LPIC-2 System Security Practice Question
A government agency runs a classified application on a Linux server with strict auditing requirements. The application writes sensitive data to a MySQL database. The auditor requires that all SQL queries executed by the application be logged with timestamps, user, and the full query text. Additionally, the audit logs must be immutable (cannot be altered by the application or any user except a designated auditor account). The database runs on the same server. Which combination of tools and configurations should the administrator deploy?
⚠ Common exam trap
Watch out — candidates often choose auditd (Option A) because it is a common auditing tool, but it cannot capture SQL query text, while MySQL's general query log directly logs queries and can be hardened with filesystem attributes for immutability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable MySQL's general query log, direct it to a file on a separate filesystem mounted with the 'noexec' and 'append' options, and set the file immutable with chattr +a.
It combines MySQL's general query log (which captures full query text, timestamps, and user) with filesystem-level immutability via `chattr +a` (append-only) on a separate filesystem mounted with `noexec` and `append` options. This ensures logs cannot be modified or deleted by the application or any non-auditor user, meeting the strict auditing requirement for immutable logs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable auditd to monitor the MySQL process and log all system calls.
Why it's wrong here
auditd logs system calls, not the SQL query text.
- ✓
Enable MySQL's general query log, direct it to a file on a separate filesystem mounted with the 'noexec' and 'append' options, and set the file immutable with chattr +a.
Why this is correct
The general query log logs plaintext queries; chattr +a makes the file append-only, preventing modification of existing logs.
- ✗
Enable the MySQL audit log plugin and configure rsyslog to forward logs to a remote log server.
Why it's wrong here
The audit log plugin logs queries, but local logs may be tampered with; remote logging helps but doesn't guarantee immutability locally.
- ✗
Use tcpdump to capture all network traffic to port 3306 and save to a file with packet captures.
Why it's wrong here
tcpdump captures packets, not queries if using local socket; also captures binary data, not readable queries.
Go deeper
Related to this question
About these practice questions
This LPIC-2 question is part of Courseiva's 507-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.