EX200 Manage security — 20 Questions

Question 1

Which THREE factors determine whether a local user can SSH into a Red Hat Enterprise Linux 9 system? (Choose three.)

Accepted Answer

The user's shell is listed in /etc/shells.. SSHd validates that the user's login shell is listed in /etc/shells before allowing authentication. If the shell is not present in /etc/shells (e.g., /sbin/nologin or a custom script), SSHd will deny the connection, even if the user has valid credentials. This check is controlled by the 'AllowUsers' and 'DenyUsers' directives but is a fundamental security measure to prevent users with non-standard shells from gaining interactive access.

Answer

The /etc/nologin file exists.

Answer

The user has sudo privileges.

Question 2

Refer to the exhibit. A web server (httpd) is unable to serve files from a user's home directory. What is the most appropriate single command to resolve the issue?

Accepted Answer

setsebool -P httpd_enable_homedirs on. SELinux policy by default blocks httpd from reading user home directories via the httpd_enable_homedirs boolean, which is off. The command 'setsebool -P httpd_enable_homedirs on' enables this boolean and directly allows httpd to serve files from user home directories. Option C only sets the file context to httpd_sys_content_t, which is insufficient without the boolean because httpd still cannot traverse the user home directory path.

Answer

chcon -u system_u /home/user/www/index.html

Answer

semanage fcontext -a -t httpd_sys_content_t '/home/user/www(/.*)?' && restorecon -Rv /home/user/www

Answer

chcon -r object_r /home/user/www/index.html

Question 3

A sysadmin wants to allow user 'alice' to run all commands as root via sudo. Which line should be added to /etc/sudoers?

Accepted Answer

alice ALL=(root) ALL. The sudoers entry 'alice ALL=(root) ALL' grants user alice permission to run any command as root on any host, exactly matching the requirement. Option C ('alice ALL=(ALL) ALL') allows running commands as any user, which is more permissive than needed. Option B restricts the host to 'localhost' and allows running as any user, so it is not the best fit. Option D uses '%alice' which refers to a group, not a user, and is therefore incorrect.

Answer

alice localhost=(ALL) ALL

Answer

alice ALL=(ALL) ALL

Answer

%alice ALL=(ALL) ALL

Question 4

A user reports that SSH key-based authentication fails, but password authentication works. The admin checks /etc/ssh/sshd_config: PubkeyAuthentication yes, PasswordAuthentication no (contrary to the report). Which is the most likely reason key-based auth fails?

Accepted Answer

The .ssh directory has permissions 755.. SSH key-based authentication requires that the ~/.ssh directory and its contents have restrictive permissions. If the .ssh directory has permissions 755, it is world-readable, which violates SSH's security model. SSH daemon (sshd) will refuse to use the authorized_keys file if the directory permissions are too permissive, causing key-based authentication to fail even though PubkeyAuthentication is enabled.

Answer

SELinux is blocking SSH from reading the key.

Answer

The public key is not in ~/.ssh/authorized_keys.

Answer

SSH is configured to use a different port.

Question 5

Refer to the exhibit. A host in the 192.168.1.0/24 network is unable to access a web service running on this server on port 8080. What is the most likely reason?

Accepted Answer

The rich rule only allows http (port 80), not the custom port 8080.. A rich rule that accepts HTTP traffic on port 80 only adds an allow rule. It does not affect traffic on other ports. Unmatched traffic falls through to the zone's default target. For the internal zone, the default target is ACCEPT, so port 8080 would not be blocked by that rule alone. To block port 8080, the default target would need to be drop/reject or an explicit reject/drop rule would need to exist.

Answer

The service http is not defined for port 8080.

Answer

The zone is internal and has a default target of drop.

Answer

The interface eth1 is not added to the zone.

Question 6

An auditor requires that all failed SSH login attempts be logged to a separate file /var/log/ssh_failures. Which configuration is needed in /etc/rsyslog.conf or /etc/rsyslog.d/?

Accepted Answer

authpriv.err /var/log/ssh_failures. SSH authentication failures are logged by the `authpriv` facility with severity `err` or higher. The `authpriv.err` selector in rsyslog matches messages from the `authpriv` facility with a severity of `err` and above (including `crit`, `alert`, `emerg`), which covers failed SSH login attempts. This directs those messages to `/var/log/ssh_failures` as required.

Answer

sshd.* /var/log/ssh_failures

Answer

authpriv.* /var/log/ssh_failures

Answer

auth.* /var/log/ssh_failures

Question 7

Which TWO of the following are valid methods to enforce password complexity requirements on a Red Hat Enterprise Linux 9 system?

Accepted Answer

Using the pam_cracklib module. It is a PAM module that enforces password complexity by checking new passwords against dictionary words, character classes, and other rules when used in the password stack (e.g., in /etc/pam.d/system-auth). Option E (pam_pwquality) is also correct and is the modern replacement for pam_cracklib on RHEL 9, providing the same complexity enforcement via the pwquality library and configurable through /etc/security/pwquality.conf. Option B (passwd --stdin) is not a complexity enforcement method; it merely allows non-interactive password changes and does not itself impose complexity rules. Option C (chage) manages password aging and expiration policies, not complexity requirements. Option D (editing /etc/shadow manually) bypasses PAM checks and does not enforce complexity, and direct manual editing is error-prone and not a valid enforcement mechanism.

Answer

Using the passwd command with --stdin

Answer

Using the chage command

Answer

Editing the /etc/shadow file manually

Question 8

A Red Hat Enterprise Linux 9 system is configured as a router between an internal network (10.0.1.0/24) and a DMZ network (10.0.2.0/24). IP forwarding is enabled, and firewalld is active. The internal interface (eth0) is assigned to the 'internal' firewall zone, and the DMZ interface (eth1) is assigned to the 'dmz' zone. The requirement is that hosts on the internal network should be able to initiate connections to hosts in the DMZ, but the DMZ should not be able to initiate connections to the internal network. The administrator finds that traffic from internal to DMZ is being blocked. The internal zone has 'masquerade' enabled, and the dmz zone has no special settings. What is the most likely cause of the blocked traffic?

Accepted Answer

The internal zone is missing a rule to allow forwarded traffic to the DMZ. The internal zone lacks a forwarding rule (or policy) that permits traffic to be forwarded to the dmz zone. firewalld blocks inter-zone forwarding by default unless explicitly allowed. Enabling IP forwarding and masquerade does not affect zone-based forward filtering. To allow internal-to-DMZ traffic while blocking DMZ-initiated connections, use a firewalld policy with source=internal, destination=dmz and an accept rule, and include a stateful rule for related/established return traffic.

Answer

The dmz zone should be assigned to the internal interface

Answer

The internal zone has masquerade enabled, which is incorrect for a router

Answer

The dmz zone does not have masquerade enabled

Question 9

A systems administrator needs to list all currently defined firewall rules in firewalld, including rules for all zones. Which TWO commands can be used to accomplish this? (Choose exactly two.)

Accepted Answer

firewall-cmd --list-all-zones. `firewall-cmd --list-all-zones` displays the firewall rules for every zone in firewalld, including all default and custom zones, satisfying the requirement to list rules for all zones. Option E is incorrect because `firewall-cmd --list-all` only shows rules for the default zone, not all zones. The other options are incorrect: `iptables -L` shows raw kernel rules that may not reflect firewalld's configuration, `systemctl status firewalld` checks the service status, and `firewall-cmd --get-default-zone` shows only the default zone name, not rules.

Answer

iptables -L

Answer

systemctl status firewalld

Answer

firewall-cmd --get-default-zone

Answer

firewall-cmd --list-all

Question 10

A systems administrator is managing a RHEL 9 server that hosts a custom web application on Apache. The application writes log files to /var/log/myapp/ and runs as the apache user. The administrator has set the directory permissions to 755 and ownership to apache:apache. SELinux is in enforcing mode. Despite these settings, the application fails to write logs. The audit log contains multiple AVC denials with the message 'avc:  denied  { write } for pid=1234 comm="httpd" name="myapp.log" dev="dm-0" ino=5678 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file'. The administrator has verified that the file exists and that SElinux booleans related to httpd are at their default values. Which of the following steps should the administrator take to resolve the issue while maintaining security?

Accepted Answer

Use audit2allow to generate and install a custom policy module that permits httpd_t to write to files with a specific type (e.g., httpd_log_t).. The AVC denial shows httpd_t is denied write access to a file with type var_log_t. The proper solution is to use audit2allow to generate and install a custom SELinux policy module that allows httpd_t to write to files labeled var_log_t, thereby maintaining security by only permitting the needed access to that specific type.

Answer

Run restorecon -R /var/log/myapp/ to restore the default SELinux context.

Answer

Set the SELinux boolean httpd_unified on to allow httpd_t to write to all types.

Answer

Change the context of the /var/log/myapp/ directory to var_log_t using chcon.

Question 11

A junior administrator on a RHEL 9 server runs `ls -Z /srv/reports/quarterly.xlsx` and sees the type `default_t`. The file is served by an httpd virtual host rooted at /srv/reports, and every request returns HTTP 403. The administrator has already confirmed the file permissions are 0644 and the SELinux policy is enforcing. Which command most directly resolves the denial without disabling SELinux?

Accepted Answer

semanage fcontext -a -t httpd_sys_content_t '/srv/reports(/.*)?' followed by restorecon -Rv /srv/reports. The denial is caused by an incorrect type label rather than by Unix permissions. Recording the correct type for the directory tree in the persistent file-context policy and then relabeling the existing files makes httpd able to read the report while keeping the change durable across relabels and updates. One-off relabeling or relaxing enforcement only masks the problem.

Answer

semanage permissive -a httpd_t

Answer

setsebool -P httpd_read_user_content on

Answer

chcon -t httpd_sys_content_t /srv/reports/quarterly.xlsx

Question 12

A junior admin needs to ensure that the 'apache' user (UID 48) cannot log in via SSH or console. Which command achieves this?

Accepted Answer

usermod -s /sbin/nologin apache. Setting the user's login shell to `/sbin/nologin` prevents the user from obtaining an interactive shell via SSH or console login. When the user attempts to log in, the system executes `/sbin/nologin`, which prints a polite message and exits immediately, effectively denying shell access while leaving other services (e.g., Apache) functional.

Answer

passwd -l apache

Answer

chage -l apache

Answer

usermod -e 1 apache

Question 13

An administrator runs 'getenforce' and sees 'Enforcing'. They then run 'setenforce 0' but SELinux still denies access to a custom application. What is the most likely reason?

Accepted Answer

The issue is due to file permissions or ACLs, not SELinux.. `setenforce 0` switches SELinux to permissive mode, which logs but does not enforce denials. If access is still denied after this command, the issue is not caused by SELinux enforcement but by traditional Linux file permissions (DAC) or ACLs. The administrator should check `ls -l` and `getfacl` to verify the file's ownership and permissions.

Answer

SELinux is in enforcing mode and the policy is misconfigured.

Answer

The application's SELinux context is incorrect and needs relabeling.

Answer

The change requires a reboot to take effect.

Question 14

A system administrator wants to allow user 'jdoe' to execute any command as root via sudo without being prompted for a password, but only from the host 'client1.example.com'. Which sudoers rule achieves this?

Accepted Answer

jdoe client1.example.com=(root) NOPASSWD: ALL. The sudoers rule 'jdoe client1.example.com=(root) NOPASSWD: ALL' specifies the user 'jdoe', the host 'client1.example.com' as the source host from which the command is run, the target user '(root)', the NOPASSWD tag to skip password authentication, and the command 'ALL' to allow any command. This matches the requirement exactly: passwordless root access restricted to a specific client host.

Answer

jdoe client1.example.com=(root) ALL

Answer

jdoe ALL=(root) NOPASSWD: ALL

Answer

jdoe ALL=(root) ALL

Question 15

A server's firewall is managed by firewalld. The admin adds a rule to allow HTTPS traffic to the public zone, but clients still cannot connect. What is the most likely cause?

Accepted Answer

The rule was added with --permanent but firewall-cmd --reload was not run.. When a rule is added with the `--permanent` flag in firewalld, it is written to the configuration files but not applied to the runtime firewall. Until `firewall-cmd --reload` is executed, the runtime configuration remains unchanged, so the new rule allowing HTTPS traffic is not active. Clients cannot connect because the firewall is still blocking HTTPS based on the old runtime rules.

Answer

The rule must be added as a rich rule, not a simple service.

Answer

The default zone is not set to public.

Answer

firewalld is just a wrapper for iptables, so iptables rules must be cleared.

Question 16

Which TWO commands can be used to display SELinux contexts of files? (Choose two.)

Accepted Answer

stat -c %C. The `stat -c %C` command displays the SELinux security context of a file by using the `%C` format specifier, which outputs the security context string. The `ls -Z` command also shows SELinux contexts for files in a directory listing, with the `-Z` flag specifically requesting security context information. Both commands are standard tools for viewing SELinux labels on files.

Answer

chcon -l

Answer

id -Z

Answer

getenforce

Question 17

You are the system administrator for a small company. A developer, Alice, needs to restart the web server (httpd.service) on server 'web1.example.com' without being prompted for a password. She should also be able to run any command as root on that server, but only from the server itself (not remotely). Currently, Alice can SSH into the server using her SSH key, but when she runs 'sudo systemctl restart httpd', she is prompted for her password. You have verified that Alice is in the 'wheel' group. The sudoers file currently has the line '%wheel ALL=(ALL) ALL'. You want to modify sudoers to satisfy the requirement with minimal privilege. Which action should you take?

Accepted Answer

Add 'alice web1.example.com=(root) NOPASSWD: /usr/bin/systemctl restart httpd' to /etc/sudoers.d/alice.. It grants Alice passwordless sudo access specifically to the command `/usr/bin/systemctl restart httpd` on the host `web1.example.com` as root, meeting the requirement with minimal privilege. The `NOPASSWD:` tag is essential to bypass the password prompt, and the host restriction ensures the rule applies only when Alice is on that server.

Answer

Add 'alice web1.example.com=(root) NOPASSWD: ALL' to /etc/sudoers.d/alice.

Answer

Add 'alice web1.example.com=(root) /usr/bin/systemctl restart httpd' to /etc/sudoers.d/alice.

Answer

Change '%wheel ALL=(ALL) ALL' to '%wheel ALL=(ALL) NOPASSWD: ALL' in /etc/sudoers.

Question 18

A system administrator needs to configure a firewall using firewalld to allow incoming HTTPS traffic and deny incoming SSH traffic from a specific source IP 192.168.1.100. Which two commands should be run? (Choose two.)

Accepted Answer

firewall-cmd --add-service=https --permanent. `firewall-cmd --add-service=https --permanent` adds the HTTPS service (TCP port 443) to the permanent firewall configuration, which is required to allow incoming HTTPS traffic persistently across reboots. The `--permanent` flag ensures the rule survives a reload or restart, and the `--add-service` option uses predefined service definitions from firewalld to simplify rule creation.

Answer

firewall-cmd --runtime-to-permanent

Answer

firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.168.1.100 service name=ssh reject' --permanent

Answer

firewall-cmd --add-service=http --permanent

Question 19

A junior administrator is tasked with setting up SELinux contexts on a Red Hat Enterprise Linux 9 server to allow Apache HTTPD to read and write to a custom directory /var/www/customcontent. The directory already exists and contains several files. The administrator has confirmed that the httpd service is running and SELinux is in enforcing mode. After changing the context to httpd_sys_content_t using chcon, the web server can read files but cannot write to the directory. The administrator needs to fix this without disabling SELinux or changing the mode to permissive. Which of the following is the correct next step?

Accepted Answer

Run restorecon -R -v /var/www/customcontent after setting the default context with semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/customcontent(/.*)?'. The directory already has the httpd_sys_content_t type, which allows reading but not writing. To enable write access, the correct type is httpd_sys_rw_content_t. Option B correctly uses semanage fcontext to set the default context to this type and then runs restorecon to apply it persistently, ensuring Apache can both read and write.

Answer

Set the SELinux boolean httpd_enable_homedirs to on using setsebool.

Answer

Change the context to httpd_sys_content_t using chcon -R -t httpd_sys_content_t /var/www/customcontent

Answer

Run semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/customcontent(/.*)?' without running restorecon.

Question 20

Order the steps to configure firewall rules to allow HTTP and HTTPS traffic using firewalld.

Accepted Answer

1. Add HTTP service: firewall-cmd --permanent --add-service=http
2. Add HTTPS service: firewall-cmd --permanent --add-service=https
3. Reload firewall: firewall-cmd --reload
4. Verify: firewall-cmd --list-services. Firewalld rules are added with --permanent flag and then reloaded to take effect.

Answer

1. Reload firewall: firewall-cmd --reload
2. Add HTTP service: firewall-cmd --permanent --add-service=http
3. Add HTTPS service: firewall-cmd --permanent --add-service=https
4. Verify: firewall-cmd --list-services

Answer

1. Add HTTP service: firewall-cmd --add-service=http (without --permanent)
2. Add HTTPS service: firewall-cmd --add-service=https (without --permanent)
3. Reload firewall: firewall-cmd --reload
4. Verify: firewall-cmd --list-services

Answer

1. Add HTTP service: firewall-cmd --permanent --add-service=http
2. Reload firewall: firewall-cmd --reload
3. Add HTTPS service: firewall-cmd --permanent --add-service=https
4. Verify: firewall-cmd --list-services