Select Two (Multi-Select) Questions

Using modprobe to load kernel modules with parameters

Why wrong: modprobe loads modules, not modifies existing parameters.

Editing /etc/sysctl.conf and running sysctl --system

Why wrong: This applies settings from files, but it's not a direct runtime modification.

Adding parameters to the kernel command line in /etc/default/grub

Why wrong: This requires a reboot to take effect.

Thin pools are created using the 'pvcreate' command.

Why wrong: Thin pools are created with lvcreate --type thin-pool.

Thin provisioning requires a dm-cache device to function.

Why wrong: dm-cache is a separate feature for caching.

Thin volumes automatically grow when they run out of space.

Why wrong: Auto-extension requires monitoring and manual intervention.

The 'allow-transfer' ACL is used to restrict which clients can perform recursive queries.

Why wrong: allow-transfer restricts zone transfers, not recursion.

The 'blackhole' ACL can be used to prevent cache poisoning attacks.

Why wrong: blackhole discards queries from certain sources, but does not prevent cache poisoning; DNSSEC does.

The 'forwarders' option can be used to disable recursion entirely.

Why wrong: forwarders only redirect queries; recursion can be disabled with 'recursion no'.

Using the 'map user' command in smbpasswd

Why wrong: No such command

Setting 'winbind use default domain = yes'

Why wrong: Affects domain name, not mapping

Using the 'valid users' directive in smb.conf

Why wrong: Controls access, not mapping

Enable the mod_info module to monitor server configuration.

Why wrong: mod_info exposes sensitive server information and should be disabled in production.

Enable .htaccess files to allow per-directory configuration changes.

Why wrong: .htaccess files can introduce performance overhead and security risks; it's better to place configuration in the main server config.

Enable the HTTP TRACE method for debugging purposes.

Why wrong: The TRACE method can be exploited for Cross-Site Tracing attacks and should be disabled.

Traffic must be allowed by iptables FORWARD chain

Why wrong: iptables rules in the FORWARD chain can filter but are not required for forwarding.

The bridge must have an IP address configured

Why wrong: An IP address is not required for bridging; the bridge can be purely layer 2.

Spanning tree must be disabled

Why wrong: STP can be enabled and still allow forwarding (after convergence).

VLAN tagging can only be used with Ethernet

Why wrong: VLAN tagging can also be used with other technologies like Fiber Channel over Ethernet (FCoE).

VLAN tags are always 12 bits

Why wrong: The tag has 4 bytes: TPID (2 bytes), TCI (2 bytes) which includes 3-bit priority, 1-bit CFI, 12-bit VLAN ID.

VLAN tags are added by the switch, not the host

Why wrong: Hosts can also add VLAN tags if configured as VLAN interfaces.

lsof -i TCP -s TCP:LISTEN

Why wrong: This also works but is not as standard as ss/netstat on minimal systems; however, the question asks for TWO, and ss/netstat are the most common.

fuser -v 80/tcp

Why wrong: fuser shows processes using a specific port, not all ports.

nmap -sT localhost

Why wrong: nmap scans ports but does not show local process info.

Run 'update-grub' to regenerate GRUB configuration

Why wrong: While often needed, it is not a core compilation step and is distribution-dependent.

Run 'depmod -a' to generate module dependencies

Why wrong: This is usually done automatically by 'make modules_install'.

verbose

Why wrong: Not a standard kernel parameter; most kernels ignore it.

quiet

Why wrong: Suppresses most kernel messages, opposite of verbose.

sshfs

Why wrong: sshfs mounts a remote filesystem via SSH.

nfsmount

Why wrong: nfsmount is not a standard command; mount -t nfs is used for NFS.

ftp

Why wrong: ftp is a file transfer protocol, not SMB.

Thin pools automatically extend when they reach 80% usage.

Why wrong: Auto-extension is not default; must be configured with dmeventd.

A thin pool cannot be extended once created.

Why wrong: Thin pools can be extended with lvextend.

It is only supported on SSDs.

Why wrong: Thin provisioning works on any block device.

NSEC3 records are stored in the zone in plain text order to allow efficient denial of existence.

Why wrong: NSEC3 records are stored in hash order, not plain text order.

The NSEC3 record type is NXT and is used to provide authenticated denial of existence.

Why wrong: NXT is the DNSSEC record for NSEC, not NSEC3.

NSEC3 uses SHA-256 as the default hash algorithm.

Why wrong: NSEC3 uses SHA-1 by default.

Install a graphical desktop environment for easier administration.

Why wrong: This introduces additional services and vulnerabilities, not recommended for a server.

Set up a web server to monitor system status.

Why wrong: Running additional services increases attack surface; not a hardening step.

Disable root login over SSH.

Why wrong: This is a security best practice but not a method to 'secure SSH access' itself; it limits access but doesn't strengthen authentication.

Use FTP over SSH (SFTP) for file transfers.

Why wrong: SFTP is a file transfer protocol, not a method to secure SSH access.

Require users to change their passwords every 30 days.

Why wrong: Password aging does not prevent brute-force attacks; key-based authentication is recommended.

iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j DROP

Why wrong: This drops SSH from the subnet, opposite of desired.

iptables -A INPUT -j ACCEPT

Why wrong: This would accept all traffic, defeating the purpose of dropping other traffic.

iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

Why wrong: This allows all traffic from the subnet, not just SSH.

usermod -L root

Why wrong: This locks the root password but does not prevent key-based SSH login.

echo "PermitRootLogin without-password" >> /etc/ssh/sshd_config

Why wrong: This still allows root login with key-based authentication.

echo "PermitRootLogin yes" >> /etc/ssh/ssh_config

Why wrong: This modifies the client configuration and allows root login.

pam_securetty.so

Why wrong: This module restricts root login to secure TTYs only.

pam_unix.so

Why wrong: pam_unix handles authentication but does not enforce complexity.

Logwatch

Why wrong: Logwatch analyzes system logs, does not perform file integrity checks.

Nmap

Why wrong: Nmap is a network scanning tool, not file integrity.

LDAP

Why wrong: LDAP authentication is possible via a plugin, but not a native method.

RADIUS

Why wrong: RADIUS authentication is possible via a plugin, but not native.

NIS

Why wrong: NIS is not a supported authentication method for OpenVPN.