Security practice questions

A system administrator notices that an unauthorized user gained access to a server via SSH using a compromised user account. Which security measure should be implemented to prevent such attacks in the future?

Trap 1: Disable SSH and use Telnet

Telnet is unencrypted and less secure.

Trap 2: Enforce a complex password policy

Complex passwords reduce brute force risk but do not prevent compromised passwords.

Trap 3: Allow all users to use sudo without passwords

This increases security risk.

A
Configure SSH to use key-based authentication only
Key-based authentication is more secure and prevents password attacks.
B
Disable SSH and use Telnet
Why wrong: Telnet is unencrypted and less secure.
C
Enforce a complex password policy
Why wrong: Complex passwords reduce brute force risk but do not prevent compromised passwords.
D
Allow all users to use sudo without passwords
Why wrong: This increases security risk.

Question 2hardmultiple choice

A Linux administrator needs to ensure that only the root user can run commands in the /usr/local/bin/scripts directory. Which command should be used to set the appropriate permissions?

Trap 1: chmod 750 /usr/local/bin/scripts

Allows group to read and execute.

Trap 2: chmod 755 /usr/local/bin/scripts

Allows group and others to read and execute.

Trap 3: chmod 770 /usr/local/bin/scripts

Allows group to write and execute.

A
chmod 750 /usr/local/bin/scripts
Why wrong: Allows group to read and execute.
B
chmod 700 /usr/local/bin/scripts
Owner (root) gets rwx; group and others have no access.
C
chmod 755 /usr/local/bin/scripts
Why wrong: Allows group and others to read and execute.
D
chmod 770 /usr/local/bin/scripts
Why wrong: Allows group to write and execute.

Question 3easymultiple choice

A security audit reveals that the /etc/shadow file has permissions 777. Which command should be used to correct this vulnerability?

Trap 1: chmod 660 /etc/shadow

Allows group write, which is insecure.

Trap 2: chmod 644 /etc/shadow

Allows world read, which is insecure.

Trap 3: chmod 640 /etc/shadow

Allows group read, which is insecure.

A
chmod 660 /etc/shadow
Why wrong: Allows group write, which is insecure.
B
chmod 600 /etc/shadow
Only root can read/write.
C
chmod 644 /etc/shadow
Why wrong: Allows world read, which is insecure.
D
chmod 640 /etc/shadow
Why wrong: Allows group read, which is insecure.

Question 4mediummultiple choice

A Linux server is configured to allow SSH access for remote administration. The security team wants to limit SSH access to only users in the 'ssh-users' group. Which configuration should be added to /etc/ssh/sshd_config?

Trap 1: AllowUsers ssh-users

AllowUsers expects usernames, not groups.

Trap 2: DenyUsers root

This only denies root.

Trap 3: PermitRootLogin yes

This allows root login.

A
AllowUsers ssh-users
Why wrong: AllowUsers expects usernames, not groups.
B
AllowGroups ssh-users
AllowGroups restricts SSH to group members.
C
DenyUsers root
Why wrong: This only denies root.
D
PermitRootLogin yes
Why wrong: This allows root login.

Question 5hardmultiple choice

A Linux administrator is configuring a firewall using iptables to allow incoming HTTP and HTTPS traffic but block all other incoming traffic. Which set of rules should be applied?

Trap 1: iptables -P INPUT DROP; iptables -A INPUT -p tcp -j ACCEPT

Allows all TCP traffic.

Trap 2: iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j…

Default ACCEPT then DROP rule is redundant and order matters.

Trap 3: iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j…

Default policy ACCEPT allows all traffic.

A
iptables -P INPUT DROP; iptables -A INPUT -p tcp -j ACCEPT
Why wrong: Allows all TCP traffic.
B
iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -j DROP
Why wrong: Default ACCEPT then DROP rule is redundant and order matters.
C
iptables -P INPUT DROP; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT
Default DROP blocks all; allow only HTTP/HTTPS.
D
iptables -P INPUT ACCEPT; iptables -A INPUT -p tcp --dport 80 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT
Why wrong: Default policy ACCEPT allows all traffic.

Question 6mediummulti select

A Linux administrator is hardening a server. Which TWO actions are effective in preventing unauthorized access via SSH? (Select TWO.)

Trap 1: Set PermitRootLogin yes

Allows root login.

Trap 2: Set PasswordAuthentication yes

Allows password authentication.

Trap 3: Disable the SSH service

Prevents all SSH access, which may be too restrictive.

A
Set PermitRootLogin yes
Why wrong: Allows root login.
B
Set PasswordAuthentication yes
Why wrong: Allows password authentication.
C
Disable the SSH service
Why wrong: Prevents all SSH access, which may be too restrictive.
D
Set PermitRootLogin no in /etc/ssh/sshd_config
Prevents direct root login.
E
Set PasswordAuthentication no and use SSH keys
Eliminates password-based attacks.

Question 7hardmulti select

A security audit identified that the /tmp directory is world-writable. Which THREE steps should be taken to secure /tmp on a Linux system? (Select THREE.)

Trap 1: Remove world-writable permission from /tmp

Many applications require world-writable /tmp.

Trap 2: Mount /tmp with the exec option

Allows execution, which is insecure.

A
Set the sticky bit on /tmp
Prevents users from deleting others' files.
B
Remove world-writable permission from /tmp
Why wrong: Many applications require world-writable /tmp.
C
Mount /tmp with the nosuid option
Prevents setuid programs from running.
D
Mount /tmp with the noexec option
Prevents execution of binaries from /tmp.
E
Mount /tmp with the exec option
Why wrong: Allows execution, which is insecure.

Question 8mediummultiple choice

Refer to the exhibit. The system administrator runs the command 'auditctl -l' and sees the above rules. What is the purpose of these audit rules?

Exhibit

Refer to the exhibit.

# auditctl -l
-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes
-w /etc/group -p wa -k group_changes

Trap 1: To log all successful login attempts on the system

Trap 2: To log any modifications to the audit configuration itself

These rules do not monitor the audit configuration.

Trap 3: To log all read accesses to /etc/passwd, /etc/shadow, and /etc/group

The -p wa only logs write and attribute changes.

A
To log any changes (write or attribute) to the password, shadow, and group files
The -p wa flag is for write and attribute changes.
B
To log all successful login attempts on the system
Why wrong: Login attempts are not related to these files.
C
To log any modifications to the audit configuration itself
Why wrong: These rules do not monitor the audit configuration.
D
To log all read accesses to /etc/passwd, /etc/shadow, and /etc/group
Why wrong: The -p wa only logs write and attribute changes.

Question 9hardmultiple choice

Refer to the exhibit. Alice is the owner of file.txt. Bob is a member of the staff group. What permissions does Bob have on file.txt?

Exhibit

Refer to the exhibit.

$ getfacl file.txt
# file: file.txt
# owner: alice
# group: staff
user::rw-
user:bob:r--
group::r--
mask::rw-
other::---

Trap 1: Read and write

Bob's ACL entry only grants read.

Trap 2: No access

Bob has read access via ACL.

Trap 3: Write only

Bob does not have write permission.

A
Read only
The ACL entry 'user:bob:r--' gives read permission.
B
Read and write
Why wrong: Bob's ACL entry only grants read.
C
No access
Why wrong: Bob has read access via ACL.
D
Write only
Why wrong: Bob does not have write permission.

Question 10easymultiple choice

A system administrator needs to restrict SSH access to a Linux server to only users in the 'sshusers' group. Which configuration change achieves this?

Trap 1: Add 'DenyUsers *' to /etc/ssh/sshd_config

DenyUsers * would block all users, not restrict to a group.

Trap 2: Set 'PermitRootLogin no' in /etc/ssh/sshd_config

This only disables root login, not group-based access.

Trap 3: Add 'AllowUsers sshusers' to /etc/ssh/sshd_config

AllowUsers expects usernames, not group names.

A
Add 'DenyUsers *' to /etc/ssh/sshd_config
Why wrong: DenyUsers * would block all users, not restrict to a group.
B
Set 'PermitRootLogin no' in /etc/ssh/sshd_config
Why wrong: This only disables root login, not group-based access.
C
Add 'AllowGroups sshusers' to /etc/ssh/sshd_config
AllowGroups restricts SSH access to members of the specified group.
D
Add 'AllowUsers sshusers' to /etc/ssh/sshd_config
Why wrong: AllowUsers expects usernames, not group names.

Question 11mediummultiple choice

A security audit reveals that the /var/log directory has permissions 777. The administrator needs to ensure that only root can write to log files, while still allowing users to read system log files. Which command should the administrator run?

Trap 1: chmod 644 /var/log

644 removes execute permission on directory, preventing listing of files.

Trap 2: chmod 700 /var/log

700 denies all access to group and others.

Trap 3: chmod 750 /var/log

750 denies read access to others, so they cannot read log files.

A
chmod 644 /var/log
Why wrong: 644 removes execute permission on directory, preventing listing of files.
B
chmod 755 /var/log
755 gives owner rwx, group and others rx, allowing read and execute but not write.
C
chmod 700 /var/log
Why wrong: 700 denies all access to group and others.
D
chmod 750 /var/log
Why wrong: 750 denies read access to others, so they cannot read log files.

Question 12hardmultiple choice

A company's security policy requires that all user passwords must expire every 90 days. The administrator runs 'chage -M 90 jdoe' for user jdoe. Which additional step ensures that the password expiration policy is enforced for all new users?

Trap 1: Add 'password required pam_unix.so remember=5' to…

This controls password history, not expiration.

Trap 2: Set EXPIRE=90 in /etc/default/useradd

This option does not exist; useradd defaults are different.

Trap 3: Modify /etc/shadow to set max days for each user

This is per-user, not a default for new users.

A
Set PASS_MAX_DAYS 90 in /etc/login.defs
This sets the default maximum password age for new users.
B
Add 'password required pam_unix.so remember=5' to /etc/pam.d/system-auth
Why wrong: This controls password history, not expiration.
C
Set EXPIRE=90 in /etc/default/useradd
Why wrong: This option does not exist; useradd defaults are different.
D
Modify /etc/shadow to set max days for each user
Why wrong: This is per-user, not a default for new users.

Question 13easymultiple choice

A Linux administrator discovers that a user's home directory contains a file with setuid bit set, owned by root. The file is not part of any authorized software. What is the most appropriate immediate action?

Trap 1: Move the file to /tmp for further analysis

Moving does not remove the setuid bit; the risk remains.

Trap 2: Delete the file immediately to remove the threat

Deleting may destroy evidence needed for investigation.

Trap 3: Change the file owner to the user with 'chown user:user <file>'

Changing ownership does not remove the setuid bit; root ownership is required for setuid to be effective.

A
Move the file to /tmp for further analysis
Why wrong: Moving does not remove the setuid bit; the risk remains.
B
Delete the file immediately to remove the threat
Why wrong: Deleting may destroy evidence needed for investigation.
C
Change the file owner to the user with 'chown user:user <file>'
Why wrong: Changing ownership does not remove the setuid bit; root ownership is required for setuid to be effective.
D
Remove the setuid bit with 'chmod u-s <file>'
This removes the setuid bit, preventing privilege escalation, while preserving the file.

Question 14mediummulti select

Which TWO of the following are valid methods to enforce disk quota limits on a Linux filesystem? (Select TWO.)

Trap 1: Using 'setquota' to set limits in a script

setquota sets limits but does not enforce; enforcement requires quotaon.

Trap 2: Running 'repquota' to generate reports

repquota only reports usage, does not enforce.

Trap 3: Running 'quotacheck' to update quota files

quotacheck scans and updates, but does not enforce limits.

A
Using 'edquota' to set soft and hard limits for users
Setting limits with edquota prepares enforcement when quotas are on.
B
Using 'setquota' to set limits in a script
Why wrong: setquota sets limits but does not enforce; enforcement requires quotaon.
C
Running 'repquota' to generate reports
Why wrong: repquota only reports usage, does not enforce.
D
Running 'quotacheck' to update quota files
Why wrong: quotacheck scans and updates, but does not enforce limits.
E
Running 'quotaon' on the filesystem
quotaon activates quota enforcement.

Question 15hardmultiple choice

Scenario: A financial services company runs a critical application on a Linux server that stores sensitive customer data. The server is configured with a firewall (iptables) that only allows SSH (port 22) and HTTPS (port 443) from the internal network (10.0.0.0/8). Recently, the security team detected unauthorized access attempts from an external IP address (203.0.113.5) targeting port 22. The administrator needs to block this specific IP while maintaining current access rules. The existing iptables rules are: - INPUT chain policy ACCEPT - Rule 1: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT - Rule 2: -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT - Rule 3: -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT - Rule 4: -A INPUT -j DROP The administrator wants to block 203.0.113.5 from any access. Which command should be added?

Trap 1: iptables -I INPUT 5 -s 203.0.113.5 -j DROP

Inserting at position 5 is after the final DROP rule; still ineffective.

Trap 2: iptables -A INPUT -s 203.0.113.5 -j DROP

Appending after the final DROP rule is ineffective.

Trap 3: iptables -I INPUT 1 -s 203.0.113.5 -j ACCEPT

This would allow the IP instead of blocking.

A
iptables -I INPUT 1 -s 203.0.113.5 -j DROP
Inserts a DROP rule at the top, blocking the IP before any ACCEPT rules.
B
iptables -I INPUT 5 -s 203.0.113.5 -j DROP
Why wrong: Inserting at position 5 is after the final DROP rule; still ineffective.
C
iptables -A INPUT -s 203.0.113.5 -j DROP
Why wrong: Appending after the final DROP rule is ineffective.
D
iptables -I INPUT 1 -s 203.0.113.5 -j ACCEPT
Why wrong: This would allow the IP instead of blocking.

Question 16mediummultiple choice

Scenario: A cloud hosting company uses SELinux in enforcing mode on all Linux servers. A developer reports that a custom web application running under Apache (httpd) is unable to write log files to /var/log/myapp/. The directory /var/log/myapp/ has permissions 755 and is owned by root:root. The httpd process runs as the 'apache' user. The administrator checks SELinux context: /var/log/myapp is labeled with default_t type. The administrator wants to allow httpd to write to this directory while maintaining security. Which command should the administrator run?

Trap 1: Change ownership with 'chown apache:apache /var/log/myapp'

Ownership change does not affect SELinux policy.

Trap 2: Run 'setenforce 0' to disable SELinux

Disabling SELinux reduces security unnecessarily.

Trap 3: Run 'chcon -t httpd_log_t /var/log/myapp'

chcon makes a temporary change that may be overwritten by restorecon.

A
Change ownership with 'chown apache:apache /var/log/myapp'
Why wrong: Ownership change does not affect SELinux policy.
B
Run 'setenforce 0' to disable SELinux
Why wrong: Disabling SELinux reduces security unnecessarily.
C
Run 'chcon -t httpd_log_t /var/log/myapp'
Why wrong: chcon makes a temporary change that may be overwritten by restorecon.
D
Run 'semanage fcontext -a -t httpd_log_t "/var/log/myapp(/.*)?"' and then 'restorecon -Rv /var/log/myapp'
This permanently sets the context to httpd_log_t, allowing httpd to write.

Question 17mediummultiple choice

A systems administrator needs to restrict SSH access to a Linux server so that only users in the 'sshusers' group can log in. Which configuration change should be made in /etc/ssh/sshd_config?

Trap 1: Add 'AllowUsers sshusers'

AllowUsers restricts by user, not group.

Trap 2: Add 'DenyGroups all'

DenyGroups blocks groups, but does not explicitly allow sshusers.

Trap 3: Add 'PermitRootLogin no' and add users to sshusers

PermitRootLogin controls root access, not group-based access.

A
Add 'AllowUsers sshusers'
Why wrong: AllowUsers restricts by user, not group.
B
Add 'DenyGroups all'
Why wrong: DenyGroups blocks groups, but does not explicitly allow sshusers.
C
Add 'AllowGroups sshusers'
AllowGroups restricts SSH access to members of the specified group.
D
Add 'PermitRootLogin no' and add users to sshusers
Why wrong: PermitRootLogin controls root access, not group-based access.

Question 18hardmulti select

An administrator runs auditctl -l and ausearch -k auth_log -ts today as shown in the exhibit. The administrator expects to see audit events for /var/log/auth.log but gets no matches. Which TWO actions should the administrator take to resolve this issue?

Exhibit

Refer to the exhibit.

# auditctl -l
LIST_RULES: syscall=openat,open,creat,truncate,ftruncate key=file_monitor
-a always,exclude -F msgtype=CRED_DISP
-w /etc/passwd -p wa -k passwd_changes
-w /etc/shadow -p wa -k shadow_changes
-w /etc/group -p wa -k group_changes
-w /var/log/auth.log -p wa -k auth_log

# ausearch -k auth_log -ts today
<no matches>

Trap 1: Change '-p wa' to '-p rwxa' in the rule for /var/log/auth.log

The rule already captures write and append; adding read might be unnecessary and not the cause.

Trap 2: Add '-a always,exit -S all -F path=/var/log/auth.log' to capture…

This would be redundant and not fix the issue of no matches.

Trap 3: Run 'auditctl -R /etc/audit/rules.d/audit.rules' to reload rules

Reloading rules is not necessarily needed if rules are already loaded.

A
Change '-p wa' to '-p rwxa' in the rule for /var/log/auth.log
Why wrong: The rule already captures write and append; adding read might be unnecessary and not the cause.
B
Verify that auditd is running with 'systemctl status auditd'
If auditd is not running, no events are captured.
C
Add '-a always,exit -S all -F path=/var/log/auth.log' to capture all syscalls
Why wrong: This would be redundant and not fix the issue of no matches.
D
Run 'auditctl -R /etc/audit/rules.d/audit.rules' to reload rules
Why wrong: Reloading rules is not necessarily needed if rules are already loaded.
E
Change the key in the ausearch command to match the rule key exactly
The key 'auth_log' is already correctly used; but if the rule was not loaded, ausearch would show no matches.

Question 19easymultiple choice

You are a systems administrator for a small company. The company uses a Linux server running Ubuntu 22.04 LTS that hosts a web application and a PostgreSQL database. The server has two network interfaces: eth0 (public IP) and eth1 (private IP). The web application listens on port 443 (HTTPS) on eth0, and the PostgreSQL database listens on port 5432 on eth1. The company security policy requires that only the web application should be accessible from the internet; all other ports must be blocked on the public interface. Additionally, SSH access should be allowed only from the internal network (192.168.1.0/24). The current iptables rules are as follows:

-P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT

There are no other rules. You need to implement the security policy using iptables. Which of the following sets of commands will achieve the required security policy?

Trap 1: iptables -P INPUT DROP iptables -A INPUT -m state --state…

Allows all traffic on eth1 from anywhere, not just internal, violating policy.

Trap 2: iptables -P INPUT DROP iptables -A INPUT -m state --state…

Allows SSH on eth1 but not on eth0; however, it also allows all traffic on eth0 except HTTPS? Actually it allows only HTTPS on eth0, but SSH is not allowed on eth0, so internal users cannot SSH from internal network via eth0, but they can via eth1. However, the policy requires SSH only from internal network, but it doesn't specify interface; typically SSH should be allowed on any internal interface. This option blocks SSH on eth0, but internal users might need to SSH via eth0 if they are on internal network? The policy says 'SSH access should be allowed only from the internal network (192.168.1.0/24)'. It doesn't specify interface, so SSH should be allowed from that subnet on any interface. Option A allows SSH on eth1 only, but internal users could also come through eth0 if they have internal IP? Actually if internal network is 192.168.1.0/24, it's likely on eth1, so it's fine. However, option C blocks SSH on eth0, which might be unnecessary but not violating policy if internal users only use eth1. But option C also does not allow SSH on eth0, which could be a problem if internal users try to SSH to the public IP from internal network. Typically, you would allow SSH on both interfaces from internal subnet. Option A is more complete. Option C is not the best because it does not allow SSH on eth0 from internal, which might be needed. So A is correct.

Trap 3: iptables -P INPUT DROP iptables -A INPUT -m state --state…

Allows SSH from anywhere, violating policy.

A
iptables -P INPUT DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT iptables -A INPUT -i eth1 -j ACCEPT
This correctly implements the policy.
B
iptables -P INPUT DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -i eth1 -j ACCEPT
Why wrong: Allows all traffic on eth1 from anywhere, not just internal, violating policy.
C
iptables -P INPUT DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -i eth1 -j ACCEPT
Why wrong: Allows SSH on eth1 but not on eth0; however, it also allows all traffic on eth0 except HTTPS? Actually it allows only HTTPS on eth0, but SSH is not allowed on eth0, so internal users cannot SSH from internal network via eth0, but they can via eth1. However, the policy requires SSH only from internal network, but it doesn't specify interface; typically SSH should be allowed on any internal interface. This option blocks SSH on eth0, but internal users might need to SSH via eth0 if they are on internal network? The policy says 'SSH access should be allowed only from the internal network (192.168.1.0/24)'. It doesn't specify interface, so SSH should be allowed from that subnet on any interface. Option A allows SSH on eth1 only, but internal users could also come through eth0 if they have internal IP? Actually if internal network is 192.168.1.0/24, it's likely on eth1, so it's fine. However, option C blocks SSH on eth0, which might be unnecessary but not violating policy if internal users only use eth1. But option C also does not allow SSH on eth0, which could be a problem if internal users try to SSH to the public IP from internal network. Typically, you would allow SSH on both interfaces from internal subnet. Option A is more complete. Option C is not the best because it does not allow SSH on eth0 from internal, which might be needed. So A is correct.
D
iptables -P INPUT DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT iptables -A INPUT -i eth1 -j ACCEPT
Why wrong: Allows SSH from anywhere, violating policy.

Question 20mediumdrag order