CCNA Lxp Security Questions

The useradd command creates a new user, and the -m flag creates the home directory, -s sets the shell. useradd -m -s /bin/bash jdoe is correct.

auditctl -w /etc/passwd -p wa -k passwd_changes adds a watch on the file for write and attribute changes, with a key for easier searching.

Option C is correct because the directive `PermitRootLogin no` explicitly disallows root login via SSH, and `AllowGroups sshusers` restricts SSH access to only members of the 'sshusers' group. This combination meets both requirements: disabling root login and limiting access to a specific group. The `AllowGroups` directive is group-based, unlike `AllowUsers`, which is user-based.

The /etc/shadow file stores user password hashes along with password aging information, such as the last password change date, minimum and maximum password age, warning period, and inactivity lockout. This file is readable only by root (or privileged processes) to protect the hashed passwords from unauthorized access, unlike /etc/passwd which is world-readable.

chage -M 60 sets max days; chage -W 7 sets warning days.

Option B is correct because on many Linux distributions, membership in the 'wheel' group is a standard mechanism that allows non-root users to execute commands with root privileges via the 'su' command, even if they are not listed in the sudoers file. The 'wheel' group is traditionally used to control access to the 'su' utility, and by default, PAM (Pluggable Authentication Modules) configuration often permits members of the 'wheel' group to switch to the root user without additional sudo configuration.

audit2allow reads audit messages and generates SELinux policy allow rules. ausearch can retrieve the specific denial, then audit2allow creates the module.

lastlog displays the last login for each user.

The pam_pwhistory module with the remember directive tracks password history and prevents reuse. pam_pwquality enforces complexity, pam_faillock handles lockout, and pam_tally2 is an older lockout module.

The `AllowGroups` directive in `/etc/ssh/sshd_config` restricts SSH access to only users who are members of the specified group. By setting `AllowGroups ops`, only users belonging to the 'ops' group will be permitted to log in via SSH, which directly meets the requirement.

The correct command is firewall-cmd --permanent --add-port=8443/tcp. The --permanent flag makes it persistent, --add-port opens the port, and the syntax includes protocol. --add-service is for predefined services, not port numbers.

To add a port, use firewall-cmd --add-port=8443/tcp --permanent and then reload.

The `getenforce` command directly displays the current SELinux mode as either 'Enforcing', 'Permissive', or 'Disabled'. It reads the enforcing status from the kernel's SELinux state and outputs the mode in a simple, single-word format, making it the correct choice for this task.

pam_pwquality is the correct PAM module because it is specifically designed to enforce password complexity requirements, such as minimum length, uppercase letters, and digits, through configurable parameters like minlen, ucredit, and dcredit. It replaces the older pam_cracklib and is the standard module for password quality checks on modern Linux systems.

Option B is correct because `nft list ruleset` is the standard command to display the entire current nftables ruleset in a human-readable format, which is essential for troubleshooting complex firewall configurations. Option C is correct because `nft add rule inet filter input tcp dport 443 accept` is the proper syntax to append a new rule to the specified chain (here, the 'input' chain of the 'filter' table in the 'inet' family) that accepts TCP traffic on port 443.

nft list ruleset displays the entire ruleset. nft list table only shows a specific table.

Default policies: INPUT DROP, OUTPUT ACCEPT. Then allow SSH from subnet.

pam_pwquality provides password strength checking with parameters like minlen, ucredit, dcredit. The other modules do not handle complexity.

setsebool -P makes the change permanent. Without -P, it only lasts until reboot.

The `getenforce` command displays the current SELinux mode as either Enforcing, Permissive, or Disabled. It reads the enforcing status directly from the kernel, making it the correct choice for checking the runtime mode.

The 'req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes' generates a self-signed certificate with a key. Other commands either miss -x509, -newkey, or use wrong options.

The format is: username hostname=(runas) command. For host-specific, use the hostname. The correct entry is 'ops webserver=(root) /usr/bin/systemctl restart httpd'.

/etc/shadow stores password hashes and aging fields.

Option B is correct because disabling password authentication forces the use of SSH keys, which are resistant to brute-force attacks and credential stuffing. This setting eliminates the risk of weak or reused passwords being exploited, a fundamental hardening step for SSH access.

Option A is correct because the line '%wheel ALL=(ALL) ALL' in /etc/sudoers grants all members of the 'wheel' group permission to execute any command as any user. This line must be uncommented using visudo, which locks the file to prevent concurrent edits and performs syntax validation before saving. Option D is correct because users must be added to the 'wheel' group using 'usermod -aG wheel username' for the sudoers rule to apply to them.

The correct command is `auditctl -a always,exit -F path=/etc/passwd -F perm=wa`. This creates a syscall-based audit rule that triggers on every syscall that accesses /etc/passwd with write (w) or attribute change (a) permissions, effectively monitoring any changes to the file. Option D uses `-w` for a file watch but with `-p rwxa`, which monitors reads and executes as well—not just changes—making it less precise for monitoring changes only.

Option C is correct because the `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes` command generates a new RSA private key and a self-signed X.509 certificate in a single step. The `-x509` flag outputs a self-signed certificate instead of a CSR, `-newkey` creates the key pair, and `-nodes` prevents encryption of the private key, which is typical for an internal web server that must start without manual passphrase entry.

Option C is correct because the auditctl command with `-a always,exit -F path=/etc/shadow -F perm=wa -k shadow` adds a rule to the audit system that records all attempts to write or attribute-change (wa) to the /etc/shadow file, which covers all access attempts that could modify the file. The `-a always,exit` appends the rule to the exit list, ensuring that every system call that accesses the file is audited, making it the proper syntax for auditing file access in Linux auditd.

The format is 'username ALL=(ALL) NOPASSWD: ALL'. The other options either require a password, use incorrect syntax, or include unnecessary aliases.

audit2allow reads audit messages and generates policy modules to allow the denied actions.

Option A is correct because it first generates a 2048-bit RSA private key using `openssl genrsa`, then uses `openssl req -new -x509` to create a self-signed X.509 certificate directly from that key, bypassing the need for a Certificate Signing Request (CSR). The `-x509` flag tells OpenSSL to output a self-signed certificate instead of a CSR, and `-days 365` sets the validity period. This two-step process produces both the private key (`key.pem`) and the self-signed certificate (`cert.pem`) required for a web server.

On Debian/Ubuntu, /var/log/auth.log records authentication events. On RHEL/CentOS, it's /var/log/secure.

The 'sestatus' command displays the current SELinux mode, including whether it is enforcing, permissive, or disabled, along with other SELinux status information.

The useradd command creates a new user and can set up the home directory and group via options, but by default it creates a home directory and assigns the user's own group.

Option C is correct because the `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes` command generates a new RSA 2048-bit private key and immediately creates a self-signed X.509 certificate in a single step. The `-x509` flag tells OpenSSL to output a self-signed certificate instead of a certificate signing request (CSR), and `-nodes` ensures the private key is not encrypted with a passphrase, which is typical for a web server that must start without manual intervention.

aa-status displays the status of AppArmor profiles. aa-complain sets a profile to complain mode (logs violations but does not enforce). aa-enforce sets a profile to enforce mode.

pam_pwquality is the module for password complexity. The options ucredit=-1, dcredit=-1, minlen=12 enforce the requirements. pam_unix handles password hashing, pam_faillock handles lockout, and pam_cracklib is an older module (deprecated in favor of pam_pwquality).

SELinux has three modes: enforcing (policy enforced), permissive (only logs violations), and disabled (SELinux turned off).

The `last` command reads the /var/log/wtmp file to display a list of all user logins and logouts since that file was created, showing timestamps and source IPs. This makes it a primary tool for investigating login history during a breach.

PermitRootLogin no prevents root login; PasswordAuthentication no forces key-based authentication. Changing the port and enabling X11 forwarding are not necessarily hardening.

%wheel ALL=(ALL) ALL grants sudo access to all members of the wheel group.

The 'req -new -newkey rsa:2048 -nodes -keyout key.pem -out req.pem' command generates a new private key and CSR. The other options either generate a self-signed certificate directly or are incomplete.

The SELinux boolean `httpd_can_network_connect_db` specifically allows the Apache HTTP server to make outbound TCP connections to database servers (e.g., MySQL, PostgreSQL). This is required when a web application needs to query a remote database. The other booleans control different aspects of httpd's behavior and do not grant network connectivity to databases.

Option B is correct because /etc/security/limits.conf is the standard configuration file used by the pam_limits.so PAM module to set per-user or per-group resource limits (ulimits) such as max number of open files, max processes, etc. This file allows system administrators to define hard and soft limits persistently across logins for users or groups, including the 'developers' group.

The correct syntax is 'auditctl -w /etc/shadow -p wa -k shadow_watch'. The -w specifies the file, -p wa watches for write and attribute changes (access is implied), but the -k is for a key. The other options have incorrect flags or order.