System Security practice questions

A system administrator notices that the SSH service on a Linux server is failing to start. The log shows: 'sshd: error: Could not load host key: /etc/ssh/ssh_host_rsa_key'. What is the most likely cause and solution?

Trap 1: The sshd_config file has a syntax error

The error message does not indicate a syntax error.

Trap 2: The SSH service is managed by xinetd and the configuration is…

SSH is typically not managed by xinetd.

Trap 3: The /etc/ssh/sshd_config file has incorrect permissions

The error is about a missing key, not permissions.

A
The sshd_config file has a syntax error. Run 'sshd -t' to check it.
Why wrong: The error message does not indicate a syntax error.
B
The SSH service is managed by xinetd and the configuration is missing. Edit /etc/xinetd.d/ssh.
Why wrong: SSH is typically not managed by xinetd.
C
The /etc/ssh/sshd_config file has incorrect permissions. Change them to 600.
Why wrong: The error is about a missing key, not permissions.
D
The host key file is missing or corrupt. Run 'ssh-keygen -A' to regenerate all missing host keys.
This regenerates default host keys.

Question 2easymultiple choice

A security policy requires that all users must change their passwords every 90 days. Which command enforces maximum password age for an existing user 'jdoe'?

Trap 1: passwd -f jdoe

Forces a password change but does not set aging.

Trap 2: usermod -e 90 jdoe

usermod -e sets account expiration, not password aging.

Trap 3: chage -E 90 jdoe

-E sets account expiration date, not password age.

A
chage -M 90 jdoe
Sets maximum number of days a password is valid.
B
passwd -f jdoe
Why wrong: Forces a password change but does not set aging.
C
usermod -e 90 jdoe
Why wrong: usermod -e sets account expiration, not password aging.
D
chage -E 90 jdoe
Why wrong: -E sets account expiration date, not password age.

Question 3hardmultiple choice

A security audit reveals that the /var/log directory contains world-readable log files that may contain sensitive information. The administrator wants to ensure new files created in /var/log are not readable by others, without affecting existing file permissions. Which umask value should be set system-wide?

Trap 1: umask 027

Results in 640 for files but 640 for directories? Actually 666-027=639, which is unusual.

Trap 2: umask 022

Results in 644 (rw-r--r--), still world-readable.

Trap 3: umask 077

Results in 600 (rw-------), too restrictive for logs.

A
umask 027
Why wrong: Results in 640 for files but 640 for directories? Actually 666-027=639, which is unusual.
B
umask 022
Why wrong: Results in 644 (rw-r--r--), still world-readable.
C
umask 077
Why wrong: Results in 600 (rw-------), too restrictive for logs.
D
umask 026
Results in default file permissions 640 (rw-r-----).

Question 4mediummulti select

Which TWO commands can be used to display the current iptables rules for the filter table?

Trap 1: iptables -S

Outputs rules in a script-like format but for all tables? Actually -S by default shows filter table. But the question asks for 'commands', and -S shows filter table as well. However, typical interpretation: both -L and -S show filter. But to avoid confusion, we include -S as correct? The question says 'which TWO', so we need exactly two. I'll choose A and B as the most direct. -S is also valid but might be considered another way. To be safe, I'll keep A and B.

Trap 2: iptables -t nat -L

Lists nat table, not filter.

Trap 3: iptables -t mangle -L

Lists mangle table, not filter.

A
iptables -L
Lists rules in the filter table by default.
B
iptables -S
Why wrong: Outputs rules in a script-like format but for all tables? Actually -S by default shows filter table. But the question asks for 'commands', and -S shows filter table as well. However, typical interpretation: both -L and -S show filter. But to avoid confusion, we include -S as correct? The question says 'which TWO', so we need exactly two. I'll choose A and B as the most direct. -S is also valid but might be considered another way. To be safe, I'll keep A and B.
C
iptables -t filter -L
Explicitly lists the filter table.
D
iptables -t nat -L
Why wrong: Lists nat table, not filter.
E
iptables -t mangle -L
Why wrong: Lists mangle table, not filter.

Question 5hardmulti select

Which THREE of the following are valid methods to restrict access to the su command on a Linux system?

Trap 1: Set the SU_WHEEL_ONLY variable in /etc/login.defs.

Trap 2: Modify /etc/shells to include only approved shells.

/etc/shells lists valid shells for chsh, not su.

Trap 3: Configure sudoers to allow only specific users to run su.

sudo can be used to run commands as root, but not to restrict su itself.

A
Set the SU_WHEEL_ONLY variable in /etc/login.defs.
Why wrong: login.defs does not have SU_WHEEL_ONLY; this is a myth.
B
Modify /etc/shells to include only approved shells.
Why wrong: /etc/shells lists valid shells for chsh, not su.
C
Configure sudoers to allow only specific users to run su.
Why wrong: sudo can be used to run commands as root, but not to restrict su itself.
D
Edit the /etc/suauth file to specify allowed users.
Legacy method, still works on some systems.
E
Add the user to the 'wheel' group and configure pam_wheel.so in /etc/pam.d/su.
Common method to restrict su to wheel group.

Question 6mediummultiple choice

Based on the iptables output, what is the expected behavior for incoming SSH connections on eth0?

Network Topology

Trap 1: SSH connections are only allowed if they are part of an established…

The rule matches state NEW, not ESTABLISHED.

Trap 2: SSH connections are dropped because the default policy is DROP.

The rule overrides the default policy for matching packets.

Trap 3: SSH connections are only allowed from the loopback interface.

The rule accepts on eth0, not lo.

A
SSH connections are only allowed if they are part of an established connection.
Why wrong: The rule matches state NEW, not ESTABLISHED.
B
SSH connections from any source to port 22 on eth0 are allowed if they are new.
The rule matches new SSH connections on eth0.
C
SSH connections are dropped because the default policy is DROP.
Why wrong: The rule overrides the default policy for matching packets.
D
SSH connections are only allowed from the loopback interface.
Why wrong: The rule accepts on eth0, not lo.

Question 7hardmultiple choice

Based on the sshd configuration, user 'charlie' attempts to log in using public key authentication. What will happen?

Exhibit

Refer to the exhibit.

# cat /etc/ssh/sshd_config | grep -v '^#' | grep -v '^$'
Port 22
Protocol 2
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
AllowUsers alice bob
DenyUsers charlie

Trap 1: Login is allowed because PasswordAuthentication is disabled, but…

DenyUsers applies to all authentication methods.

Trap 2: Login is allowed because AllowUsers includes other users but does…

DenyUsers explicitly denies charlie.

Trap 3: Login is denied because charlie's IP address is not in the allowed…

No IP-based restrictions are configured.

A
Login is denied because the DenyUsers directive explicitly blocks charlie.
DenyUsers blocks charlie regardless of authentication.
B
Login is allowed because PasswordAuthentication is disabled, but public key authentication is enabled.
Why wrong: DenyUsers applies to all authentication methods.
C
Login is allowed because AllowUsers includes other users but does not deny charlie.
Why wrong: DenyUsers explicitly denies charlie.
D
Login is denied because charlie's IP address is not in the allowed list.
Why wrong: No IP-based restrictions are configured.

Read the full network assurance explanation →

Question 8easymultiple choice

A system administrator wants to ensure that all commands executed by root are logged to a remote syslog server. Which rsyslog configuration directive should be used?

Trap 1: auth.* @192.168.1.100

auth is for general authentication, but authpriv is more specific.

Trap 2: user.* @192.168.1.100

user facility is for user-level messages.

Trap 3: kern.* @192.168.1.100

kern is kernel facility, not for root commands.

A
auth.* @192.168.1.100
Why wrong: auth is for general authentication, but authpriv is more specific.
B
authpriv.* @192.168.1.100
authpriv facility logs security/authorization messages including sudo commands.
C
user.* @192.168.1.100
Why wrong: user facility is for user-level messages.
D
kern.* @192.168.1.100
Why wrong: kern is kernel facility, not for root commands.

Question 9mediummultiple choice

An organization requires that all email traffic from their mail server must be encrypted in transit. Which of the following is the most appropriate solution?

Trap 1: Implement IPsec to encrypt all traffic between mail servers.

IPsec can be used but is more complex and not specific to email.

Trap 2: Use SMTPS (SMTP over SSL) on port 465.

SMTPS is deprecated; STARTTLS is the standard.

Trap 3: Configure the mail server to use SSH tunneling for all SMTP…

SSH tunneling is not standard for email transport.

A
Implement IPsec to encrypt all traffic between mail servers.
Why wrong: IPsec can be used but is more complex and not specific to email.
B
Use SMTPS (SMTP over SSL) on port 465.
Why wrong: SMTPS is deprecated; STARTTLS is the standard.
C
Configure the mail server to use SSH tunneling for all SMTP connections.
Why wrong: SSH tunneling is not standard for email transport.
D
Enable STARTTLS on the SMTP server to encrypt connections.
STARTTLS upgrades plain SMTP to encrypted using TLS.

Question 10easymultiple choice

Which file is used to configure which users and groups are allowed to use the 'cron' daemon?

Trap 1: /var/spool/cron/

Directory containing user crontab files.

Trap 2: /etc/cron.d/

Directory for system cron jobs.

Trap 3: /etc/crontab

System crontab file, not for user access control.

A
/var/spool/cron/
Why wrong: Directory containing user crontab files.
B
/etc/cron.d/
Why wrong: Directory for system cron jobs.
C
/etc/crontab
Why wrong: System crontab file, not for user access control.
D
/etc/cron.allow
Lists users allowed to use cron.

Study the full ACL explanation →

Question 11hardmultiple choice

Based on the ACL output, which user(s) can write to the file /var/www/html/index.html?

Exhibit

Refer to the exhibit.

# getfacl /var/www/html/index.html
# file: var/www/html/index.html
# owner: root
# group: www-data
user::rw-
user:www-data:r--
group::r--
mask::r--
other::---

Trap 1: Only the user www-data.

www-data has read-only permission.

Trap 2: No one, because the mask is r--.

Mask does not affect root's permissions.

Trap 3: Any user in the www-data group.

Group has r--.

A
Only the user www-data.
Why wrong: www-data has read-only permission.
B
No one, because the mask is r--.
Why wrong: Mask does not affect root's permissions.
C
Only root.
Root has rw- and is not limited by mask.
D
Any user in the www-data group.
Why wrong: Group has r--.

Question 12hardmultiple choice

A company runs a web application on a Linux server that uses Apache, MySQL, and PHP. The application stores sensitive user data in a MySQL database. The security team has detected that the MySQL service is listening on port 3306 on all interfaces (0.0.0.0). The application and database are on the same server, so there is no need for remote database access. The administrator must secure the MySQL service without breaking the application. Which of the following is the most appropriate course of action?

Trap 1: Change the MySQL default port to a non-standard port to avoid…

Changing the port does not prevent direct connection attempts.

Trap 2: Disable the MySQL network entirely by commenting out the…

Disabling networking would force the application to use Unix sockets, which may require reconfiguration of the PHP database connection.

Trap 3: Use iptables to add a rule dropping incoming packets to port 3306…

This is more complex and still exposes the service to local network if misconfigured.

A
Edit the MySQL configuration file (my.cnf) and set bind-address = 127.0.0.1, then restart the MySQL service.
This restricts MySQL to listen only on localhost, preventing remote connections.
B
Change the MySQL default port to a non-standard port to avoid automated scans.
Why wrong: Changing the port does not prevent direct connection attempts.
C
Disable the MySQL network entirely by commenting out the 'skip-networking' directive in my.cnf.
Why wrong: Disabling networking would force the application to use Unix sockets, which may require reconfiguration of the PHP database connection.
D
Use iptables to add a rule dropping incoming packets to port 3306 from all IPs except 127.0.0.1.
Why wrong: This is more complex and still exposes the service to local network if misconfigured.

Question 13mediummultiple choice

A system administrator needs to ensure that all users must change their passwords every 90 days and that passwords must be at least 12 characters long. The administrator modifies /etc/login.defs and /etc/pam.d/common-password. Which additional step is required to enforce these settings for existing users?

Trap 1: Run 'passwd -x 90' for each existing user

passwd -x sets max days but requires the username argument; also less efficient than chage.

Trap 2: Run 'pwconv' to synchronize password aging

pwconv only converts to shadow, it does not set aging.

Trap 3: Run 'pwunconv' then 'pwconv' to update shadow file

This converts shadow passwords but does not set max days.

A
Run 'chage -M 90' for each existing user
chage modifies password aging for existing users.
B
Run 'passwd -x 90' for each existing user
Why wrong: passwd -x sets max days but requires the username argument; also less efficient than chage.
C
Run 'pwconv' to synchronize password aging
Why wrong: pwconv only converts to shadow, it does not set aging.
D
Run 'pwunconv' then 'pwconv' to update shadow file
Why wrong: This converts shadow passwords but does not set max days.

Question 14easymulti select

Which TWO commands can be used to list all currently listening TCP ports and the associated processes?

Trap 1: lsof -i TCP -s TCP:LISTEN

This also works but is not as standard as ss/netstat on minimal systems; however, the question asks for TWO, and ss/netstat are the most common.

Trap 2: fuser -v 80/tcp

fuser shows processes using a specific port, not all ports.

Trap 3: nmap -sT localhost

nmap scans ports but does not show local process info.

A
lsof -i TCP -s TCP:LISTEN
Why wrong: This also works but is not as standard as ss/netstat on minimal systems; however, the question asks for TWO, and ss/netstat are the most common.
B
ss -tlnp
ss -tlnp shows listening TCP ports with process info.
C
netstat -tlnp
netstat -tlnp also shows listening TCP ports with process info.
D
fuser -v 80/tcp
Why wrong: fuser shows processes using a specific port, not all ports.
E
nmap -sT localhost
Why wrong: nmap scans ports but does not show local process info.

Question 15hardmultiple choice

Given the exhibit, what is the most likely reason for the GPG error, and what is the correct way to fix it permanently?

Network Topology

Trap 1: The repository is not signed; use '--allow-unauthenticated'…

This bypasses security permanently, not recommended.

Trap 2: The repository URL is incorrect; change 'http://deb.example.com' to…

HTTPS would not fix missing public key.

Trap 3: The InRelease file is corrupted; remove it and run 'apt-get update'…

The file is likely fine; the key is missing.

A
The repository is not signed; use '--allow-unauthenticated' permanently in /etc/apt/apt.conf.d/
Why wrong: This bypasses security permanently, not recommended.
B
The repository URL is incorrect; change 'http://deb.example.com' to 'https://deb.example.com'
Why wrong: HTTPS would not fix missing public key.
C
The InRelease file is corrupted; remove it and run 'apt-get update' again
Why wrong: The file is likely fine; the key is missing.
D
The public key is missing; obtain and add it with 'apt-key add' or 'wget -O- | apt-key add -'
Adding the correct public key resolves the error.

Question 16mediummultiple choice

You are the security administrator for a company that runs a web application on a Linux server. The application runs under the user 'www-data' and listens on TCP port 8080. The server also runs an SSH service on port 22. Recently, an external penetration test revealed that an attacker could exploit a vulnerability in the web application to execute commands as the 'www-data' user, and from there, the attacker could escalate privileges to root due to a misconfigured sudo rule. You need to implement a defense-in-depth approach to limit the impact of such an attack. Which single action would be the most effective in preventing privilege escalation from the 'www-data' user to root, while still allowing the application to function normally?

Trap 1: Change the SSH port to a non-standard port to reduce the attack…

Does not address local privilege escalation from www-data.

Trap 2: Run the web application in a chroot jail to isolate it from the…

Chroot does not prevent sudo execution if the sudo binary and configuration are accessible.

Trap 3: Implement mandatory access control with AppArmor profiles for the…

AppArmor can restrict capabilities but does not override explicit sudo permissions.

A
Review and remove any sudo privileges granted to the 'www-data' user in /etc/sudoers, and ensure the application does not require sudo.
Directly eliminates the escalation path.
B
Change the SSH port to a non-standard port to reduce the attack surface.
Why wrong: Does not address local privilege escalation from www-data.
C
Run the web application in a chroot jail to isolate it from the rest of the filesystem.
Why wrong: Chroot does not prevent sudo execution if the sudo binary and configuration are accessible.
D
Implement mandatory access control with AppArmor profiles for the web application.
Why wrong: AppArmor can restrict capabilities but does not override explicit sudo permissions.

Question 17hardmultiple choice

An administrator is reviewing the audit rules on a Linux server. The current rules are shown in the exhibit. The administrator needs to ensure that any failed attempts to open files are logged, while also monitoring for successful outbound connections. Which of the following describes the effect of the current rules?

Exhibit

Refer to the exhibit.

```
# auditctl -l
-a always,exit -F arch=b64 -S openat -F success=0 -F key=access_denied
-a always,exit -F arch=b64 -S connect -F key=outbound_connect
-w /etc/shadow -p wa -k shadow_changes
-w /etc/ssh/sshd_config -p wa -k sshd_config_change
```

Trap 1: The first rule logs only successful openat calls, and the second…

The first rule uses success=0, which means failed calls; the second rule does not filter by success, so it logs both.

Trap 2: The first rule logs all openat calls, and the second rule logs all…

The first rule logs only failed openat calls because of success=0.

Trap 3: The first rule logs only failed openat calls, and the second rule…

The second rule does not filter by success, so it logs all connect calls.

A
The first rule logs only failed openat calls, and the second rule logs all connect calls.
The first rule logs failed openat (success=0), the second logs all connect (no success filter).
B
The first rule logs only successful openat calls, and the second rule logs only failed connect calls.
Why wrong: The first rule uses success=0, which means failed calls; the second rule does not filter by success, so it logs both.
C
The first rule logs all openat calls, and the second rule logs all connect calls.
Why wrong: The first rule logs only failed openat calls because of success=0.
D
The first rule logs only failed openat calls, and the second rule logs only failed connect calls.
Why wrong: The second rule does not filter by success, so it logs all connect calls.

Question 18easymulti select

An administrator wants to enhance the security of a web server running Apache. Which TWO of the following actions are recommended best practices?

Trap 1: Enable the mod_info module to monitor server configuration.

mod_info exposes sensitive server information and should be disabled in production.

Trap 2: Enable .htaccess files to allow per-directory configuration changes.

.htaccess files can introduce performance overhead and security risks; it's better to place configuration in the main server config.

Trap 3: Enable the HTTP TRACE method for debugging purposes.

The TRACE method can be exploited for Cross-Site Tracing attacks and should be disabled.

A
Enable the mod_info module to monitor server configuration.
Why wrong: mod_info exposes sensitive server information and should be disabled in production.
B
Disable directory listing in the Apache configuration using Options -Indexes.
Disabling directory listing prevents attackers from browsing directory contents.
C
Enable .htaccess files to allow per-directory configuration changes.
Why wrong: .htaccess files can introduce performance overhead and security risks; it's better to place configuration in the main server config.
D
Run the Apache worker processes as a non-root user such as www-data.
Running as a non-privileged user limits the impact of a security breach.
E
Enable the HTTP TRACE method for debugging purposes.
Why wrong: The TRACE method can be exploited for Cross-Site Tracing attacks and should be disabled.

Question 19mediummultiple choice

A company runs a critical database server on a Linux system. The server is subject to a strict compliance policy that requires all commands executed by the database administrator (user 'dbadmin') to be logged. Additionally, any attempt to change the system time must be logged regardless of the user. The administrator has configured auditd and added the following rules: -w /usr/bin -p x -k binary_exec, -a always,exit -F arch=b64 -S adjtimex -F key=time_change. However, during a compliance audit, it is discovered that not all commands executed by dbadmin are being logged. Which of the following is the most likely cause?

Trap 1: The auditd logs are being overwritten because the audit log file…

While log rotation could cause loss, it does not explain why commands are not being logged initially.

Trap 2: The auditd service is not running because the kernel was not…

Most distribution kernels include audit support; the service is running if rules are applied.

Trap 3: The adjtimex syscall rule is incorrect and prevents other rules…

The rule syntax is valid and does not interfere with other rules.

A
The auditd logs are being overwritten because the audit log file size is too small.
Why wrong: While log rotation could cause loss, it does not explain why commands are not being logged initially.
B
The auditd service is not running because the kernel was not compiled with audit support.
Why wrong: Most distribution kernels include audit support; the service is running if rules are applied.
C
The adjtimex syscall rule is incorrect and prevents other rules from being processed.
Why wrong: The rule syntax is valid and does not interfere with other rules.
D
The rule -w /usr/bin -p x only monitors executables in /usr/bin, not commands in other directories or built-in shell commands.
The rule only watches /usr/bin; dbadmin may run commands from elsewhere.