

Add to /etc/hosts.allow: sshd: ALLOW .example.com