EX200 Manage security Practice Test 3 — 15 Questions

Question 1

An auditor requires that all failed SSH login attempts be logged to a separate file /var/log/ssh_failures. Which configuration is needed in /etc/rsyslog.conf or /etc/rsyslog.d/?

Accepted Answer

authpriv.err /var/log/ssh_failures. SSH authentication failures are logged by the `authpriv` facility with severity `err` or higher. The `authpriv.err` selector in rsyslog matches messages from the `authpriv` facility with a severity of `err` and above (including `crit`, `alert`, `emerg`), which covers failed SSH login attempts. This directs those messages to `/var/log/ssh_failures` as required.

Answer

sshd.* /var/log/ssh_failures

Answer

authpriv.* /var/log/ssh_failures

Answer

auth.* /var/log/ssh_failures

Question 2

A security policy requires that all files in /home have the default SELinux context for user home directories. Which command recursively restores the default context?

Accepted Answer

restorecon -Rv /home. `restorecon -Rv /home` recursively resets the SELinux context of all files under `/home` to the default type defined in the SELinux policy for user home directories (typically `user_home_t`). The `-R` flag enables recursion, and `-v` provides verbose output, ensuring compliance with the security policy requirement.

Answer

semanage fcontext -a -t user_home_t /home

Answer

chcon -Rv default_t /home

Answer

setfiles -Rv /home

Question 3

Which command checks if a user's password has expired and forces a password change at next login?

Accepted Answer

chage -d 0 username. The `chage -d 0 username` command sets the last password change date to the epoch (January 1, 1970), which forces the password to be considered expired immediately. On the next login, the system will prompt the user to change their password before granting access, as defined by the PAM (Pluggable Authentication Modules) password aging policy.

Answer

passwd -f username

Answer

usermod -L username

Answer

passwd -l username

Question 4

Which two statements about SELinux modes are correct? (Choose two.)

Accepted Answer

Permissive mode logs violations but does not deny actions.. SELinux permissive mode allows all actions but logs any violations that would have been denied in enforcing mode. Option D is correct because enforcing mode both logs violations and denies actions that violate the SELinux policy, providing full security enforcement.

Answer

Permissive mode denies actions but does not log.

Answer

Enforcing mode only logs violations but does not deny.

Answer

Disabled mode completely disables SELinux without requiring a reboot.

Question 5

Which three statements about firewalld zones are correct? (Choose three.)

Accepted Answer

The default zone can be changed using firewall-cmd.. The default zone in firewalld can be changed using the 'firewall-cmd --set-default-zone=<zone>' command. This command updates the runtime and permanent configuration, ensuring that all new network interfaces are automatically assigned to the specified zone unless explicitly overridden.

Answer

A network interface can be assigned to multiple zones simultaneously.

Answer

Zones can have a default target of only 'DROP' or 'ACCEPT'.

Question 6

Which three actions enhance security for user accounts on a Red Hat Enterprise Linux system? (Choose three.)

Accepted Answer

Enforcing password complexity via pam_pwquality.. Pam_pwquality (formerly pam_cracklib) enforces password complexity rules such as minimum length, character classes, and reuse restrictions. This module is configured in /etc/pam.d/system-auth or /etc/security/pwquality.conf and directly reduces the risk of weak passwords being chosen by users.

Answer

Granting all users sudo access to run all commands.

Answer

Setting the password expiration to 0 days.

Question 7

A company runs a web application on a Red Hat Enterprise Linux 8 server. The application is served by Apache HTTPD, and it requires read/write access to a custom directory /var/www/app_data. The SELinux context for the directory is set to httpd_sys_rw_content_t. Apache runs in enforcing mode. Recently, a new feature was added that requires Apache to connect to a database on the same server via a Unix socket. The database serves on /var/run/mysqld/mysqld.sock. After the feature deployment, the web application fails to connect to the database. The error logs show permission denied on the socket file. The socket file has permissions 660 and is owned by mysql:mysql. SELinux audit logs show AVC denials for httpd_t trying to connect to mysqld_var_run_t. Which of the following solutions should the administrator implement to allow Apache to read the database socket while maintaining security?

Accepted Answer

Enable the SELinux boolean httpd_can_connect_db using setsebool -P httpd_can_connect_db on.. The correct solution is to enable the SELinux boolean `httpd_can_connect_db` using `setsebull -P httpd_can_connect_db on`. This boolean specifically allows the `httpd_t` domain to connect to MySQL/MariaDB databases via Unix sockets, which is exactly the scenario described: Apache needs to connect to a local database socket with context `mysqld_var_run_t`. The AVC denial confirms that the default policy blocks this socket connection, and enabling this boolean grants the necessary permission without weakening other security controls.

Answer

Change the SELinux context of the socket file to httpd_sys_rw_content_t using chcon.

Answer

Enable the SELinux boolean httpd_can_network_connect_db using setsebool -P httpd_can_network_connect_db on.

Answer

Use semanage to add a context mapping for the socket file to httpd_var_run_t and set the httpd to permissive mode.

Question 8

Which TWO of the following are valid methods to enforce password complexity requirements on a Red Hat Enterprise Linux 9 system?

Accepted Answer

Using the pam_cracklib module. The pam_cracklib module is a legacy PAM module that enforces password complexity rules such as minimum length, character classes, and reuse restrictions on RHEL 9. It is invoked via the /etc/pam.d/system-auth and /etc/pam.d/password-auth configuration files, and while deprecated in favor of pam_pwquality, it remains a valid method for enforcing complexity.

Answer

Using the passwd command with --stdin

Answer

Using the chage command

Answer

Editing the /etc/shadow file manually

Question 9

A system administrator is managing a Red Hat Enterprise Linux 9 web server running Apache httpd. The server hosts a custom application that stores its files in /var/www/custom. The administrator has set ownership to apache:apache and file permissions to 755. However, when users access the web application, they receive a 'Forbidden' error. The httpd service is running, and SELinux is in enforcing mode. The administrator checks the SELinux context of the /var/www/custom directory and sees 'unconfined_u:object_r:default_t:s0'. What should the administrator do to resolve the issue without disabling SELinux?

Accepted Answer

Use semanage fcontext to set the SELinux type to httpd_sys_content_t and run restorecon. The SELinux type 'default_t' prevents httpd from reading the files. The correct approach is to change the context type to 'httpd_sys_content_t' persistently using semanage fcontext and then apply it with restorecon. Using chcon is temporary and will not survive a file system relabel.

Answer

Set SELinux to permissive mode

Answer

Use chcon to set the SELinux type to httpd_sys_content_t

Answer

Add the apache user to the group that owns the directory

Question 10

A Red Hat Enterprise Linux 9 system is configured as a router between an internal network (10.0.1.0/24) and a DMZ network (10.0.2.0/24). IP forwarding is enabled, and firewalld is active. The internal interface (eth0) is assigned to the 'internal' firewall zone, and the DMZ interface (eth1) is assigned to the 'dmz' zone. The requirement is that hosts on the internal network should be able to initiate connections to hosts in the DMZ, but the DMZ should not be able to initiate connections to the internal network. The administrator finds that traffic from internal to DMZ is being blocked. The internal zone has 'masquerade' enabled, and the dmz zone has no special settings. What is the most likely cause of the blocked traffic?

Accepted Answer

The internal zone is missing a rule to allow forwarded traffic to the DMZ. The internal zone lacks a forwarding rule (or policy) that permits traffic to be forwarded to the dmz zone. firewalld blocks inter-zone forwarding by default unless explicitly allowed. Enabling IP forwarding and masquerade does not affect zone-based forward filtering. To allow internal-to-DMZ traffic while blocking DMZ-initiated connections, use a firewalld policy with source=internal, destination=dmz and an accept rule, and include a stateful rule for related/established return traffic.

Answer

The dmz zone should be assigned to the internal interface

Answer

The internal zone has masquerade enabled, which is incorrect for a router

Answer

The dmz zone does not have masquerade enabled

Question 11

A user reports that the Apache web server cannot serve the file /var/www/html/index.html on a RHEL 9 system when SELinux is in enforcing mode. Given the exhibit output, what is the most likely cause?

Accepted Answer

The SELinux context of the file is incorrect for web serving.. The default SELinux context for files served by Apache in /var/www/html is `httpd_sys_content_t`. If the file has a different context (e.g., `unconfined_u:object_r:admin_home_t:s0`), SELinux will deny Apache read access even if standard Linux permissions are permissive. The `ls -Z` output would reveal the mismatch, and `restorecon -v /var/www/html/index.html` would fix it.

Answer

The firewalld service is blocking HTTP traffic on port 80.

Answer

The file is owned by root and Apache cannot read it.

Answer

The file permissions do not allow the apache user to read the file.

Question 12

A systems administrator is managing a RHEL 9 server that hosts a custom web application on Apache. The application writes log files to /var/log/myapp/ and runs as the apache user. The administrator has set the directory permissions to 755 and ownership to apache:apache. SELinux is in enforcing mode. Despite these settings, the application fails to write logs. The audit log contains multiple AVC denials with the message 'avc:  denied  { write } for pid=1234 comm="httpd" name="myapp.log" dev="dm-0" ino=5678 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file'. The administrator has verified that the file exists and that SElinux booleans related to httpd are at their default values. Which of the following steps should the administrator take to resolve the issue while maintaining security?

Accepted Answer

Use audit2allow to generate and install a custom policy module that permits httpd_t to write to files with a specific type (e.g., httpd_log_t).. The AVC denial shows httpd_t is denied write access to a file with type var_log_t. The proper solution is to use audit2allow to generate and install a custom SELinux policy module that allows httpd_t to write to files labeled var_log_t, thereby maintaining security by only permitting the needed access to that specific type.

Answer

Run restorecon -R /var/log/myapp/ to restore the default SELinux context.

Answer

Set the SELinux boolean httpd_unified on to allow httpd_t to write to all types.

Answer

Change the context of the /var/log/myapp/ directory to var_log_t using chcon.

Question 13

A server's firewall is managed by firewalld. The admin adds a rule to allow HTTPS traffic to the public zone, but clients still cannot connect. What is the most likely cause?

Accepted Answer

The rule was added with --permanent but firewall-cmd --reload was not run.. When a rule is added with the `--permanent` flag in firewalld, it is written to the configuration files but not applied to the runtime firewall. Until `firewall-cmd --reload` is executed, the runtime configuration remains unchanged, so the new rule allowing HTTPS traffic is not active. Clients cannot connect because the firewall is still blocking HTTPS based on the old runtime rules.

Answer

The rule must be added as a rich rule, not a simple service.

Answer

The default zone is not set to public.

Answer

firewalld is just a wrapper for iptables, so iptables rules must be cleared.

Question 14

After configuring sudo, a user reports: 'sudo: unable to open /etc/sudoers: Permission denied'. The admin checks the file permissions and sees '-rw-r-----' owned by root:root. What is the most likely cause?

Accepted Answer

The file permissions are too permissive (0640 instead of 0440).. The sudoers file requires strict permissions of 0440 (owner read, group read) to be considered secure by sudo. The current permissions of 0640 (owner read/write, group read) are too permissive, as they grant write access to the owner (root), which violates sudo's security model. When sudo detects that /etc/sudoers has permissions other than 0440, it refuses to open the file and reports 'Permission denied' to prevent potential tampering.

Answer

The file is owned by the wrong user.

Answer

The sudo binary is missing the setuid bit.

Answer

SELinux is blocking access.

Question 15

A server uses firewalld with the default zone set to 'drop'. SSH is allowed only for the 192.168.1.0/24 subnet via a rich rule in the 'internal' zone. After a reboot, SSH connections from that subnet are refused. What is the most likely cause?

Accepted Answer

The network interface is not assigned to the 'internal' zone.. After a reboot, firewalld applies the default zone to all interfaces not explicitly assigned to another zone. Since the rich rule allowing SSH from 192.168.1.0/24 is defined in the 'internal' zone, the network interface must be assigned to that zone for the rule to take effect. If the interface is not assigned (e.g., it remains in the default 'drop' zone), all incoming traffic, including SSH from the allowed subnet, is dropped by default.

Answer

The subnet 192.168.1.0/24 is not a valid source for rich rules.

Answer

The rich rule was not made permanent.

Answer

The SSH service is not enabled in the default zone.