- A
Enable the mod_info module to monitor server configuration.
Why wrong: mod_info exposes sensitive server information and should be disabled in production.
- B
Disable directory listing in the Apache configuration using Options -Indexes.
Disabling directory listing prevents attackers from browsing directory contents.
- C
Enable .htaccess files to allow per-directory configuration changes.
Why wrong: .htaccess files can introduce performance overhead and security risks; it's better to place configuration in the main server config.
- D
Run the Apache worker processes as a non-root user such as www-data.
Running as a non-privileged user limits the impact of a security breach.
- E
Enable the HTTP TRACE method for debugging purposes.
Why wrong: The TRACE method can be exploited for Cross-Site Tracing attacks and should be disabled.
Quick Answer
The correct answer is to disable directory listing and run Apache as a non-root user. Disabling directory listing with `Options -Indexes` in the Apache configuration prevents the server from automatically generating a list of files in directories that lack an index file, such as index.html. This is a fundamental Apache security hardening best practice because it reduces information disclosure about the web server’s file structure, which an attacker could otherwise exploit to locate sensitive files or configuration details. On the LPIC-2 exam, this topic tests your understanding of the Apache configuration directives under the 210.4 objective, often appearing as a multiple-choice question where a distractor suggests using `Options +Indexes` or running the server as root. A common trap is confusing the `User` directive for the main process with the worker processes; remember that only the child processes should run as a non-root user like www-data, while the parent process may temporarily start as root to bind to privileged ports. A useful memory tip is “No Index, No Root” to recall the two core actions: disable Indexes and avoid running workers as root.
LPIC-2 System Security Practice Question
This LPIC-2 practice question tests your understanding of system security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An administrator wants to enhance the security of a web server running Apache. Which TWO of the following actions are recommended best practices?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"best"Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Disable directory listing in the Apache configuration using Options -Indexes.
Option B is correct because disabling directory listing with `Options -Indexes` prevents Apache from generating a list of files in directories that lack an index file (e.g., index.html). This is a fundamental security hardening step that reduces information disclosure about the web server's file structure, which could be leveraged by an attacker to find sensitive files or configuration details.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable the mod_info module to monitor server configuration.
Why it's wrong here
mod_info exposes sensitive server information and should be disabled in production.
- ✓
Disable directory listing in the Apache configuration using Options -Indexes.
Why this is correct
Disabling directory listing prevents attackers from browsing directory contents.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Enable .htaccess files to allow per-directory configuration changes.
Why it's wrong here
.htaccess files can introduce performance overhead and security risks; it's better to place configuration in the main server config.
- ✓
Run the Apache worker processes as a non-root user such as www-data.
Why this is correct
Running as a non-privileged user limits the impact of a security breach.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Enable the HTTP TRACE method for debugging purposes.
Why it's wrong here
The TRACE method can be exploited for Cross-Site Tracing attacks and should be disabled.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse enabling `.htaccess` files (Option C) with a security best practice, when in fact it is a security anti-pattern that reduces performance and control, while the correct hardening step is to disable them and centralize configuration.
Detailed technical explanation
How to think about this question
Under the hood, `Options -Indexes` works by modifying the per-directory option flags that Apache evaluates during the `dir_module` handler. When a directory without a DirectoryIndex (e.g., index.html) is requested, Apache normally falls back to generating a directory listing via `mod_autoindex`; disabling Indexes forces Apache to return a 403 Forbidden instead. In real-world scenarios, even a single directory with Indexes accidentally left enabled (e.g., an uploads folder) can expose backup files, logs, or user data, making this a common finding in security audits like PCI DSS.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the LPIC-2 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
System Security — study guide chapter
Learn the concepts, then practise the questions
- →
System Security practice questions
Targeted practice on this topic area only
- →
All LPIC-2 questions
511 questions across all exam domains
- →
Linux Professional Institute Certification Level 2 LPIC-2 study guide
Full concept coverage aligned to exam objectives
- →
LPIC-2 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related LPIC-2 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Linux Kernel and System Startup practice questions
Practise LPIC-2 questions linked to Linux Kernel and System Startup.
Block Devices, Filesystems and Advanced Storage practice questions
Practise LPIC-2 questions linked to Block Devices, Filesystems and Advanced Storage.
Advanced Networking Configuration practice questions
Practise LPIC-2 questions linked to Advanced Networking Configuration.
DNS, Web and Mail Services practice questions
Practise LPIC-2 questions linked to DNS, Web and Mail Services.
File Sharing and Samba practice questions
Practise LPIC-2 questions linked to File Sharing and Samba.
System Security practice questions
Practise LPIC-2 questions linked to System Security.
Network Client Management practice questions
Practise LPIC-2 questions linked to Network Client Management.
LPIC-2 fundamentals practice questions
Practise LPIC-2 questions linked to LPIC-2 fundamentals.
LPIC-2 scenario practice questions
Practise LPIC-2 questions linked to LPIC-2 scenario.
LPIC-2 troubleshooting practice questions
Practise LPIC-2 questions linked to LPIC-2 troubleshooting.
Practice this exam
Start a free LPIC-2 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this LPIC-2 question test?
System Security — This question tests System Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Disable directory listing in the Apache configuration using Options -Indexes. — Option B is correct because disabling directory listing with `Options -Indexes` prevents Apache from generating a list of files in directories that lack an index file (e.g., index.html). This is a fundamental security hardening step that reduces information disclosure about the web server's file structure, which could be leveraged by an attacker to find sensitive files or configuration details.
What should I do if I get this LPIC-2 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.