EX200 Manage security Practice Test 2 — 15 Questions

Question 1

Which TWO commands can be used to display SELinux contexts of files? (Choose two.)

Accepted Answer

stat -c %C. The `stat -c %C` command displays the SELinux security context of a file by using the `%C` format specifier, which outputs the security context string. The `ls -Z` command also shows SELinux contexts for files in a directory listing, with the `-Z` flag specifically requesting security context information. Both commands are standard tools for viewing SELinux labels on files.

Answer

chcon -l

Answer

id -Z

Answer

getenforce

Question 2

You are the system administrator for a small company. A developer, Alice, needs to restart the web server (httpd.service) on server 'web1.example.com' without being prompted for a password. She should also be able to run any command as root on that server, but only from the server itself (not remotely). Currently, Alice can SSH into the server using her SSH key, but when she runs 'sudo systemctl restart httpd', she is prompted for her password. You have verified that Alice is in the 'wheel' group. The sudoers file currently has the line '%wheel ALL=(ALL) ALL'. You want to modify sudoers to satisfy the requirement with minimal privilege. Which action should you take?

Accepted Answer

Add 'alice web1.example.com=(root) NOPASSWD: /usr/bin/systemctl restart httpd' to /etc/sudoers.d/alice.. It grants Alice passwordless sudo access specifically to the command `/usr/bin/systemctl restart httpd` on the host `web1.example.com` as root, meeting the requirement with minimal privilege. The `NOPASSWD:` tag is essential to bypass the password prompt, and the host restriction ensures the rule applies only when Alice is on that server.

Answer

Add 'alice web1.example.com=(root) NOPASSWD: ALL' to /etc/sudoers.d/alice.

Answer

Add 'alice web1.example.com=(root) /usr/bin/systemctl restart httpd' to /etc/sudoers.d/alice.

Answer

Change '%wheel ALL=(ALL) ALL' to '%wheel ALL=(ALL) NOPASSWD: ALL' in /etc/sudoers.

Question 3

A system administrator needs to configure a firewall using firewalld to allow incoming HTTPS traffic and deny incoming SSH traffic from a specific source IP 192.168.1.100. Which two commands should be run? (Choose two.)

Accepted Answer

firewall-cmd --add-service=https --permanent. `firewall-cmd --add-service=https --permanent` adds the HTTPS service (TCP port 443) to the permanent firewall configuration, which is required to allow incoming HTTPS traffic persistently across reboots. The `--permanent` flag ensures the rule survives a reload or restart, and the `--add-service` option uses predefined service definitions from firewalld to simplify rule creation.

Answer

firewall-cmd --runtime-to-permanent

Answer

firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.168.1.100 service name=ssh reject' --permanent

Answer

firewall-cmd --add-service=http --permanent

Question 4

A junior administrator is tasked with setting up SELinux contexts on a Red Hat Enterprise Linux 9 server to allow Apache HTTPD to read and write to a custom directory /var/www/customcontent. The directory already exists and contains several files. The administrator has confirmed that the httpd service is running and SELinux is in enforcing mode. After changing the context to httpd_sys_content_t using chcon, the web server can read files but cannot write to the directory. The administrator needs to fix this without disabling SELinux or changing the mode to permissive. Which of the following is the correct next step?

Accepted Answer

Run restorecon -R -v /var/www/customcontent after setting the default context with semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/customcontent(/.*)?'. The directory already has the httpd_sys_content_t type, which allows reading but not writing. To enable write access, the correct type is httpd_sys_rw_content_t. Option B correctly uses semanage fcontext to set the default context to this type and then runs restorecon to apply it persistently, ensuring Apache can both read and write.

Answer

Set the SELinux boolean httpd_enable_homedirs to on using setsebool.

Answer

Change the context to httpd_sys_content_t using chcon -R -t httpd_sys_content_t /var/www/customcontent

Answer

Run semanage fcontext -a -t httpd_sys_rw_content_t '/var/www/customcontent(/.*)?' without running restorecon.

Question 5

Order the steps to configure firewall rules to allow HTTP and HTTPS traffic using firewalld.

Accepted Answer

1. Add HTTP service: firewall-cmd --permanent --add-service=http
2. Add HTTPS service: firewall-cmd --permanent --add-service=https
3. Reload firewall: firewall-cmd --reload
4. Verify: firewall-cmd --list-services. Firewalld rules are added with --permanent flag and then reloaded to take effect.

Answer

1. Reload firewall: firewall-cmd --reload
2. Add HTTP service: firewall-cmd --permanent --add-service=http
3. Add HTTPS service: firewall-cmd --permanent --add-service=https
4. Verify: firewall-cmd --list-services

Answer

1. Add HTTP service: firewall-cmd --add-service=http (without --permanent)
2. Add HTTPS service: firewall-cmd --add-service=https (without --permanent)
3. Reload firewall: firewall-cmd --reload
4. Verify: firewall-cmd --list-services

Answer

1. Add HTTP service: firewall-cmd --permanent --add-service=http
2. Reload firewall: firewall-cmd --reload
3. Add HTTPS service: firewall-cmd --permanent --add-service=https
4. Verify: firewall-cmd --list-services

Question 6

Match each networking term to its definition.

Accepted Answer

IP address: A unique identifier assigned to each device on a network.. The correct matches are: IP address (unique identifier), Subnet mask (network/host division), Default gateway (router to external networks), DNS server (name resolution). Common confusions include swapping definitions between IP address and subnet mask, or between default gateway and DNS server.

Answer

IP address: A 32-bit number used to divide an IP address into network and host portions.

Answer

Default gateway: A server that resolves domain names to IP addresses.

Question 7

After configuring sudo, a user reports: 'sudo: unable to open /etc/sudoers: Permission denied'. The admin checks the file permissions and sees '-rw-r-----' owned by root:root. What is the most likely cause?

Accepted Answer

The file permissions are too permissive (0640 instead of 0440).. The sudoers file requires strict permissions of 0440 (owner read, group read) to be considered secure by sudo. The current permissions of 0640 (owner read/write, group read) are too permissive, as they grant write access to the owner (root), which violates sudo's security model. When sudo detects that /etc/sudoers has permissions other than 0440, it refuses to open the file and reports 'Permission denied' to prevent potential tampering.

Answer

The file is owned by the wrong user.

Answer

The sudo binary is missing the setuid bit.

Answer

SELinux is blocking access.

Question 8

A server uses firewalld with the default zone set to 'drop'. SSH is allowed only for the 192.168.1.0/24 subnet via a rich rule in the 'internal' zone. After a reboot, SSH connections from that subnet are refused. What is the most likely cause?

Accepted Answer

The network interface is not assigned to the 'internal' zone.. After a reboot, firewalld applies the default zone to all interfaces not explicitly assigned to another zone. Since the rich rule allowing SSH from 192.168.1.0/24 is defined in the 'internal' zone, the network interface must be assigned to that zone for the rule to take effect. If the interface is not assigned (e.g., it remains in the default 'drop' zone), all incoming traffic, including SSH from the allowed subnet, is dropped by default.

Answer

The subnet 192.168.1.0/24 is not a valid source for rich rules.

Answer

The rich rule was not made permanent.

Answer

The SSH service is not enabled in the default zone.

Question 9

Which command sets the password maximum age for user 'bob' to 30 days?

Accepted Answer

chage -M 30 bob. Both `chage -M 30 bob` and `passwd -x 30 bob` are valid commands to set the maximum password age for user 'bob' to 30 days. `chage -M` is the commonly used and RHCSA-recommended tool for password aging, but `passwd -x` also works on Red Hat systems. Option C (`usermod -e`) sets account expiration, not password maximum age. Option D (`chage -W`) sets the warning period before expiry.

Answer

usermod -e 30 bob

Answer

chage -W 30 bob

Question 10

An administrator wants newly created files to be readable and writable only by the owner, and readable by group and others. Which umask value should be set?

Accepted Answer

022. The umask value 022 removes write permissions for group and others, while leaving read and execute permissions intact. Since the default base permissions for files are 666 (rw-rw-rw-), applying umask 022 results in 644 (rw-r--r--), which gives the owner read/write access and group/others read-only access — exactly matching the requirement.

Answer

027

Answer

002

Answer

077

Question 11

Which file contains the hashed passwords for local user accounts?

Accepted Answer

/etc/shadow. The /etc/shadow file stores hashed passwords for local user accounts, along with password aging and expiration information. It is readable only by root (or privileged processes) to prevent unauthorized access to password hashes, unlike /etc/passwd which is world-readable.

Answer

/etc/security/passwd

Answer

/etc/passwd

Answer

/etc/gshadow

Question 12

A file has been assigned an incorrect SELinux context, preventing a service from accessing it. Which command restores the default SELinux context for that file?

Accepted Answer

restorecon. The `restorecon` command is used to restore the default SELinux security context for a file or directory based on the system's policy store (the file_contexts database). When a file has an incorrect context that prevents a service from accessing it, `restorecon` resets the context to the correct default, allowing the service to access the resource as intended.

Answer

chcon

Answer

fixfiles

Answer

setfiles

Question 13

An administrator needs to grant user 'dev' the ability to execute /usr/local/bin/deploy.sh as root without a password, but no other commands. Which sudoers entry accomplishes this?

Accepted Answer

dev ALL=(root) NOPASSWD: /usr/local/bin/deploy.sh. The sudoers entry 'dev ALL=(root) NOPASSWD: /usr/local/bin/deploy.sh' grants user dev permission to run only that command as root without a password prompt. The NOPASSWD tag removes the password requirement, and specifying the single command restricts the privilege to exactly that binary.

Answer

dev ALL=(root) PASSWD: /usr/local/bin/deploy.sh

Answer

dev ALL=(ALL) NOPASSWD: /usr/local/bin/deploy.sh

Answer

%dev ALL=(root) NOPASSWD: /usr/local/bin/deploy.sh

Question 14

Refer to the exhibit. What is the primary security concern with this sudo configuration?

Accepted Answer

The less command allows executing shell commands via !, enabling privilege escalation.. The `less` command, when executed with sudo, allows the user to escape to a shell by typing `!command` from within the pager. This bypasses the intended restriction of only running `/usr/bin/less` as root, enabling arbitrary command execution with elevated privileges. The NOPASSWD directive further compounds the risk by removing the password prompt, making the escalation trivial.

Answer

The NOPASSWD option eliminates the need for a password.

Answer

The entry uses (ALL) instead of (root), allowing jane to run as any user.

Answer

The command /usr/bin/less can be used to read any file.

Question 15

Refer to the exhibit. A CGI script located at /var/www/cgi-bin/test.cgi fails to execute. What is the most likely cause?

Accepted Answer

The SELinux context should be httpd_sys_script_exec_t.. SELinux contexts control which processes can access files and directories. The CGI script at /var/www/cgi-bin/test.cgi requires the httpd_sys_script_exec_t context to allow the Apache HTTP server (httpd) to execute it. Without this context, SELinux will deny execution even if file permissions and ownership are correct.

Answer

The script is in the wrong directory.

Answer

The script is not marked as executable.

Answer

The file permissions are incorrect.