EX200 Manage security Practice Test 2 — 15 Questions

Question 1

An administrator needs to grant user 'dev' the ability to execute /usr/local/bin/deploy.sh as root without a password, but no other commands. Which sudoers entry accomplishes this?

Accepted Answer

dev ALL=(root) NOPASSWD: /usr/local/bin/deploy.sh. The correct syntax is 'dev ALL=(root) NOPASSWD: /usr/local/bin/deploy.sh'. This allows dev to run that specific command as root without a password.

Answer

dev ALL=(root) PASSWD: /usr/local/bin/deploy.sh

Answer

dev ALL=(ALL) NOPASSWD: /usr/local/bin/deploy.sh

Answer

%dev ALL=(root) NOPASSWD: /usr/local/bin/deploy.sh

Question 2

Refer to the exhibit. What is the primary security concern with this sudo configuration?

Accepted Answer

The less command allows executing shell commands via !, enabling privilege escalation.. The `less` command, when executed with sudo, allows the user to escape to a shell by typing `!command` from within the pager. This bypasses the intended restriction of only running `/usr/bin/less` as root, enabling arbitrary command execution with elevated privileges. The NOPASSWD directive further compounds the risk by removing the password prompt, making the escalation trivial.

Answer

The NOPASSWD option eliminates the need for a password.

Answer

The entry uses (ALL) instead of (root), allowing jane to run as any user.

Answer

The command /usr/bin/less can be used to read any file.

Question 3

Refer to the exhibit. A CGI script located at /var/www/cgi-bin/test.cgi fails to execute. What is the most likely cause?

Accepted Answer

The SELinux context should be httpd_sys_script_exec_t.. SELinux contexts control which processes can access files and directories. The CGI script at /var/www/cgi-bin/test.cgi requires the httpd_sys_script_exec_t context to allow the Apache HTTP server (httpd) to execute it. Without this context, SELinux will deny execution even if file permissions and ownership are correct.

Answer

The script is in the wrong directory.

Answer

The script is not marked as executable.

Answer

The file permissions are incorrect.

Question 4

Refer to the exhibit. An administrator wants to add the HTTP service (port 80) to the internal zone permanently. Which sequence of commands should be used?

Accepted Answer

firewall-cmd --zone=internal --add-service=http --permanent; firewall-cmd --reload. It uses the --permanent flag to make the rule persistent across reboots, and then runs firewall-cmd --reload to apply the permanent configuration to the running runtime environment without restarting the firewalld service. This sequence ensures the HTTP service is added to the internal zone permanently while maintaining active connections.

Answer

firewall-cmd --add-service=http --zone=internal; firewall-cmd --reload

Answer

firewall-cmd --permanent --add-service=http --zone=internal; systemctl restart firewalld

Answer

firewall-cmd --zone=internal --add-service=http; firewall-cmd --runtime-to-permanent

Question 5

Which TWO statements about the /etc/shadow file are true? (Select exactly two.)

Accepted Answer

Contains hashed passwords for local users.. The /etc/shadow file stores hashed user passwords using algorithms like SHA-512 or yescrypt, as defined by the pam_unix module. It also contains password aging fields (e.g., minimum days, maximum days, warning period) that enforce password expiration policies. These two functions make options A and E correct.

Answer

Contains the user's UID.

Answer

Is used to store encrypted group passwords.

Answer

Is readable by all users.

Question 6

Which THREE commands are used to manage SELinux file security contexts? (Select exactly three.)

Accepted Answer

chcon. B (chcon) is correct because it changes the SELinux security context of a file or directory immediately, without reference to the SELinux policy database. This is useful for temporary or one-off changes, but the context may be overwritten by restorecon or a file system relabel.

Answer

setenforce

Answer

selinux

Question 7

Which TWO methods are considered best practices for securing SSH access to a server? (Select exactly two.)

Accepted Answer

Disable root login by setting PermitRootLogin no.. Disabling root login by setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents direct SSH access as the root user, forcing administrators to log in as a regular user and then use `sudo` or `su` to escalate privileges. This reduces the attack surface by eliminating a high-value target for brute-force attacks and ensures all actions are auditable via the regular user's session.

Answer

Use only password authentication for simplicity.

Answer

Change the default SSH port to a high-numbered port.

Answer

Allow SSH access for all users in the system.

Question 8

A system administrator needs to allow members of the 'developers' group to run any command as root without being prompted for a password. Which sudoers configuration line should be added?

Accepted Answer

%developers ALL=(ALL) NOPASSWD: ALL. The line `%developers ALL=(ALL) NOPASSWD: ALL` grants all members of the 'developers' group (indicated by the `%` prefix) permission to run any command as any user (including root) via sudo without being prompted for a password. The `NOPASSWD` tag is the key directive that bypasses password authentication, which directly matches the requirement to run commands as root without a password.

Answer

%developers ALL=(root) PASSWD: ALL

Answer

developers ALL=(ALL) NOPASSWD: ALL

Answer

%developers ALL=(ALL) ALL

Question 9

A web server is running in enforcing mode with SELinux, but Apache cannot read content in a custom directory /web. The directory has been labeled correctly with httpd_sys_content_t. However, access is still denied. What is the most likely cause?

Accepted Answer

The directory has incorrect permissions of 700.. Even though the SELinux context is correctly set to httpd_sys_content_t, the directory has permissions of 700 (rwx------). This means only the owner (typically root) can read, write, or execute the directory. The Apache httpd process runs as the 'apache' or 'httpd' user, which is not the owner, so it is denied read access. SELinux enforces its own policy, but DAC (Discretionary Access Control) permissions are checked first; if DAC denies access, SELinux never gets to evaluate the context match.

Answer

SELinux boolean httpd_enable_homedirs is off.

Answer

The httpd process is running in permissive mode.

Answer

The files are labeled with default_t.

Question 10

A company requires that SSH access from the external network (10.0.1.0/24) only be allowed to port 2222, and all other incoming traffic on the firewall should be dropped. Which firewalld rule should be applied to the external zone?

Accepted Answer

firewall-cmd --zone=external --add-rich-rule='rule family="ipv4" source address="10.0.1.0/24" port port="2222" protocol="tcp" accept' --permanent. It uses a rich rule to explicitly allow incoming TCP traffic on port 2222 from the 10.0.1.0/24 source network, which matches the requirement. The default target for the external zone is 'drop', so only explicitly permitted traffic is allowed; this rule ensures SSH on port 2222 is accepted while all other incoming traffic is dropped.

Answer

firewall-cmd --zone=external --add-service=ssh --permanent

Answer

firewall-cmd --zone=external --add-port=2222/tcp --permanent

Answer

firewall-cmd --zone=external --add-rich-rule='rule family="ipv4" source address="10.0.1.0/24" service name="ssh" accept' --permanent

Question 11

To enforce that user passwords expire every 90 days and users are warned 7 days before expiration, which command sets these policies for user 'john'?

Accepted Answer

chage -M 90 -W 7 john. The `chage -M 90 -W 7 john` command sets the maximum number of days a password is valid (password aging) to 90 days via the `-M` flag, and the `-W` flag sets the warning period to 7 days before expiration. The `chage` command is the standard tool in Red Hat Enterprise Linux for modifying user password aging information stored in `/etc/shadow`.

Answer

chage -m 90 -W 7 john

Answer

usermod -e 90 -f 7 john

Answer

passwd -x 90 -w 7 john

Question 12

An administrator wants to allow user 'alice' to SSH into the server using key-based authentication only. Which configuration change is required?

Accepted Answer

Add alice's public key to ~alice/.ssh/authorized_keys and set PubkeyAuthentication yes in sshd_config.. SSH key-based authentication requires the user's public key to be placed in the user's `~/.ssh/authorized_keys` file, and the SSH daemon must have `PubkeyAuthentication yes` set in `/etc/ssh/sshd_config` to allow public key authentication. This configuration ensures that only users with the corresponding private key can authenticate as 'alice'.

Answer

Add alice's private key to /etc/ssh/authorized_keys.

Answer

Set PasswordAuthentication no in /etc/ssh/sshd_config and restart sshd.

Answer

Set PermitRootLogin prohibit-password.

Question 13

Refer to the exhibit. A web server is serving content from /var/www/html. SELinux is in enforcing mode. The web client reports 'Forbidden'. What is the most likely cause?

Accepted Answer

The directory /var/www/html may have incorrect context or permissions preventing Apache from listing files.. The most likely cause of a 'Forbidden' error when SELinux is enforcing is that the directory or file lacks the correct SELinux context (e.g., httpd_sys_content_t) or the permissions do not allow the Apache user (apache) to read or traverse the directory. Even if file permissions are 644, SELinux can block access if the context is wrong, such as being set to default_t or user_home_t. The error indicates Apache cannot access the content, which is typically resolved by restoring the correct context with restorecon or setting it with chcon.

Answer

The file is owned by root, and Apache runs as apache user, so it cannot read.

Answer

The file permissions are 644, which restricts access.

Answer

The file has an incorrect SELinux context; it should be httpd_user_content_t.

Question 14

To allow a user to run a specific program with root privileges without providing the root password, which configuration file should be modified?

Accepted Answer

/etc/sudoers. The /etc/sudoers file is the correct configuration file to modify because it controls the sudo command, which allows specified users to execute programs with root privileges. By adding an entry such as `username ALL=(ALL) NOPASSWD: /path/to/program`, the user can run that specific program without being prompted for a password. This is the standard mechanism in Red Hat Enterprise Linux for granting passwordless privilege escalation.

Answer

/etc/passwd

Answer

/etc/security/limits.conf

Answer

/etc/sysconfig/sshd

Question 15

Refer to the exhibit. A host in the 192.168.1.0/24 network is unable to access a web service running on this server on port 8080. What is the most likely reason?

Accepted Answer

The rich rule only allows http (port 80), not the custom port 8080.. A rich rule that accepts HTTP traffic on port 80 only adds an allow rule. It does not affect traffic on other ports. Unmatched traffic falls through to the zone's default target. For the internal zone, the default target is ACCEPT, so port 8080 would not be blocked by that rule alone. To block port 8080, the default target would need to be drop/reject or an explicit reject/drop rule would need to exist.

Answer

The service http is not defined for port 8080.

Answer

The zone is internal and has a default target of drop.

Answer

The interface eth1 is not added to the zone.