LPIC-2 System Security Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. A user cannot log in via SSH even though the password is correct. What is the most likely issue?

Accepted Answer

The /etc/nologin file exists, preventing non-root logins.. The /etc/nologin file, when present, prevents all non-root users from logging into the system via any authentication method, including SSH. This is a common administrative mechanism to block user access during maintenance or security incidents. Since the password is correct but login fails, the existence of /etc/nologin is the most likely cause, as it overrides successful PAM authentication for non-root users.

Answer

The password module is not configured correctly.

Answer

pam_unix.so nullok allows blank passwords, causing authentication to fail.

Answer

pam_securetty.so restricts root login via SSH, but the user is not root.

Question 2

An administrator wants to block all incoming traffic from the IP address 203.0.113.55 except for SSH (port 22) using iptables. The current default policy for the INPUT chain is ACCEPT. Which set of commands achieves this?

Accepted Answer

iptables -A INPUT -s 203.0.113.55 -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -s 203.0.113.55 -j DROP. Iptables processes rules in order. The first rule accepts SSH traffic from 203.0.113.55, and the second rule drops all other traffic from that IP. Since the default INPUT policy is ACCEPT, the drop rule must be placed after the SSH allow rule to ensure SSH packets are accepted before being dropped by the subsequent rule.

Answer

iptables -A INPUT -p tcp --dport 22 -s 203.0.113.55 -j ACCEPT -m; iptables -A INPUT -s 203.0.113.55 -j DROP

Answer

iptables -A INPUT -s 203.0.113.55 -j DROP; iptables -A INPUT -s 203.0.113.55 -p tcp -j ACCEPT

Answer

iptables -A INPUT -s 203.0.113.55 -j DROP; iptables -A INPUT -s 203.0.113.55 -p tcp --dport 22 -j ACCEPT

Question 3

An administrator needs to encrypt a large file using GPG with a symmetric cipher and then decrypt it on another system. Which command encrypts the file using AES256 and prompts for a passphrase?

Accepted Answer

gpg --symmetric --cipher-algo AES256 file.txt. `--symmetric` tells GPG to encrypt the file using a symmetric cipher (i.e., a single passphrase shared between sender and receiver), and `--cipher-algo AES256` selects the AES-256 encryption algorithm. The command will prompt for a passphrase interactively, which is exactly what the scenario requires.

Answer

gpg --clearsign --cipher-algo AES256 file.txt

Answer

gpg --encrypt --cipher-algo AES256 file.txt

Answer

gpg --sign --cipher-algo AES256 file.txt

Question 4

A web server running Apache is receiving many failed login attempts. Which tool should be used to dynamically block IPs after a configurable number of failures?

Accepted Answer

fail2ban. fail2ban is the correct tool because it monitors log files (e.g., /var/log/apache2/error.log) for repeated failed login attempts and dynamically updates iptables or nftables rules to block the offending IP address after a configurable threshold (e.g., maxretry = 5). It is purpose-built for this task, offering flexible jails and ban actions, unlike static or system-wide mechanisms.

Answer

TCP Wrappers

Answer

/etc/hosts.deny

Answer

iptables

Question 5

An AppArmor profile for a database server is too restrictive and denies legitimate queries. The administrator wants to learn the required accesses by running the application in complain mode. Which command puts the profile into complain mode?

Accepted Answer

aa-complain /etc/apparmor.d/usr.sbin.mysqld. The `aa-complain` command places an AppArmor profile into complain mode, where policy violations are logged but not blocked. This allows the administrator to run the database server and observe which accesses are denied, then use the logs to update the profile with the required permissions. The correct syntax is `aa-complain /etc/apparmor.d/usr.sbin.mysqld` to target the specific profile file.

Answer

aa-disable /etc/apparmor.d/usr.sbin.mysqld

Answer

aa-enforce /etc/apparmor.d/usr.sbin.mysqld

Answer

aa-log /etc/apparmor.d/usr.sbin.mysqld

Question 6

Which TWO commands can be used to list currently loaded iptables rules in the filter table? (Choose two.)

Accepted Answer

iptables -nL. Option B, `iptables -nL`, is correct because `-L` lists all rules in the default filter table and `-n` disables DNS resolution, showing numeric addresses and ports; since the filter table is the default when no `-t` is specified, this lists the currently loaded filter rules. Option C, `iptables -L -t filter`, is correct because `-L` lists the rules and `-t filter` explicitly selects the filter table, which is exactly the table requested. Option A, `iptables -L -t nat`, is wrong because it targets the nat table rather than the filter table. Option D, `iptables -Z`, is wrong because it zeroes packet and byte counters instead of listing rules. Option E, `iptables -F`, is wrong because it flushes (deletes) all rules in a table rather than listing them.

Answer

iptables -L -t nat

Answer

iptables -Z

Answer

iptables -F

Question 7

Which user can execute any command as any user without any password restriction?

Accepted Answer

root. The root user (UID 0) has unrestricted superuser privileges by default on Linux systems. Unlike regular users, root can execute any command as any user without needing to provide a password, as there is no sudo or su password requirement for the root account itself. This is a fundamental security property of the Unix/Linux permission model.

Answer

alice

Answer

charlie

Answer

bob

Question 8

A company's security policy requires that all members of the 'developers' group be able to run the command 'systemctl restart httpd' as root using sudo, without being prompted for a password. Which sudoers entry achieves this?

Accepted Answer

%developers ALL=(root) NOPASSWD: /usr/bin/systemctl restart httpd. It uses the %group syntax to specify the 'developers' group, includes the NOPASSWD: tag to suppress password prompting, and specifies the exact command path and arguments (/usr/bin/systemctl restart httpd) as required by the sudoers policy. This matches the security requirement precisely.

Answer

%developers ALL=(root) /usr/bin/systemctl restart httpd

Answer

developers ALL=(root) NOPASSWD: /usr/bin/systemctl restart httpd

Answer

%developers ALL=(root) NOPASSWD: {/usr/bin/systemctl restart httpd}

Answer

%developers ALL=(0) NOPASSWD: /usr/bin/systemctl restart httpd

Question 9

A firewall rule set is implemented using iptables. The administrator wants to allow incoming SSH connections only from the 192.168.1.0/24 subnet, while all other incoming traffic is dropped. Which set of rules achieves this?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -j DROP. It first adds a rule to accept TCP traffic on port 22 (SSH) from the 192.168.1.0/24 subnet, then adds a default DROP rule for all other incoming traffic. Since iptables processes rules in order, the ACCEPT rule matches allowed SSH connections first, and the subsequent DROP rule catches all other incoming packets, effectively dropping everything else including SSH from other sources.

Answer

iptables -A INPUT -p tcp --sport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -j DROP

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j DROP

Answer

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

Question 10

Which TWO of the following are recommended best practices for securing a Linux server that is publicly accessible?

Accepted Answer

Use a firewall to restrict access to only necessary ports.. Option C is correct because a host-based firewall such as iptables, nftables, or ufw should enforce a default-deny policy that permits only the specific TCP/UDP ports required by exposed services (for example 22/tcp for SSH and 443/tcp for HTTPS), minimizing the attack surface on a publicly reachable server. Option E is correct because disabling direct root login via SSH, typically by setting PermitRootLogin no in /etc/ssh/sshd_config, forces administrators to authenticate as an unprivileged user and then escalate through sudo, which removes a well-known, high-value target and enables per-user accountability and auditing. Option A is wrong because running services as root violates least privilege and lets any service compromise yield full system control. Option B is wrong because simple, memorable passwords are trivially guessable or brute-forced, whereas strong passphrases, key-based SSH authentication, and tools like fail2ban are recommended. Option D is wrong because enabling NFS exports on a public server unnecessarily exposes file-sharing services and weakens the security posture.

Answer

Run all services with root privileges.

Answer

Set all user passwords to simple, memorable ones.

Answer

Enable NFS exports for file sharing.

Question 11

Which THREE of the following tools can be used to implement file integrity checking on a Linux system?

Accepted Answer

AIDE. AIDE (Advanced Intrusion Detection Environment) is correct because it builds a database of file hashes, permissions, and metadata and later compares the filesystem against it to detect unauthorized changes, which is exactly file integrity checking. Tripwire is correct because it is a classic host-based file integrity monitoring tool that creates a baseline of cryptographic hashes and reports any deviations. sha256sum is correct because it computes SHA-256 cryptographic hashes of files, allowing an administrator to manually compare a file's current hash against a known-good value to verify integrity. Logwatch is not correct because it only parses and summarizes system log files; it does not hash or monitor file contents. Nmap is not correct because it is a network port scanner and host discovery tool, not a file integrity checker.

Answer

Logwatch

Answer

Nmap

Question 12

A small business has a single Linux server that serves as both a file server (Samba) and a web server (Apache). The server is directly connected to the internet. Recently, there have been numerous brute-force SSH login attempts. The administrator wants to implement a simple solution to block IP addresses that have more than 5 failed SSH attempts in 10 minutes. The server runs Ubuntu 20.04. Which tool should the administrator use to achieve this with minimal configuration?

Accepted Answer

Install and configure Fail2ban to monitor /var/log/auth.log.. Fail2ban is the correct tool because it is specifically designed to monitor log files (e.g., /var/log/auth.log) for repeated failed authentication attempts and dynamically update firewall rules (via iptables or nftables) to block offending IP addresses. It requires minimal configuration: a default SSH jail is provided out-of-the-box, and the administrator only needs to adjust the `maxretry` and `findtime` parameters to match the requirement of 5 failures in 10 minutes.

Answer

Enable UFW and set default deny incoming, allow SSH from specific IPs.

Answer

Set up TCP wrappers with /etc/hosts.deny for SSH.

Answer

Use port knocking to hide SSH port until a specific sequence is sent.

Question 13

Refer to the exhibit. What is the effect of this sudoers configuration?

Accepted Answer

Users alice and bob can run apt-get and dpkg on any host as root, requiring a password.. The sudoers configuration specifies that users alice and bob are allowed to run only the commands /usr/bin/apt-get and /usr/bin/dpkg as root on any host (ALL). The absence of the NOPASSWD tag means that a password is required for these commands. The syntax 'alice,bob ALL=(root) /usr/bin/apt-get, /usr/bin/dpkg' restricts the command set and requires authentication.

Answer

Users alice and bob can run any software command on the localhost only.

Answer

Members of ADMINS can run any command as root on any host.

Answer

Users alice and bob can run apt-get and dpkg without a password.

Question 14

A company runs an Apache web server (port 80) and an SSH server (port 22) for remote administration. The system administrator notices that the server has become sluggish and network traffic has increased significantly. Checking /var/log/auth.log reveals hundreds of failed SSH authentication attempts per minute from diverse IP addresses targeting the 'admin' user. The administrator wants to mitigate this brute-force attack with minimal impact on legitimate users. Which course of action is most effective?

Accepted Answer

Install and configure fail2ban to block IP addresses after 5 failed SSH attempts within 10 minutes.. Fail2ban is specifically designed to mitigate brute-force attacks by monitoring log files (e.g., /var/log/auth.log) for repeated failed authentication attempts and dynamically updating firewall rules (e.g., iptables or nftables) to block offending IP addresses. This approach is automated, reduces manual intervention, and has minimal impact on legitimate users since only IPs exceeding the threshold are blocked.

Answer

Change the SSH port to a non-standard port number.

Answer

Disable password authentication for SSH and use key-based authentication only.

Answer

Add the offending IP addresses to /etc/hosts.deny manually.

Question 15

A Debian-based Linux server runs SSH on TCP port 2222 with PermitRootLogin yes. The administrator notices thousands of failed authentications in /var/log/auth.log and wants an automated tool that reads that log file and inserts firewall rules to block offending source addresses. Which tool should the administrator deploy?

Accepted Answer

fail2ban. The requirement is automated log-driven reaction: read auth.log and block source addresses. fail2ban is purpose-built for this, pairing filters with jails and firewall actions. The other tools either inspect packets without log awareness, restrict authentication counts without blocking sources, or only report on events. Only a log-monitoring daemon that triggers firewall actions meets the described need.

Answer

iptables with the recent module loaded

Answer

logwatch with a custom reporting script

Answer

sshd with UsePAM and MaxAuthTries tightened