LPIC-2 System Security Practice Question
A company runs a web application on a Linux server that uses Apache, MySQL, and PHP. The application stores sensitive user data in a MySQL database. The security team has detected that the MySQL service is listening on port 3306 on all interfaces (0.0.0.0). The application and database are on the same server, so there is no need for remote database access. The administrator must secure the MySQL service without breaking the application. Which of the following is the most appropriate course of action?
⚠ Common exam trap
Many exam-takers confuse 'skip-networking' with disabling networking (option C) or think that changing the port (option B) is sufficient security, when in fact the core issue is the binding to all interfaces, which is directly solved by the bind-address directive.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Edit the MySQL configuration file (my.cnf) and set bind-address = 127.0.0.1, then restart the MySQL service.
Setting bind-address = 127.0.0.1 in the MySQL configuration file (my.cnf) instructs the MySQL server to listen only on the loopback interface, which prevents remote connections while still allowing local applications (Apache/PHP) to connect via the local socket or TCP to 127.0.0.1. This directly addresses the security concern of exposing the database on all interfaces without breaking the application, as the application and database reside on the same server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Edit the MySQL configuration file (my.cnf) and set bind-address = 127.0.0.1, then restart the MySQL service.
Why this is correct
This restricts MySQL to listen only on localhost, preventing remote connections.
- ✗
Change the MySQL default port to a non-standard port to avoid automated scans.
Why it's wrong here
Changing the port does not prevent direct connection attempts.
- ✗
Disable the MySQL network entirely by commenting out the 'skip-networking' directive in my.cnf.
Why it's wrong here
Disabling networking would force the application to use Unix sockets, which may require reconfiguration of the PHP database connection.
- ✗
Use iptables to add a rule dropping incoming packets to port 3306 from all IPs except 127.0.0.1.
Why it's wrong here
While `iptables` would successfully block external connections to port 3306, it fails to address the root issue: the MySQL service itself is still configured to listen on all interfaces (0.0.0.0). The most appropriate solution involves reconfiguring MySQL directly to bind only to 127.0.0.1, thereby preventing it from listening on external interfaces at all. This option is tempting as `iptables` provides a valid network-level defence, and it would be a correct choice if the MySQL service *had* to listen on 0.0.0.0 for other internal services, but external access needed restricting.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.