Security

Which TWO commands can be used to lock a user account? (Choose two.)

A security administrator is reviewing file permissions on a Linux system. They want to ensure that the /etc/shadow file is only readable by the root user. Which two commands can be used to set the correct permissions?

A file named 'webapp.conf' is being served by Apache but users get a 'Permission denied' error. The SELinux context of the file is 'unconfined_u:object_r:admin_home_t:s0'. What is the most appropriate command to fix the SELinux context?

Which file contains the password aging information such as minimum and maximum days between password changes?

A security analyst needs to see a list of failed login attempts on a Linux system. Which command displays this information from the /var/log/btmp log?

A security policy requires that system logs be rotated weekly and kept for 4 weeks. Which configuration file should be modified to achieve this for /var/log/syslog?

A system administrator needs to ensure that the Apache web server can read files in /var/www/html, which has the SELinux context httpd_sys_content_t. However, Apache is unable to access the files. What command should be used to apply the correct context to the directory and its contents?

An administrator is configuring auditd to monitor changes to the /etc/passwd file. Which three commands are part of the auditd toolset for setting up and reviewing audit rules?

A system administrator wants to limit the number of simultaneous logins for a user to 2. Which file and parameter should be configured?

An administrator is configuring a firewall using iptables to block all incoming traffic except SSH on port 22. Which three rules correctly implement this? (Choose THREE.)

A user reports they cannot log in after three failed password attempts. The system uses PAM with pam_faillock. Which command can the administrator use to view the number of failed attempts for the user?

A file on an SELinux-enabled system has the security context 'unconfined_u:object_r:httpd_sys_content_t:s0'. A web server needs to read it, but it is being denied. Which command changes the context to allow access?

A security analyst notices repeated failed login attempts on a Linux server. They want to lock the account after 3 failed attempts using PAM. Which PAM module should be configured in /etc/pam.d/sshd or /etc/pam.d/system-auth?

A security audit reveals that a Linux system allows password-based SSH logins and has weak password policies. Which THREE actions should the administrator take to improve security? (Choose three.)

A server running nftables has a rule set that allows incoming SSH from the management network (192.168.1.0/24). An administrator needs to insert a rule to drop SSH from all other sources. Which nft command accomplishes this? Assume the input chain is 'input' and the table is 'inet filter'.

An administrator needs to harden SSH access. Which TWO settings in /etc/ssh/sshd_config are recommended to improve security? (Choose two.)

A Linux administrator needs to add a new user named 'jdoe' with a home directory and a bash shell. Which command accomplishes this?

An administrator needs to prevent a specific user 'bob' from logging in via SSH while allowing other users. Which configuration directive should be added to /etc/ssh/sshd_config?

Which THREE of the following commands are used to manage iptables rules? (Select THREE.)

An administrator wants to restrict SSH access to only users in the 'sshusers' group. Which configuration directive should be added to /etc/ssh/sshd_config?

An administrator is configuring sudo access for a group of developers. They should be able to run any command as root, but only after authenticating with their own password. Which TWO configuration lines in /etc/sudoers would achieve this? (Select TWO.)

A security auditor notices that a service account's password never expires. The company policy requires password rotation every 60 days. Which command will enforce this policy for the service account?

An AppArmor profile for a web server is in complain mode. After testing, the administrator wants to enforce the profile. Which command accomplishes this?

A Linux administrator needs to ensure that user passwords expire after 90 days. Which command should be used to enforce this policy?

Which command displays the current SELinux mode?

A security administrator is reviewing SSH configuration. Which TWO settings enhance security by limiting authentication attempts and preventing password-based logins? (Choose two.)

A firewall administrator wants to add a rule to allow incoming SSH traffic (port 22) using firewalld. Which command correctly adds this rule to the default zone permanently?

A security team wants to restrict SSH access to only users in the 'sshusers' group. Which configuration line in /etc/ssh/sshd_config achieves this?

A Linux administrator wants to prevent users from reusing their last five passwords. Which PAM module should be configured?

A system administrator is configuring firewalld on a Linux server. They want to allow incoming HTTPS traffic permanently for the public zone. Which command should be used?

An administrator is configuring log rotation for /var/log/auth.log. They want logs to be rotated weekly, compressed, and kept for 12 weeks. Which logrotate configuration directive achieves this?

After modifying a PAM configuration file for sshd, a user reports they cannot log in. Which command can be used to verify the syntax of the PAM configuration without affecting running services?

A technician needs to generate a self-signed certificate for an internal web server. Which OpenSSL command creates a new private key and a certificate signing request (CSR) in one step?

After configuring AppArmor, an administrator wants to verify the status of all profiles and switch a profile from complain to enforce mode. Which TWO commands are appropriate? (Choose two.)

A security audit reveals that users can change their password without meeting complexity requirements. Which PAM module should be configured to enforce password complexity?

A security analyst wants to ensure that users cannot change their password more than once every 7 days. Which command and option should be used to enforce this policy for user 'jsmith'?

An administrator wants to force a password change for user 'alice' on next login. Which command is appropriate?

A Linux administrator wants to monitor changes to the /etc/passwd file for security auditing. Which auditctl command should be used?

A Linux administrator needs to implement password complexity rules requiring at least one uppercase letter, one digit, and a minimum length of 10 characters. Which two PAM configuration entries would be used? (Choose TWO.)

To limit the number of processes a user can create, which file should be configured?

Which command displays the current SELinux mode?

A system administrator needs to configure sudo so that members of the 'wheel' group can execute any command without a password. Which line should be added to /etc/sudoers (using visudo)?

A security audit reveals that an SELinux boolean 'httpd_can_network_connect' is currently off, but a web application requires Apache to connect to a database server. Which command should the administrator use to enable this boolean persistently?

Which command displays the current SELinux mode (e.g., enforcing, permissive, disabled)?

Which command can be used to generate an SSH key pair for user authentication?

A Linux administrator needs to configure a firewall to allow incoming SSH connections on the default port. Which firewalld command accomplishes this permanently?

A user reports being unable to log in because the password is locked. The administrator needs to unlock the account. Which command should be used?

A system administrator needs to configure PAM to lock a user account after 5 failed login attempts for 15 minutes. Which two PAM modules and configuration lines are appropriate? (Select TWO.)

Which of the following correctly describes the purpose of the /etc/shadow file?

An administrator wants to enforce an account lockout policy after five failed login attempts on a Linux system. Which PAM module should be added to the authentication stack?

A system administrator configures PAM to enforce account lockout after 3 failed login attempts. Which PAM module should be used?

A security policy requires that all users must have passwords with at least one uppercase letter, one digit, and a minimum length of 12 characters. Which PAM configuration file and module should be used to enforce this?

A Linux administrator needs to add a new user named 'jdoe' with a home directory and default shell /bin/bash. Which command should be used?

An administrator notices that a process is running with the context 'unconfined_u:unconfined_r:unconfined_t:s0'. What does this indicate about SELinux?

Which command displays the current SELinux mode?

A system administrator is hardening SSH and needs to disable root login and password authentication. Which two directives should be set in /etc/ssh/sshd_config?

An administrator wants to generate a self-signed certificate and private key for testing. Which command creates both in one step?

A system administrator needs to add an iptables rule to drop incoming TCP traffic on port 22 (SSH) from the IP address 10.0.0.100. Which command should be used?

An administrator notices that an AppArmor profile is in complain mode for a service that should be enforcing. Which command changes the profile to enforce mode?

An administrator is troubleshooting an AppArmor profile that is blocking a custom application. They want to set the profile to complain mode to gather violations without enforcing. Which command should they use?

A security audit has identified that several users have excessive sudo privileges. The administrator needs to review and modify sudo access. Which two files or commands would be used? (Choose TWO.)

To harden SSH, an administrator needs to disable root login over SSH. Which directive should be set in /etc/ssh/sshd_config?

A user named 'jdoe' needs to run commands as root without being given the root password. The administrator wants to grant jdoe the ability to run any command as root, but only after entering their own password. Which entry in /etc/sudoers accomplishes this?

A security audit reveals that a service is running with an incorrect SELinux context. Which two commands can be used to relabel the file or directory to the correct context? (Choose TWO.)

A Linux administrator needs to prevent the root user from logging in via SSH. Which directive should be set in /etc/ssh/sshd_config to accomplish this?

A web server running on port 8080 must be accessible from external networks. The system uses firewalld. Which command opens port 8080/tcp permanently in the default zone?

A security audit reveals that the /etc/shadow file is readable by all users. What is the most appropriate immediate action?

A technician needs to ensure a service can listen on TCP port 8443 using firewalld. Which command permanently adds the port to the default zone?

An administrator runs 'auditctl -w /etc/passwd -p wa -k passwd_changes' to monitor changes to /etc/passwd. Which command should be used to search the audit log for all events related to this watch?

An administrator needs to configure iptables to allow incoming SSH traffic only from the 10.0.0.0/8 network and drop all other incoming traffic except established connections. Which TWO rules are necessary?

A system administrator is configuring PAM to lock out users after 3 failed login attempts for 15 minutes. Which TWO PAM modules can be used together to achieve this? (Select TWO.)

An administrator wants to harden SSH access by implementing the following: disallow root login, disable password authentication, and limit the number of authentication attempts. Which three configuration directives should be set in /etc/ssh/sshd_config? (Choose THREE.)

An administrator notices repeated failed login attempts in /var/log/secure. The company policy requires account lockout after 5 failed attempts within 15 minutes. Which PAM module and configuration can enforce this?

A Linux technician is configuring a firewall with firewalld. The organization requires that SSH services be available only on the internal network zone (10.0.0.0/8). Which command should be used to add this rule permanently?

A system is running SELinux in enforcing mode. A custom application needs to write to /var/log/app.log. The log file shows the correct context, but access is denied. What is the most likely cause?

A Linux administrator needs to add a new user named 'jdoe' with a home directory and bash shell. Which command accomplishes this?

A Linux administrator needs to configure auditing to monitor changes to the /etc/passwd file. Which auditctl command should be used?

An administrator is hardening SSH and wants to disable root login and only allow users in the 'sshusers' group. Which two directives should be set in /etc/ssh/sshd_config?

Which file contains user password hashes and aging information on a Linux system?

A security policy requires that user passwords must be changed every 60 days, and users should be warned 7 days before expiration. Which two chage commands set these requirements for user 'jsmith'? (Choose TWO.)

An administrator notices that a non-root user 'alice' can run commands as root without being in the sudoers file. Which group membership could allow this?

A Linux server has SELinux enforcing and a custom application needs to write to /var/log/app.log. The audit log shows 'avc: denied { write } for pid=1234'. After verifying that the application runs in the correct domain, which command should be used to allow the write access by generating a policy module?

Which command displays the last successful login times for all users?

A security policy requires that users cannot reuse any of their last 5 passwords. Which PAM module and configuration directive enforces this?

An administrator needs to ensure that only users from the 'ops' group can SSH into a server. Which configuration in /etc/ssh/sshd_config accomplishes this?

An administrator notices that a custom application uses port 8443/TCP. To allow external access, which firewalld command permanently opens this port in the default zone?

An administrator needs to allow incoming TCP traffic on port 8443 using firewalld. Which command should be used to make this change persistent?

An administrator wants to view the current SELinux mode on a system. Which command displays whether SELinux is enforcing, permissive, or disabled?

A system administrator wants to enforce a password policy requiring a minimum length of 12 characters, at least one uppercase letter, and one digit. Which PAM module should be configured?

A security audit reveals that user accounts remain active after employees leave the company. Which TWO commands should be used to disable an account immediately?

A Linux administrator is troubleshooting a firewall issue using nftables. The ruleset is complex. Which two commands are useful for listing the current ruleset and adding a new rule? (Choose TWO.)

An administrator needs to view all current nftables rules. Which command should be used?

An administrator is configuring iptables on a server. The requirements are: allow incoming SSH (port 22) from the 192.168.1.0/24 network, drop all other incoming traffic, and allow all outgoing traffic. Which three iptables rules achieve this? (Choose THREE.)

A security auditor notices that users can set weak passwords on a Linux system. The administrator wants to enforce password complexity requiring a minimum of 12 characters, at least one uppercase letter, and at least one digit. Which PAM module should be configured in /etc/pam.d/common-password?

An administrator wants to set an SELinux boolean that allows Apache to connect to databases. After setting the boolean, which option ensures the change persists across reboots?

Which command displays the current SELinux mode?

An administrator needs to generate a self-signed certificate valid for 365 days with a 2048-bit RSA key. Which OpenSSL command correctly creates both the private key and certificate in one step?

An administrator wants to allow the user 'ops' to run only the command '/usr/bin/systemctl restart httpd' via sudo on a specific host 'webserver'. Which /etc/sudoers entry is correct?

Which file contains the hashed passwords and password aging information for user accounts?

A Linux engineer needs to harden SSH access. Which TWO of the following settings should be configured in /etc/ssh/sshd_config to enhance security? (Select TWO.)

A Linux administrator needs to configure sudo access for members of the 'wheel' group to run any command. Which two steps are required? (Choose TWO.)

A system administrator wants to monitor changes to the /etc/passwd file using auditd. Which auditctl command sets up a watch on this file?

An administrator needs to generate a self-signed certificate and private key for an internal web server. Which OpenSSL command creates both in one step?

An administrator configures /etc/ssh/sshd_config with the following settings: PermitRootLogin no, PasswordAuthentication no, AllowUsers alice bob, MaxAuthTries 2. After restarting sshd, which of the following is true?

An administrator wants to audit all attempts to access the file /etc/shadow. Which auditctl command should be used?

An administrator wants to allow user 'jane' to run all commands as root via sudo without a password. Which line should be added to /etc/sudoers?

SELinux is currently in enforcing mode. A service is being blocked by SELinux. Which command can analyze the audit log and suggest the minimum policy changes to allow the service?

Which log file typically records authentication failures and successes on a Debian-based system?

Which command displays the current SELinux mode?

A technician needs to create a self-signed certificate and private key for a web server. Which OpenSSL command should be used?

An administrator is configuring AppArmor for a custom application. Which THREE commands are used to manage AppArmor profiles?

A security audit reveals that the system's PAM configuration does not enforce password complexity. Which PAM module and configuration line should be added to /etc/pam.d/common-password to require at least one uppercase letter, one digit, and a minimum length of 12 characters?

Which THREE are valid SELinux modes?

A security analyst is investigating a potential breach and needs to examine user login history. Which THREE commands or log files provide information about user logins? (Select THREE.)

A Linux administrator is hardening an SSH server. Which two of the following settings should be applied to /etc/ssh/sshd_config to improve security?

An administrator wants to ensure that only users in the 'wheel' group can use the sudo command. Which directive in /etc/sudoers enables this?

A Linux security administrator needs to generate a self-signed certificate for a web server. They want to create a private key and a certificate signing request (CSR) in one step. Which OpenSSL command should be used?

An administrator needs to configure SELinux to allow the Apache HTTP server to connect to a database server. Which SELinux boolean should be enabled?

A Linux engineer needs to restrict resource usage for users in the 'developers' group. Which TWO files or commands can be used to set ulimit values?

A system administrator needs to monitor file access attempts to /etc/shadow using auditd. Which auditctl command sets up the watch?