Scenario practice questions

A Linux server experiences a kernel panic after a recent driver update. The system is still operational but unstable. Which command should be used to gather detailed information about the kernel modules currently loaded?

Trap 1: modinfo

Shows info about a specific module.

Trap 2: dmesg

Shows kernel messages, not a direct list of loaded modules.

Trap 3: modprobe -l

Lists available modules, not loaded ones.

A
modinfo
Why wrong: Shows info about a specific module.
B
lsmod
Lists all loaded kernel modules.
C
dmesg
Why wrong: Shows kernel messages, not a direct list of loaded modules.
D
modprobe -l
Why wrong: Lists available modules, not loaded ones.

Question 2easymultiple choice

A junior administrator accidentally modified the /etc/sudoers file and now users report not being able to use sudo. Which command should be used to safely edit the sudoers file?

Trap 1: chmod 400 /etc/sudoers

Changing permissions does not repair syntax errors in sudoers.

Trap 2: echo 'user ALL=(ALL) ALL' >> /etc/sudoers

Redirecting echo appends text without syntax checking, risking further breakage; visudo should be used.

Trap 3: usermod -aG wheel user

Adding user to wheel group grants sudo access but does not fix the broken sudoers file.

A
visudo
visudo safely edits /etc/sudoers with syntax checking and file locking.
B
chmod 400 /etc/sudoers
Why wrong: Changing permissions does not repair syntax errors in sudoers.
C
echo 'user ALL=(ALL) ALL' >> /etc/sudoers
Why wrong: Redirecting echo appends text without syntax checking, risking further breakage; visudo should be used.
D
usermod -aG wheel user
Why wrong: Adding user to wheel group grants sudo access but does not fix the broken sudoers file.

Question 3hardmultiple choice

A user cannot delete a file owned by another user on a shared filesystem. The file's permissions are 644, and the directory has permissions 755 with the sticky bit set. Which action would allow the user to delete the file?

Trap 1: Change the directory's group to include the user

Adding the user to the directory's group does not change the sticky bit or directory write permissions.

Trap 2: Add write permission for others on the file

File write permission is not required to delete a file; directory write permission is needed.

Trap 3: Change the file's group to match the user's group

Group ownership does not determine deletion permission; directory permissions and sticky bit are key.

A
Change the directory's group to include the user
Why wrong: Adding the user to the directory's group does not change the sticky bit or directory write permissions.
B
Remove the sticky bit from the directory
Sticky bit restricts deletion to file owners; removing it allows deletion by users with write access to the directory.
C
Add write permission for others on the file
Why wrong: File write permission is not required to delete a file; directory write permission is needed.
D
Change the file's group to match the user's group
Why wrong: Group ownership does not determine deletion permission; directory permissions and sticky bit are key.

Question 4easymultiple choice

A system fails to boot after installing a new SATA disk. The BIOS recognizes the disk. What is the most likely cause?

Trap 1: GRUB configuration is corrupted

Corrupt GRUB would cause boot failure regardless of new disk.

Trap 2: The new disk is not formatted

Formatting is not required for booting from another disk.

Trap 3: The new disk is not partitioned

An unpartitioned disk would not prevent boot from the primary disk.

A
GRUB configuration is corrupted
Why wrong: Corrupt GRUB would cause boot failure regardless of new disk.
B
Boot order is incorrect
The system might try to boot from the new disk, which has no bootloader.
C
The new disk is not formatted
Why wrong: Formatting is not required for booting from another disk.
D
The new disk is not partitioned
Why wrong: An unpartitioned disk would not prevent boot from the primary disk.

Question 5mediummultiple choice

Scenario: A cloud hosting company uses SELinux in enforcing mode on all Linux servers. A developer reports that a custom web application running under Apache (httpd) is unable to write log files to /var/log/myapp/. The directory /var/log/myapp/ has permissions 755 and is owned by root:root. The httpd process runs as the 'apache' user. The administrator checks SELinux context: /var/log/myapp is labeled with default_t type. The administrator wants to allow httpd to write to this directory while maintaining security. Which command should the administrator run?

Trap 1: Change ownership with 'chown apache:apache /var/log/myapp'

Ownership change does not affect SELinux policy.

Trap 2: Run 'setenforce 0' to disable SELinux

Disabling SELinux reduces security unnecessarily.

Trap 3: Run 'chcon -t httpd_log_t /var/log/myapp'

chcon makes a temporary change that may be overwritten by restorecon.

A
Change ownership with 'chown apache:apache /var/log/myapp'
Why wrong: Ownership change does not affect SELinux policy.
B
Run 'setenforce 0' to disable SELinux
Why wrong: Disabling SELinux reduces security unnecessarily.
C
Run 'chcon -t httpd_log_t /var/log/myapp'
Why wrong: chcon makes a temporary change that may be overwritten by restorecon.
D
Run 'semanage fcontext -a -t httpd_log_t "/var/log/myapp(/.*)?"' and then 'restorecon -Rv /var/log/myapp'
This permanently sets the context to httpd_log_t, allowing httpd to write.

Question 6hardmultiple choice

Scenario: A financial services company runs a critical application on a Linux server that stores sensitive customer data. The server is configured with a firewall (iptables) that only allows SSH (port 22) and HTTPS (port 443) from the internal network (10.0.0.0/8). Recently, the security team detected unauthorized access attempts from an external IP address (203.0.113.5) targeting port 22. The administrator needs to block this specific IP while maintaining current access rules. The existing iptables rules are: - INPUT chain policy ACCEPT - Rule 1: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT - Rule 2: -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT - Rule 3: -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT - Rule 4: -A INPUT -j DROP The administrator wants to block 203.0.113.5 from any access. Which command should be added?

Trap 1: iptables -I INPUT 5 -s 203.0.113.5 -j DROP

Inserting at position 5 is after the final DROP rule; still ineffective.

Trap 2: iptables -A INPUT -s 203.0.113.5 -j DROP

Appending after the final DROP rule is ineffective.

Trap 3: iptables -I INPUT 1 -s 203.0.113.5 -j ACCEPT

This would allow the IP instead of blocking.

A
iptables -I INPUT 1 -s 203.0.113.5 -j DROP
Inserts a DROP rule at the top, blocking the IP before any ACCEPT rules.
B
iptables -I INPUT 5 -s 203.0.113.5 -j DROP
Why wrong: Inserting at position 5 is after the final DROP rule; still ineffective.
C
iptables -A INPUT -s 203.0.113.5 -j DROP
Why wrong: Appending after the final DROP rule is ineffective.
D
iptables -I INPUT 1 -s 203.0.113.5 -j ACCEPT
Why wrong: This would allow the IP instead of blocking.