LPIC-3_Part-1

Which Fail2ban configuration file typically contains local, site-specific overrides that should not be modified in the default jail.conf file?. jail.local. fail2ban.conf. action.d/iptables.conf. filter.d/sshd.conf.

In an IPsec implementation using strongSwan, what is the purpose of the Internet Key Exchange (IKE) protocol?. To encrypt the actual data payload of IPsec traffic. To negotiate and establish the Security Associations (SAs) and cryptographic keys used by IPsec. To route IPsec packets across the internet. To compress IPsec traffic before encryption.

Which of the following is an example of a behavioral-based HID technique?. Signature-based detection. Anomaly-based detection. Heuristic-based detection. Rule-based detection.

Which of the following commands displays all ebtable rules contained in the table filter including their packet and byte counters?. ebtables -t nat -L -v. ebtables -L -t filter -Lv. ebtables -t filter -L --Lc. ebtables -t filter -Ln -L. ebtables -L -Lc -t filter.

Which of the following commands displays all ebtable rules contained in the table filter including their packet and byte counters?. setfacl -x group: * : rx, user:*: rx afile. setfacl -x mask: : rx afile. setfacl ~m mask: : rx afile. setfacl ~m group: * : rx, user :*: rx afile.

Which command displays currently listening TCP and UDP sockets along with the process ID and name of the associated program?. ss -tulnp. ping -c 4. traceroute. dig.

Which of the following are differences between AppArmor and SELinux? (Choose TWO correct answers). AppArmor is implemented in user space only. SELinux is a Linux Kernel Module. AppArmor is less complex and easier to configure than SELinux. AppArmor neither requires nor allows any specific configuration. SELinux must always be manuallyconfigured. SELinux stores information in extended file attributes. AppArmor does not maintain file specific information and states. The SELinux configuration is loaded at boot time and cannot be changed later on. AppArmor provides user space tools to change its behavior.

Which of the following commands adds a new user usera to FreeIPA?. useradd usera --directory ipa --gecos "User A". idap- useradd -H Idaps://ipa-server CN=UserA --attribs "Firstname: User: Lastname: A". ipa-admin create user --account usera --fname User --iname A. ipa user-add usera --first User --last A. ipa-user- add usera --name "User A".

Which of the following commands disables the automatic password expiry for the user usera?. chage --maxdays none usera. chage --maxdays 99 usera. chage --maxdays -1 usera. chage --lastday none usera. chage --lastday 0 usera.

What is the difference between a SetUID and SetGID bit?. SetUID applies to files, while SetGID applies to directories. SetUID allows a file to be executed with the permissions of the file owner, while SetGID allows a file to be executed with the permissions of the group owner. SetUID allows a user to change the owner of a file, while SetGID allows a user to change the group owner of a file. There is no difference between SetUID and SetGID.

hich strongSwan configuration file typically defines the connection definitions, including the local and remote endpoints and authentication method for an IPsec VPN?. /etc/ipsec.conf. /etc/ipsec.secrets. /etc/strongswan.conf. /etc/ipsec.d/certs.

Which command is used to set the permissions of a file in Linux?. chown. chmod. chgrp. setfacl.

Which of the following commands makes the contents of the eCryptfs encrypted directory ~/Private available to the user?. ecryptfsclient. ecryptfs.mount. decryptfs. ecryptfs-manage-directory.

What does the following iptables rule accomplish: iptables -A INPUT -s !127.0.0.0/8 -p tcp -dport 111 -j DROP. Drops all packets from the LAN destined for port 111. Drops all packets originating from the local machine unless they are destined for port 111. Drops all packets destined for port 111 which originate from the local machine. Drops all packets destined for port 111 unless they are from the local machine.

Which of the following components are part of FreeIPA? (Choose THREE correct answers.). DHCP Server. Kerberos KDC. Intrusion Detection System. Public Key Infrastructure. Directory Server.

A LUKS device was mapped using the command: cryptsetup luksOpen/dev/sda1 crypt-vol Given that this device has three different keys, which of the following commands deletes only the first key?. cryptsetup luksDelKey /dev/sda 1 0. cryptsetup luksDelkey /dev/sda 1 1. cryptsetup luksDelKey / dev /mapper/crypt- vol 1. cryptsetup luksDelKey / dev /mapper/crypt- vol 0.

What is a man-in-the-middle attack?. An attack that targets a specific user or organization. An attack that aims to steal sensitive information. An attack that intercepts communications between two parties to steal information. An attack that floods a network or server with traffic to make it unavailable.

What is the purpose of file ownership in Linux systems?. To restrict access to files only to their owner. To enable multiple users to access files simultaneously. To ensure that files are backed up regularly. To protect files from being accidentally deleted.

Which of the following openssl commands generates a certificate signing request (CSR) using the already existing private key contained in the file private/ keypair.pem?. openssl req -key private/keypair.pem -out req/csr.pem. openssl req - new -key private/keypair.pem -out req/csr.pem. openssl gencsr -key private/keypair.pem -out req/csr.pem. openssl gencsr -new- key private/keypair.pem -out req/csr.pem.

Which command is used to run a new shell for a user changing the SELinux context? (Specify ONLY the command without any path or parameters.).

What is a ciphertext?. The original message before encryption. The encrypted message. The key used to encrypt the message. The algorithm used to encrypt the message.

What is a Certificate Revocation List (CRL)?. A list of X.509 certificates that have been issued by a particular CA. A list of X.509 certificates that have been revoked by a particular CA. A list of public keys that have been compromised. A list of private keys that have been compromised.

What is Cryptography?. The art of sending secret messages. The art of sending public messages. The art of sending anonymous messages. The art of decoding messages.

Which tool can be used to manage the Linux Audit system?. auditd. rkhunter. chkrootkit. maldet.

Which IPsec mode encapsulates and protects the entire original IP packet, including its header, typically used for site-to-site VPN gateways?. Transport mode. Tunnel mode. Aggressive mode. Main mode.

Which command displays the capabilities currently assigned to a specific binary file?. getcap /path/to/binary. setcap /path/to/binary. capsh --print. chmod +cap /path/to/binary.

What option of mount.cifs specifies the user that appears as the local owner of the files of a mounted CIFS share when the server does not provide ownership information? (Specify ONLY the option name without any values or parameters.).

What is a rootkit?. A type of virus. A type of malware that disguises itself as legitimate software. A type of denial-of-service attack. A type of phishing scam.

Which of the following DNS record types can the command dnssec-signzone add to a zone? (Choose THREE correct answers.). ASIG. NSEC. NSEC3. NSSIG. RRSIG.

Which of the following statements are true regarding the certificate of a Root CA? (Choose THREE correct answers.). It is a self-signed certificate. It does not include the private key of the CA. It must contain a host name as the common name. It has an infinite lifetime and never expires. It must contain an X509v3 Authority extension.

What is the purpose of IP sets?. They group together IP addresses that are assigned to the same network interfaces. They group together IP addresses and networks that can be referenced by the network routing table. They group together IP addresses that can be referenced by netfilter rules. They group together IP and MAC addresses used by the neighbors on the local network. They group together IP addresses and user names that can be referenced from /etc/hosts.allow and /etc/hosts.deny.

Which command, included in BIND, generates DNSSEC keys? (Specify ONLY the command without any path or parameters.).

What is the purpose of a Certificate Revocation List (CRL)?. It lists certificates that have not yet been issued. It lists certificates that have been revoked by the issuing CA before their expiration date. It lists all valid certificates currently trusted by a client. It replaces the need for certificate expiration dates.

What is social engineering?. A type of virus. A type of malware that disguises itself as legitimate software. A type of denial-of-service attack. A type of attack that exploits human psychology to gain access to sensitive information.

Which command switches an AppArmor profile from complain mode into enforce mode?. aa-complain. aa-audit. aa-enforce. aa-disable.

Which DNS label points to the DANE information used to secure HTTPS connections to https://www.example.com/?. example.com. dane.www.example.com. soa.example.com. www.example.com. _443_tcp.www.example.com.

Which of the following configuration options makes Apache HTTPD require a client certificate for authentication?. Limit valid-x509. SSLRequestClientCert always. Require valid-x509. SSLVerifyClient require. SSLPolicy valid-client-cert.

What is a certificate chain?. A chain of digital signatures used to verify the authenticity of a certificate. A sequence of certificates used to verify the authenticity of a digital certificate. A chain of public and private keys used for encryption and decryption. A sequence of public and private keys used for encryption and decryption.

Which of the following statements is true about chroot environments?. Symbolic links to data outside the chroot path are followed, making files and directories accessible. Hard links to files outside the chroot path are not followed, to increase security. The chroot path needs to contain all data required by the programs running in the chroot environment. Programs are not able to set a chroot path by using a function call, they have to use the command chroot. When using the command chroot, the started command is running in its own namespace and cannot communicate with other processes.

What is the purpose of a TLSA record in DANE?. To provide information about a TLS server. To sign a TLS server's public key. To authenticate a DNS server. To map a domain name to an IP address.

Which of the following methods can be used to deactivate a rule in Snort? (Choose TWO correct answers.). By placing a # in front of the rule and restarting Snort. By placing a pass rule in local.rules and restarting Snort. By deleting the rule and waiting for Snort to reload its rules files automatically. By adding a pass rule to /etc/snort/rules.deactivated and waiting for Snort to reload its rules files automatically.

What is an asymmetric key?. A key used for encryption and decryption that is the same. A key used for encryption that is different from the key used for decryption. A key used for decryption that is different from the key used for encryption. A key used for both encryption and decryption that is generated in a pair.

What type of activity does HID monitor for?. Malware infections. Unauthorized access attempts. Network traffic. File and folder changes.

What command is used to update NVTs from the OpenVAS NVT feed? (Specify ONLY the command without any path or parameters).

What is a Trojan?. A type of virus. A type of malware that disguises itself as legitimate software. A type of denial-of-service attack. A type of phishing scam.

Which of the following database names can be used within a Name Service Switch (NSS) configuration file?(Choose THREE correct answers). host. shadow. service. passwd. group.

What is the purpose of an extended attribute in Linux?. To store additional metadata about a file. To encrypt a file for secure transmission. To compress a file to save disk space. To mark a file as executable.

Which of the following commands lists the extended attributes set on a file?. lsattr. getfacl. getfattr. stat.

In nftables, what is the purpose of a "base chain" as opposed to a "regular chain"?. A base chain can only contain accept rules. A base chain is directly attached to a netfilter hook, such as input or forward, allowing it to receive packets from the kernel. A base chain is used only for NAT rules. There is no functional difference between base and regular chains.

What is a buffer overflow?. A type of virus. A type of malware that disguises itself as legitimate software. A type of denial-of-service attack. A type of software vulnerability.

Which auditd configuration file is used to define audit rules that control which system calls and files are monitored?. /etc/audit/auditd.conf. /etc/audit/rules.d/audit.rules. /etc/audisp/audispd.conf. /var/log/audit/audit.log.

In Suricata, what is the purpose of a "rule" file, such as those found in the emergingthreats. rules collection?. It defines firewall NAT translation rules. It defines the signatures and conditions used to detect specific types of malicious or suspicious network traffic. It configures which network interfaces Suricata should monitor. It defines user authentication policies for the Suricata management interface.

Which of the following authentication methods was added to NFS in version 4?. Kerberos authentication. SSH hostkey authentication. Winbind authentication. SSL certificate authentication.

Which of the following DNS records is used to publish X.509 certificate and certificate authority information in DNS?. DS. CAA. NSEC. A.