45 of 120 questions · Page 2/2 · Lxp Security topic · Answers revealed
A Linux administrator needs to add a new user named 'jdoe' with a home directory and bash shell. Which command accomplishes this?
Correct: -m creates home directory, -s sets shell.
Why this answer
The useradd command creates a new user, and the -m flag creates the home directory, -s sets the shell. useradd -m -s /bin/bash jdoe is correct.
A Linux administrator needs to configure auditing to monitor changes to the /etc/passwd file. Which auditctl command should be used?
Correct. The -w flag watches a file, -p wa specifies permissions to monitor (write and attribute change), and -k adds a key for filtering. This is the standard auditctl command for file change monitoring.
Why this answer
The correct command is option B. It uses the -w watch syntax to monitor /etc/passwd for write (w) and attribute change (a) permissions, which is the standard and simplest method for auditing changes. Option D is a valid syscall-based alternative but is more complex and not the best answer for this question.
Option A includes read permission, which is unnecessary. Option C monitors unlink and rename syscalls, not direct file modifications.
An administrator is hardening SSH and wants to disable root login and only allow users in the 'sshusers' group. Which two directives should be set in /etc/ssh/sshd_config?
Correct directives.
Why this answer
The directive `PermitRootLogin no` explicitly disallows root login via SSH, and `AllowGroups sshusers` restricts SSH access to only members of the 'sshusers' group. This combination meets both requirements: disabling root login and limiting access to a specific group. The `AllowGroups` directive is group-based, unlike `AllowUsers`, which is user-based.
Exam trap
The trap here is confusing `AllowGroups` with `AllowUsers` — candidates often pick `AllowUsers sshusers` thinking it restricts to the group, but it actually restricts to a user named 'sshusers', not group membership.
How to eliminate wrong answers
Option A is wrong because `DenyRootLogin` is not a valid directive in sshd_config; the correct directive is `PermitRootLogin`. Option B is wrong because `PermitRootLogin prohibit-password` only disables password-based root login but still allows root login via public key authentication, which does not fully disable root login as required. Option D is wrong because `AllowUsers sshusers` would only allow a user literally named 'sshusers', not members of the 'sshusers' group; the correct group-based directive is `AllowGroups`.
Which file contains user password hashes and aging information on a Linux system?
/etc/shadow stores encrypted passwords and aging data.
Why this answer
The /etc/shadow file stores user password hashes along with password aging information, such as the last password change date, minimum and maximum password age, warning period, and inactivity lockout. This file is readable only by root (or privileged processes) to protect the hashed passwords from unauthorized access, unlike /etc/passwd which is world-readable.
Exam trap
The trap here is that candidates often confuse /etc/passwd with /etc/shadow, mistakenly thinking that /etc/passwd still stores password hashes, but modern Linux systems store them only in /etc/shadow for security.
How to eliminate wrong answers
Option B is wrong because /etc/group stores group membership information, not password hashes or aging data. Option C is wrong because /etc/passwd contains user account details (like UID, GID, home directory) and traditionally held password hashes, but on modern Linux systems it uses an 'x' placeholder and defers to /etc/shadow for security. Option D is wrong because /etc/gshadow stores group password hashes and group administrator information, not user password hashes or aging data.
A security policy requires that user passwords must be changed every 60 days, and users should be warned 7 days before expiration. Which two chage commands set these requirements for user 'jsmith'? (Choose TWO.)
Sets maximum password age to 60 days.
Why this answer
chage -M 60 sets max days; chage -W 7 sets warning days.
An administrator notices that a non-root user 'alice' can run commands as root without being in the sudoers file. Which group membership could allow this?
Members of wheel group often have sudo privileges.
Why this answer
On many Linux distributions, membership in the 'wheel' group is a standard mechanism that allows non-root users to execute commands with root privileges via the 'su' command, even if they are not listed in the sudoers file. The 'wheel' group is traditionally used to control access to the 'su' utility, and by default, PAM (Pluggable Authentication Modules) configuration often permits members of the 'wheel' group to switch to the root user without additional sudo configuration.
Exam trap
The trap here is that candidates often focus solely on sudo and the 'sudo' group, overlooking the alternative privilege escalation path through the 'wheel' group and the 'su' command, which is a common misconfiguration in Linux security audits.
How to eliminate wrong answers
Option A is wrong because the 'admin' group is not a standard Linux group for privilege escalation; on some older Ubuntu systems, 'admin' was used for sudo access, but it is not a default mechanism for 'su' and has been replaced by the 'sudo' group. Option C is wrong because the 'root' group is the primary group of the root user itself, and membership in it does not grant a non-root user the ability to run commands as root; it only provides group-level file access permissions. Option D is wrong because the 'sudo' group is used to grant sudo privileges via the sudoers file, but the question specifies that the user is NOT in the sudoers file, so membership in the 'sudo' group alone would not allow root command execution without a corresponding sudoers entry.
A Linux server has SELinux enforcing and a custom application needs to write to /var/log/app.log. The audit log shows 'avc: denied { write } for pid=1234'. After verifying that the application runs in the correct domain, which command should be used to allow the write access by generating a policy module?
Correct: ausearch retrieves AVC messages, audit2allow creates policy module.
Why this answer
audit2allow reads audit messages and generates SELinux policy allow rules. ausearch can retrieve the specific denial, then audit2allow creates the module.
Which command displays the last successful login times for all users?
Correct.
Why this answer
lastlog displays the last login for each user.
A security policy requires that users cannot reuse any of their last 5 passwords. Which PAM module and configuration directive enforces this?
Correct. pam_pwhistory with remember=N prevents reuse of last N passwords.
Why this answer
The pam_pwhistory module with the remember directive tracks password history and prevents reuse. pam_pwquality enforces complexity, pam_faillock handles lockout, and pam_tally2 is an older lockout module.
An administrator needs to ensure that only users from the 'ops' group can SSH into a server. Which configuration in /etc/ssh/sshd_config accomplishes this?
Correct: AllowGroups restricts by group membership.
Why this answer
The `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH access to only users who are members of the specified group. By setting `AllowGroups ops`, only users belonging to the 'ops' group will be permitted to log in via SSH, which directly meets the requirement.
Exam trap
The trap here is confusing `AllowUsers` (which matches usernames) with `AllowGroups` (which matches group membership), leading candidates to select option C when the requirement specifies group-based restriction.
How to eliminate wrong answers
Option B is wrong because `Match Group ops DenyUsers *` would deny all users (including those in 'ops') when the group matches, effectively blocking everyone. Option C is wrong because `AllowUsers ops` restricts access to a user named 'ops', not to members of the 'ops' group. Option D is wrong because `DenyUsers all` is invalid syntax (the correct directive is `DenyUsers` followed by specific usernames, not the keyword 'all'), and it would not achieve group-based restriction.
An administrator notices that a custom application uses port 8443/TCP. To allow external access, which firewalld command permanently opens this port in the default zone?
Correct. Opens port 8443/tcp permanently.
An administrator needs to allow incoming TCP traffic on port 8443 using firewalld. Which command should be used to make this change persistent?
Adds port persistently and reloads to apply.
An administrator wants to view the current SELinux mode on a system. Which command displays whether SELinux is enforcing, permissive, or disabled?
getenforce returns Enforcing, Permissive, or Disabled.
Why this answer
The `getenforce` command directly displays the current SELinux mode as either 'Enforcing', 'Permissive', or 'Disabled'. It reads the enforcing status from the kernel's SELinux state and outputs the mode in a simple, single-word format, making it the correct choice for this task.
Exam trap
The trap here is that candidates often confuse `sestatus` (which shows the mode among many details) with `getenforce` (which is the dedicated command for just the mode), leading them to choose the more familiar but less precise option.
How to eliminate wrong answers
Option A is wrong because `seinfo` is used to query SELinux policy components (such as types, roles, and users) and does not display the current enforcement mode. Option B is wrong because `sestatus` provides a detailed status report of SELinux, including the current mode, but the question specifically asks for a command that displays whether SELinux is enforcing, permissive, or disabled; while `sestatus` can show this, it is not the most direct command for just the mode, and `getenforce` is the standard utility for that single piece of information. Option D is wrong because `getsebool -a` lists all SELinux boolean values and their current state, not the enforcement mode.
A system administrator wants to enforce a password policy requiring a minimum length of 12 characters, at least one uppercase letter, and one digit. Which PAM module should be configured?
pam_pwquality enforces password complexity rules.
Why this answer
pam_pwquality is the correct PAM module because it is specifically designed to enforce password complexity requirements, such as minimum length, uppercase letters, and digits, through configurable parameters like minlen, ucredit, and dcredit. It replaces the older pam_cracklib and is the standard module for password quality checks on modern Linux systems.
Exam trap
The trap here is that candidates confuse pam_unix (which handles authentication and password aging) with pam_pwquality (which enforces complexity), because both are commonly used together in password policies but serve distinct roles.
How to eliminate wrong answers
Option B (pam_unix) is wrong because it handles traditional Unix authentication (password hashing and verification) but does not enforce complexity rules like length or character classes. Option C (pam_faillock) is wrong because it is used for account lockout after failed login attempts, not for password composition policies. Option D (pam_tally2) is wrong because it also manages login failure counting and account locking, not password quality enforcement.
A security audit reveals that user accounts remain active after employees leave the company. Which TWO commands should be used to disable an account immediately?
Correct. usermod -e 1 sets the account to expire on January 1, 1970, immediately disabling all login methods.
Why this answer
To disable an account immediately, `usermod -e 1 username` (option B) sets the account expiration date to January 1, 1970, which immediately expires the account and prevents all login methods. `usermod -L username` (option C) locks the user's password, preventing password-based authentication. Both commands together provide immediate disablement covering all authentication paths. Option D also locks the password but is redundant with C; the question asks for two commands, so B and C are the most appropriate.
Option A sets expiration to 0 days after epoch, which may not disable immediately. Option E deletes the account, which is not the same as disabling.
Exam trap
The trap is that candidates may think locking and expiring are equivalent, but expiring disables all login methods while locking only disables password logins. The question asks for two commands to disable immediately, so the best pair is usermod -e for full expiration and usermod -L for password lock.
A Linux administrator is troubleshooting a firewall issue using nftables. The ruleset is complex. Which two commands are useful for listing the current ruleset and adding a new rule? (Choose TWO.)
Lists all current rules.
Why this answer
`nft list ruleset` is the standard command to display the entire current nftables ruleset in a human-readable format, which is essential for troubleshooting complex firewall configurations. Option C is correct because `nft add rule inet filter input tcp dport 443 accept` is the proper syntax to append a new rule to the specified chain (here, the 'input' chain of the 'filter' table in the 'inet' family) that accepts TCP traffic on port 443.
Exam trap
The trap here is that candidates may confuse `nft show ruleset` (invalid) with `nft list ruleset` (valid), or think that `nft insert rule` is used for listing rules instead of adding them at a specific position.
An administrator needs to view all current nftables rules. Which command should be used?
This command shows all rulesets.
Why this answer
nft list ruleset displays the entire ruleset. nft list table only shows a specific table.
An administrator is configuring iptables on a server. The requirements are: allow incoming SSH (port 22) from the 192.168.1.0/24 network, drop all other incoming traffic, and allow all outgoing traffic. Which three iptables rules achieve this? (Choose THREE.)
Allows SSH from subnet.
Why this answer
Default policies: INPUT DROP, OUTPUT ACCEPT. Then allow SSH from subnet.
A security auditor notices that users can set weak passwords on a Linux system. The administrator wants to enforce password complexity requiring a minimum of 12 characters, at least one uppercase letter, and at least one digit. Which PAM module should be configured in /etc/pam.d/common-password?
pam_pwquality enforces password complexity rules.
Why this answer
pam_pwquality provides password strength checking with parameters like minlen, ucredit, dcredit. The other modules do not handle complexity.
An administrator wants to set an SELinux boolean that allows Apache to connect to databases. After setting the boolean, which option ensures the change persists across reboots?
-P makes it persistent.
Why this answer
setsebool -P makes the change permanent. Without -P, it only lasts until reboot.
Which command displays the current SELinux mode?
Displays the current SELinux mode.
Why this answer
The `getenforce` command displays the current SELinux mode as either Enforcing, Permissive, or Disabled. It reads the enforcing status directly from the kernel, making it the correct choice for checking the runtime mode.
Exam trap
The trap here is that candidates confuse `sestatus` (which also shows the mode) with `getenforce`, but the exam expects the command specifically designed to output only the mode, and `setenforce` is often mistakenly chosen because it sounds like it 'gets' the enforce status.
How to eliminate wrong answers
Option A is wrong because `sestatus` displays comprehensive SELinux status information including the current mode, policy version, and loaded policy, but it is not the command that solely displays the mode; however, the question asks for the command that displays the current SELinux mode, and `sestatus` does show it, but `getenforce` is the more direct and standard command for this purpose. Option B is wrong because `setenforce` is used to change the SELinux mode (e.g., `setenforce 0` for Permissive, `setenforce 1` for Enforcing), not to display it. Option C is wrong because `selinuxenabled` is a command that returns an exit status indicating whether SELinux is enabled (0 if enabled, 1 if not), but it does not display the current mode.
An administrator needs to generate a self-signed certificate valid for 365 days with a 2048-bit RSA key. Which OpenSSL command correctly creates both the private key and certificate in one step?
Single command that generates both key and self-signed certificate.
Why this answer
The 'req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes' generates a self-signed certificate with a key. Other commands either miss -x509, -newkey, or use wrong options.
An administrator wants to allow the user 'ops' to run only the command '/usr/bin/systemctl restart httpd' via sudo on a specific host 'webserver'. Which /etc/sudoers entry is correct?
This restricts to host webserver and runs as root.
Why this answer
The format is: username hostname=(runas) command. For host-specific, use the hostname. The correct entry is 'ops webserver=(root) /usr/bin/systemctl restart httpd'.
Which file contains the hashed passwords and password aging information for user accounts?
Contains encrypted passwords and aging data.
Why this answer
/etc/shadow stores password hashes and aging fields.
A Linux engineer needs to harden SSH access. Which TWO of the following settings should be configured in /etc/ssh/sshd_config to enhance security? (Select TWO.)
Disables password logins, reducing risk of brute force.
Why this answer
Disabling password authentication forces the use of SSH keys, which are resistant to brute-force attacks and credential stuffing. This setting eliminates the risk of weak or reused passwords being exploited, a fundamental hardening step for SSH access.
Exam trap
The trap here is that candidates often confuse 'hardening' with 'increasing limits' (like MaxAuthTries) or 'enabling convenience' (like PermitRootLogin yes), when the correct hardening choices actually restrict or disable weaker authentication methods.
A Linux administrator needs to configure sudo access for members of the 'wheel' group to run any command. Which two steps are required? (Choose TWO.)
Grants sudo access to wheel group members.
Why this answer
The line '%wheel ALL=(ALL) ALL' in /etc/sudoers grants all members of the 'wheel' group permission to execute any command as any user. This line must be uncommented using visudo, which locks the file to prevent concurrent edits and performs syntax validation before saving. Option D is correct because users must be added to the 'wheel' group using 'usermod -aG wheel username' for the sudoers rule to apply to them.
Exam trap
The trap here is that candidates confuse the setuid bit on sudo (which is already set) with a configuration step, or think that editing SSH config or running syntax checks alone grants sudo access, when in fact both the sudoers rule and group membership are required.
A system administrator wants to monitor changes to the /etc/passwd file using auditd. Which auditctl command sets up a watch on this file?
This is correct. It creates a syscall-based audit rule that triggers on any syscall accessing /etc/passwd with write or attribute change permissions, which effectively monitors changes.
Why this answer
The correct command is `auditctl -a always,exit -F path=/etc/passwd -F perm=wa`. This creates a syscall-based audit rule that triggers on every syscall that accesses /etc/passwd with write (w) or attribute change (a) permissions, effectively monitoring any changes to the file. Option D uses `-w` for a file watch but with `-p rwxa`, which monitors reads and executes as well—not just changes—making it less precise for monitoring changes only.
An administrator needs to generate a self-signed certificate and private key for an internal web server. Which OpenSSL command creates both in one step?
Correct: -x509 for self-signed, -newkey generates key, -keyout and -out output files.
Why this answer
The `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes` command generates a new RSA private key and a self-signed X.509 certificate in a single step. The `-x509` flag outputs a self-signed certificate instead of a CSR, `-newkey` creates the key pair, and `-nodes` prevents encryption of the private key, which is typical for an internal web server that must start without manual passphrase entry.
Exam trap
The trap here is that candidates may think Option B is correct because it technically works, but the question explicitly asks for a command that creates both 'in one step', meaning a single OpenSSL command, not a shell pipeline of two separate commands.
How to eliminate wrong answers
Option A is wrong because `openssl ca` is used to sign a certificate request (CSR) with a CA certificate, not to generate a self-signed certificate and private key together; it requires an existing CA setup and a pre-generated CSR. Option B is wrong because while it does produce a self-signed certificate and key, it uses two separate commands (`genrsa` then `req`) chained with `&&`, which is not a single OpenSSL command as the question asks for 'one step'. Option D is wrong because `openssl x509 -req` signs a CSR using an existing key (`-signkey`), but it does not generate a new private key; it requires a pre-existing CSR and key file, so it cannot create both in one step.
An administrator configures /etc/ssh/sshd_config with the following settings: PermitRootLogin no, PasswordAuthentication no, AllowUsers alice bob, MaxAuthTries 2. After restarting sshd, which of the following is true?
Correct. Password authentication is disabled, but public key is allowed, and bob is in AllowUsers.
Why this answer
PasswordAuthentication no disables password logins, so public key authentication is required. PermitRootLogin no prevents root login entirely. AllowUsers restricts to alice and bob only.
MaxAuthTries 2 limits authentication attempts. So root cannot log in even with keys, and alice/bob must use keys.
An administrator wants to audit all attempts to access the file /etc/shadow. Which auditctl command should be used?
Correct because `-w /etc/shadow -p rwxa` watches the file for all access types (read, write, execute, attribute change), auditing every attempt to access the file.
Why this answer
`auditctl -w /etc/shadow -p rwxa -k shadow` sets a watch on the file for all access types: read (r), write (w), execute (x), and attribute change (a). This captures all attempts to access the file, including reads, which matches the requirement. Option C uses `-F perm=wa`, which only logs write and attribute changes, excluding reads.
Option A has invalid syntax (`-A` instead of `-a`). Option D uses `ausearch`, which is for searching audit logs, not setting rules.
Exam trap
The trap is that candidates may think the `-a always,exit` syntax is always required, but the `-w` watch syntax with `-p rwxa` is a valid and simpler way to audit all access attempts. Some may also incorrectly believe that reads should not be logged, but the question explicitly asks for 'all attempts to access'.
How to eliminate wrong answers
Option A is wrong because `-A` is not a valid auditctl flag; the correct flag for appending a rule is `-a`, and the syntax `-A exit,always` is invalid and would cause an error. Option B is wrong because `-w /etc/shadow -p rwxa -k shadow` uses the watch flag `-w` with permissions `rwxa` (read, write, execute, attribute change), which audits all access types including read, but the question specifically asks to audit 'all attempts to access' the file, and while this might seem correct, the watch-based syntax is less precise for system call auditing and does not use the recommended `-a` approach for exit-based rules; more importantly, `-p rwxa` includes read (`r`), which is not necessary for auditing access attempts that modify the file, and the watch mode does not integrate as cleanly with the audit subsystem for exit-based filtering. Option D is wrong because `ausearch` is a search tool for querying audit logs, not a command to add audit rules; it cannot be used to configure auditing.
An administrator wants to allow user 'jane' to run all commands as root via sudo without a password. Which line should be added to /etc/sudoers?
Correct syntax for passwordless sudo.
Why this answer
The format is 'username ALL=(ALL) NOPASSWD: ALL'. The other options either require a password, use incorrect syntax, or include unnecessary aliases.
SELinux is currently in enforcing mode. A service is being blocked by SELinux. Which command can analyze the audit log and suggest the minimum policy changes to allow the service?
audit2allow creates policy from audit denials.
Why this answer
audit2allow reads audit messages and generates policy modules to allow the denied actions.
Which log file typically records authentication failures and successes on a Debian-based system?
Records authentication logs on Debian.
Why this answer
On Debian/Ubuntu, /var/log/auth.log records authentication events. On RHEL/CentOS, it's /var/log/secure.
Which command displays the current SELinux mode?
sestatus shows SELinux status including mode.
Why this answer
The 'sestatus' command displays the current SELinux mode, including whether it is enforcing, permissive, or disabled, along with other SELinux status information.
A technician needs to create a self-signed certificate and private key for a web server. Which OpenSSL command should be used?
This command creates a self-signed certificate valid for 365 days.
Why this answer
The `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes` command generates a new RSA 2048-bit private key and immediately creates a self-signed X.509 certificate in a single step. The `-x509` flag tells OpenSSL to output a self-signed certificate instead of a certificate signing request (CSR), and `-nodes` ensures the private key is not encrypted with a passphrase, which is typical for a web server that must start without manual intervention.
Exam trap
The trap here is that candidates often confuse the `req -new` command (which creates a CSR) with the `req -x509` command (which creates a self-signed certificate), leading them to choose Option A, which only produces a CSR, not a usable certificate for a web server.
How to eliminate wrong answers
Option A is wrong because it first generates a private key with `genrsa` and then creates a CSR (`req -new`), not a self-signed certificate; the output file `cert.pem` would be a CSR, not a certificate. Option B is wrong because `openssl x509 -req` signs a CSR using a CA private key, but it requires an existing CSR (`req.pem`) and an existing signing key (`key.pem`); it does not create a self-signed certificate from scratch. Option D is wrong because `openssl ca` is used to sign a CSR with a configured CA infrastructure (requires a CA database and configuration), not to create a self-signed certificate directly.
An administrator is configuring AppArmor for a custom application. Which THREE commands are used to manage AppArmor profiles?
Shows status of AppArmor profiles.
Why this answer
aa-status displays the status of AppArmor profiles. aa-complain sets a profile to complain mode (logs violations but does not enforce). aa-enforce sets a profile to enforce mode.
A security audit reveals that the system's PAM configuration does not enforce password complexity. Which PAM module and configuration line should be added to /etc/pam.d/common-password to require at least one uppercase letter, one digit, and a minimum length of 12 characters?
Correct. pam_pwquality with requisite enforces the rules.
Why this answer
pam_pwquality is the module for password complexity. The options ucredit=-1, dcredit=-1, minlen=12 enforce the requirements. pam_unix handles password hashing, pam_faillock handles lockout, and pam_cracklib is an older module (deprecated in favor of pam_pwquality).
Which THREE are valid SELinux modes?
Permissive mode logs violations but does not enforce.
Why this answer
SELinux has three modes: enforcing (policy enforced), permissive (only logs violations), and disabled (SELinux turned off).
A security analyst is investigating a potential breach and needs to examine user login history. Which THREE commands or log files provide information about user logins? (Select THREE.)
Shows user login history.
Why this answer
The `last` command reads the /var/log/wtmp file to display a list of all user logins and logouts since that file was created, showing timestamps and source IPs. This makes it a primary tool for investigating login history during a breach.
Exam trap
The trap here is that candidates often confuse general system logs like /var/log/syslog or /var/log/messages with dedicated authentication logs, but these files lack the structured login/out records that commands like last, lastlog, and lastb specifically parse.
A Linux administrator is hardening an SSH server. Which two of the following settings should be applied to /etc/ssh/sshd_config to improve security?
Disables root SSH login, reducing attack surface.
Why this answer
PermitRootLogin no prevents root login; PasswordAuthentication no forces key-based authentication. Changing the port and enabling X11 forwarding are not necessarily hardening.
An administrator wants to ensure that only users in the 'wheel' group can use the sudo command. Which directive in /etc/sudoers enables this?
This allows all members of the wheel group to run any command as any user.
Why this answer
%wheel ALL=(ALL) ALL grants sudo access to all members of the wheel group.
A Linux security administrator needs to generate a self-signed certificate for a web server. They want to create a private key and a certificate signing request (CSR) in one step. Which OpenSSL command should be used?
This creates a new private key and CSR.
Why this answer
The 'req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.pem' command generates a new private key and CSR. The other options either generate a self-signed certificate directly or are incomplete.
An administrator needs to configure SELinux to allow the Apache HTTP server to connect to a database server. Which SELinux boolean should be enabled?
This boolean specifically allows Apache to connect to database servers.
Why this answer
The SELinux boolean `httpd_can_network_connect_db` specifically allows the Apache HTTP server to make outbound TCP connections to database servers (e.g., MySQL, PostgreSQL). This is required when a web application needs to query a remote database. The other booleans control different aspects of httpd's behavior and do not grant network connectivity to databases.
Exam trap
A common pitfall in SELinux configuration is confusing the general network connect boolean (`httpd_can_network_connect`) with the database-specific boolean (`httpd_can_network_connect_db`). In this scenario, the database-targeted boolean is required.
How to eliminate wrong answers
Option A is wrong because `httpd_can_network_connect` allows general outbound network connections (e.g., to any TCP port), which is broader than needed and may introduce unnecessary risk; it does not specifically target database connections. Option B is wrong because `httpd_enable_cgi` controls whether httpd can execute CGI scripts, not network connectivity. Option C is wrong because `httpd_use_nfs` allows httpd to access files on NFS mounts, not to connect to a database server over the network.
A Linux engineer needs to restrict resource usage for users in the 'developers' group. Which TWO files or commands can be used to set ulimit values?
This file specifies limits for users and groups.
Why this answer
/etc/security/limits.conf is the standard configuration file used by the pam_limits.so PAM module to set per-user or per-group resource limits (ulimits) such as max number of open files, max processes, etc. This file allows system administrators to define hard and soft limits persistently across logins for users or groups, including the 'developers' group.
Exam trap
The trap here is that candidates often confuse the configuration file (/etc/security/limits.conf) with the PAM module file (/etc/pam.d/login) or think the ulimit command alone can set persistent limits for a group, when in fact ulimit only affects the current shell session and is not persistent across logins for all group members.
A system administrator needs to monitor file access attempts to /etc/shadow using auditd. Which auditctl command sets up the watch?
Correct use of -w to watch file with write and attribute permissions.
Why this answer
The correct syntax is 'auditctl -w /etc/shadow -p wa -k shadow_watch'. The -w specifies the file, -p wa watches for write and attribute changes (access is implied), but the -k is for a key. The other options have incorrect flags or order.
Ready to test yourself?
Try a timed practice session using only Lxp Security questions.