EX200 Manage security Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. An administrator wants to add the HTTP service (port 80) to the internal zone permanently. Which sequence of commands should be used?

Accepted Answer

firewall-cmd --zone=internal --add-service=http --permanent; firewall-cmd --reload. It uses the --permanent flag to make the rule persistent across reboots, and then runs firewall-cmd --reload to apply the permanent configuration to the running runtime environment without restarting the firewalld service. This sequence ensures the HTTP service is added to the internal zone permanently while maintaining active connections.

Answer

firewall-cmd --add-service=http --zone=internal; firewall-cmd --reload

Answer

firewall-cmd --permanent --add-service=http --zone=internal; systemctl restart firewalld

Answer

firewall-cmd --zone=internal --add-service=http; firewall-cmd --runtime-to-permanent

Question 2

Which TWO statements about the /etc/shadow file are true? (Select exactly two.)

Accepted Answer

Contains hashed passwords for local users.. The /etc/shadow file stores hashed user passwords using algorithms like SHA-512 or yescrypt, as defined by the pam_unix module. It also contains password aging fields (e.g., minimum days, maximum days, warning period) that enforce password expiration policies. These two functions make options A and E correct.

Answer

Contains the user's UID.

Answer

Is used to store encrypted group passwords.

Answer

Is readable by all users.

Question 3

Which THREE commands are used to manage SELinux file security contexts? (Select exactly three.)

Accepted Answer

chcon. B (chcon) is correct because it changes the SELinux security context of a file or directory immediately, without reference to the SELinux policy database. This is useful for temporary or one-off changes, but the context may be overwritten by restorecon or a file system relabel.

Answer

setenforce

Answer

selinux

Question 4

Which TWO methods are considered best practices for securing SSH access to a server? (Select exactly two.)

Accepted Answer

Disable root login by setting PermitRootLogin no.. Disabling root login by setting `PermitRootLogin no` in `/etc/ssh/sshd_config` prevents direct SSH access as the root user, forcing administrators to log in as a regular user and then use `sudo` or `su` to escalate privileges. This reduces the attack surface by eliminating a high-value target for brute-force attacks and ensures all actions are auditable via the regular user's session.

Answer

Use only password authentication for simplicity.

Answer

Change the default SSH port to a high-numbered port.

Answer

Allow SSH access for all users in the system.

Question 5

A system administrator needs to allow members of the 'developers' group to run any command as root without being prompted for a password. Which sudoers configuration line should be added?

Accepted Answer

%developers ALL=(ALL) NOPASSWD: ALL. The line `%developers ALL=(ALL) NOPASSWD: ALL` grants all members of the 'developers' group (indicated by the `%` prefix) permission to run any command as any user (including root) via sudo without being prompted for a password. The `NOPASSWD` tag is the key directive that bypasses password authentication, which directly matches the requirement to run commands as root without a password.

Answer

%developers ALL=(root) PASSWD: ALL

Answer

developers ALL=(ALL) NOPASSWD: ALL

Answer

%developers ALL=(ALL) ALL

Question 6

A web server is running in enforcing mode with SELinux, but Apache cannot read content in a custom directory /web. The directory has been labeled correctly with httpd_sys_content_t. However, access is still denied. What is the most likely cause?

Accepted Answer

The directory has incorrect permissions of 700.. Even though the SELinux context is correctly set to httpd_sys_content_t, the directory has permissions of 700 (rwx------). This means only the owner (typically root) can read, write, or execute the directory. The Apache httpd process runs as the 'apache' or 'httpd' user, which is not the owner, so it is denied read access. SELinux enforces its own policy, but DAC (Discretionary Access Control) permissions are checked first; if DAC denies access, SELinux never gets to evaluate the context match.

Answer

SELinux boolean httpd_enable_homedirs is off.

Answer

The httpd process is running in permissive mode.

Answer

The files are labeled with default_t.

Question 7

A company requires that SSH access from the external network (10.0.1.0/24) only be allowed to port 2222, and all other incoming traffic on the firewall should be dropped. Which firewalld rule should be applied to the external zone?

Accepted Answer

firewall-cmd --zone=external --add-rich-rule='rule family="ipv4" source address="10.0.1.0/24" port port="2222" protocol="tcp" accept' --permanent. It uses a rich rule to explicitly allow incoming TCP traffic on port 2222 from the 10.0.1.0/24 source network, which matches the requirement. The default target for the external zone is 'drop', so only explicitly permitted traffic is allowed; this rule ensures SSH on port 2222 is accepted while all other incoming traffic is dropped.

Answer

firewall-cmd --zone=external --add-service=ssh --permanent

Answer

firewall-cmd --zone=external --add-port=2222/tcp --permanent

Answer

firewall-cmd --zone=external --add-rich-rule='rule family="ipv4" source address="10.0.1.0/24" service name="ssh" accept' --permanent

Question 8

To enforce that user passwords expire every 90 days and users are warned 7 days before expiration, which command sets these policies for user 'john'?

Accepted Answer

chage -M 90 -W 7 john. The `chage -M 90 -W 7 john` command sets the maximum number of days a password is valid (password aging) to 90 days via the `-M` flag, and the `-W` flag sets the warning period to 7 days before expiration. The `chage` command is the standard tool in Red Hat Enterprise Linux for modifying user password aging information stored in `/etc/shadow`.

Answer

chage -m 90 -W 7 john

Answer

usermod -e 90 -f 7 john

Answer

passwd -x 90 -w 7 john

Question 9

An administrator wants to allow user 'alice' to SSH into the server using key-based authentication only. Which configuration change is required?

Accepted Answer

Add alice's public key to ~alice/.ssh/authorized_keys and set PubkeyAuthentication yes in sshd_config.. SSH key-based authentication requires the user's public key to be placed in the user's `~/.ssh/authorized_keys` file, and the SSH daemon must have `PubkeyAuthentication yes` set in `/etc/ssh/sshd_config` to allow public key authentication. This configuration ensures that only users with the corresponding private key can authenticate as 'alice'.

Answer

Add alice's private key to /etc/ssh/authorized_keys.

Answer

Set PasswordAuthentication no in /etc/ssh/sshd_config and restart sshd.

Answer

Set PermitRootLogin prohibit-password.

Question 10

Refer to the exhibit. A web server is serving content from /var/www/html. SELinux is in enforcing mode. The web client reports 'Forbidden'. What is the most likely cause?

Accepted Answer

The directory /var/www/html may have incorrect context or permissions preventing Apache from listing files.. The most likely cause of a 'Forbidden' error when SELinux is enforcing is that the directory or file lacks the correct SELinux context (e.g., httpd_sys_content_t) or the permissions do not allow the Apache user (apache) to read or traverse the directory. Even if file permissions are 644, SELinux can block access if the context is wrong, such as being set to default_t or user_home_t. The error indicates Apache cannot access the content, which is typically resolved by restoring the correct context with restorecon or setting it with chcon.

Answer

The file is owned by root, and Apache runs as apache user, so it cannot read.

Answer

The file permissions are 644, which restricts access.

Answer

The file has an incorrect SELinux context; it should be httpd_user_content_t.

Question 11

To allow a user to run a specific program with root privileges without providing the root password, which configuration file should be modified?

Accepted Answer

/etc/sudoers. The /etc/sudoers file is the correct configuration file to modify because it controls the sudo command, which allows specified users to execute programs with root privileges. By adding an entry such as `username ALL=(ALL) NOPASSWD: /path/to/program`, the user can run that specific program without being prompted for a password. This is the standard mechanism in Red Hat Enterprise Linux for granting passwordless privilege escalation.

Answer

/etc/passwd

Answer

/etc/security/limits.conf

Answer

/etc/sysconfig/sshd

Question 12

A security policy requires that all files in /home have the default SELinux context for user home directories. Which command recursively restores the default context?

Accepted Answer

restorecon -Rv /home. `restorecon -Rv /home` recursively resets the SELinux context of all files under `/home` to the default type defined in the SELinux policy for user home directories (typically `user_home_t`). The `-R` flag enables recursion, and `-v` provides verbose output, ensuring compliance with the security policy requirement.

Answer

semanage fcontext -a -t user_home_t /home

Answer

chcon -Rv default_t /home

Answer

setfiles -Rv /home

Question 13

Which command checks if a user's password has expired and forces a password change at next login?

Accepted Answer

chage -d 0 username. The `chage -d 0 username` command sets the last password change date to the epoch (January 1, 1970), which forces the password to be considered expired immediately. On the next login, the system will prompt the user to change their password before granting access, as defined by the PAM (Pluggable Authentication Modules) password aging policy.

Answer

passwd -f username

Answer

usermod -L username

Answer

passwd -l username

Question 14

Which two statements about SELinux modes are correct? (Choose two.)

Accepted Answer

Permissive mode logs violations but does not deny actions.. SELinux permissive mode allows all actions but logs any violations that would have been denied in enforcing mode. Option D is correct because enforcing mode both logs violations and denies actions that violate the SELinux policy, providing full security enforcement.

Answer

Permissive mode denies actions but does not log.

Answer

Enforcing mode only logs violations but does not deny.

Answer

Disabled mode completely disables SELinux without requiring a reboot.

Question 15

Which three statements about firewalld zones are correct? (Choose three.)

Accepted Answer

The default zone can be changed using firewall-cmd.. The default zone in firewalld can be changed using the 'firewall-cmd --set-default-zone=<zone>' command. This command updates the runtime and permanent configuration, ensuring that all new network interfaces are automatically assigned to the specified zone unless explicitly overridden.

Answer

A network interface can be assigned to multiple zones simultaneously.

Answer

Zones can have a default target of only 'DROP' or 'ACCEPT'.