LPIC-3_Part-2

55 What effect does the configuration SSLStrictSNIVHostCheck on have on an Apache HTTPD virtual host?. The clients connecting to the virtual host must provide a client certificate that was issued by the same CA that issued the server's certificate. The virtual host is served only to clients that support SNI. All of the names of the virtual host must be within the same DNS zone. The virtual host is used as a fallback default for all clients that do not support SNI. Despite its configuration, the virtual host is served only on the common name and Subject Alternative.

Which of the following keywords are built-in chairs for the iptables nat table? (Choose THREE correct answers.). OUTPUT. MASQUERADE. PROCESSING. POSTROUTING. PREROUTING.

n X509 certificate contains the following information; X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 Which of the following statements are true regarding the certificate? (Choose THREE correct answers.). This certificate belongs to a certification authority. This certificate may be used to sign certificates of subordinate certification authorities. This certificate may never be used to sign any other certificates. This certificate may be used to sign certificates that are not also a certification authority. This certificate will not be accepted by programs that do not understand the listed extension.

What is the purpose of the program snort-stat?. It displays statistics from the running Snort process. It returns the status of all configured network devices. It reports whether the Snort process is still running and processing packets. It displays the status of all Snort processes. It reads syslog files containing Snort information and generates port scan statistics.

Which command is used to set an extended attribute on a file in Linux?. getfattr. setfattr. getfacl. setfacl.

Which permission bit allows a file to be executed?. Read. Write. Execute. SetUID.

Which of the following is NOT a benefit of using HID?. Provides real-time detection of security incidents. Allows for quick response to security incidents. Helps prevent security incidents from occurring. Provides automatic removal of detected threats.

Which of the following practices are important for the security of private keys? (Choose TWO correct answers.). Private keys should be created on the systems where they will be used and should never leave them. Private keys should be uploaded to public key servers. Private keys should be included in X509 certificates. Private keys should have a sufficient length for the algorithm used for key generation. Private keys should always be stored as plain text files without any encryption.

In which path is the data, which can be altered by the sysctl command, accessible?. /dev/sys/. /sys/. /proc/sys/. /sysctl/.

Which file is used to configure AIDE?. /etc/rkhunter.conf. /etc/audit/auditd.conf. /etc/aide/aide.conf. etc/maldet.conf.

Which command is used to generate a new GnuPG key pair interactively?. gpg --gen-key. gpg --export. gpg --encrypt. gpg --list-keys.

What is a DoS attack?. An attack that targets a specific user or organization. An attack that aims to steal sensitive information. An attack that floods a network or server with traffic to make it unavailable. An attack that exploits a vulnerability in software.

When OpenVPN sends a control packet to its peer, it expects an acknowledgement in 2 seconds by default. Which of the following options changes the timeout period to 5 seconds?. -- tls-timeout 5. -- tls- timeout 500. -- tls- timer 5. -- tls- timer 500.

What is the purpose of Linux capabilities, as introduced to divide the traditional all-or-nothing root privilege model?. They replace the need for the setuid bit entirely on all binaries. They allow specific, granular privileges (such as binding to low-numbered ports) to be granted to a process without granting full root access. They are used only within containerized environments. They control network bandwidth allocation per process.

What is the purpose of the GnuPG "trust level" assigned to a key, as opposed to a signature on that key?. It indicates how strongly the key's authenticity has been verified. It indicates how much the owner trusts that key's holder to properly verify and sign other people's keys. It is identical in meaning to a key signature and is redundant. It determines the key's expiration date.

Which of the following DNS records are used in DNSSEC?. MX. TXT. RRSIG. PTR.

What is the primary purpose of Fail2ban?. To encrypt log files stored on disk. To monitor log files for repeated failed authentication attempts and dynamically block the offending IP address using firewall rules. To generate strong random passwords for user accounts. To replace the need for a firewall entirely.

Which PAM module checks new passwords against dictionary words and enforces complexity? (Specially the module name only without any path.).

Which of the following information, within a DNSSEC- signed zone, is signed by the key signing key?. The non-DNSSEC records like A, AAAA or MX. The zone signing key of the zone. The RRSIG records of the zone. The NSEC or NSEC3 records of the zone. The DS records pointing to the zone.

Which of the following utilities is used to generate keys for DNSSEC?. dnssec-dsfromkey. rndc. delv. dnssec-keygen.

Which of the following stanzas is a valid client configuration for FreeRADIUS. client private-network-1 { ipaddr = 192.0.2.0/24 password = testing123-1 }. client private-network-1 { ip = 192.0.2.0/24 password = testing123-1 }. client private-network-1 { ip = 192.0.2.0/24 passwd = testing123-1 }. client private-network-1 { ip = 192.0.2.0/24 secret = testing123-1 }. lient private-network-1 { ipaddr = 192.0.2.0/24 secret = testing123-1 }.

Which tool can be used to check for rootkits on a Linux system?. chkrootkit. AIDE. OpenSCAP. rpm.

Which tool is commonly used to perform a comprehensive network port scan, including service and OS fingerprinting, as part of a security assessment?. tcpdump. nmap. Wireshark. netstat.

Which of the following statements describes the purpose of ndpmon?. It monitors the network for neighbor discovery messages from new IPv6 hosts and routers. It monitors remote hosts by periodically sending echo requests to them. It monitors the availability of a network link by querying network interfaces. It monitors the network for IPv4 nodes that have not yet migrated to IPv6. It monitors log files for failed login attempts in order to block traffic from offending network nodes.

What is the purpose of OCSP stapling?. It allows the certificate authority to revoke a certificate faster. It allows the server, rather than the client, to periodically query the OCSP responder and attach the signed response to the TLS handshake. It replaces the need for a Certificate Revocation List entirely. It encrypts the OCSP request between client and CA.

How are SELinux permissions related to standard Linux permissions? (Choose TWO correct answers.). SELinux permissions override standard Linux permissions. Standard Linux permissions override SELinux permissions. SELinux permissions are verified before standard Linux permissions. SELinux permissions are verified after standard Linux permissions.

How can host scans be automated on a Linux system?. Using OpenSCAP. Using chkrootkit. Using Linux Audit system. Using cron.

Which of the following lines in an OpenSSL configuration adds an X 509v3 Subject Alternative Name extension for the host names example.org and www.example.org to a certificate?. subjectAltName = DNS: www.example.org, DNS:example.org. extension= SAN: www.example.org, SAN:example.org. subjectAltName: www.example.org, subjectAltName: example.org. commonName = subjectAltName= www.example.org, subjectAltName = example.org. subject= CN= www.example.org, CN=example.org.

Which of the following commands defines an audit rule that monitors read and write operations to the file/ etc/firewall/rules and associates the rule with the name firewall?. auditctl -N firewall -r r: /etc/firewall/rules -r w: etc/firewall/rules. auditctl -A -f /etc/firewall/rules -o r -o w -l firewall. auditctl -w /etc/firewall/rules -p rw -k firewall. auditctl --read /etc/firewall/rules --write /etc/firewall/rules --label firewall. echo "n: firewall r:/etc/firewall/rules: w:/etc/firewall/rules:" | auditctl ~.

What is the purpose of TSIG in DNS?. To encrypt DNS queries. To sign DNS messages for secure communication. To provide information about DNS servers. To map a domain name to an IP address.

What is a trust anchor?. A root certificate that is trusted by a particular CA. A list of public keys that are trusted by a particular CA. A list of private keys that are trusted by a particular CA. A key pair that is generated by a particular CA.

Which PAM module is used to enforce password complexity requirements, such as minimum length and character class requirements?. pam_unix. pam_cracklib or pam_pwquality. pam_limits. pam_access.

Which file defines the default set of resource limits, such as maximum open files or processes, applied to users via PAM?. /etc/security/limits.conf. /etc/pam.d/common-session. /etc/login.defs. /etc/sysctl.confs.

Which of the following prefixes could be present in the output of getcifsacl? (Choose THREE correct answers.). ACL. GRANT. GROUP. OWNER. SID.

Which of the following is a best practice for implementing HID?. Install HID on every computer in the network. Configure HID to block all incoming traffic. Configure HID to alert security personnel of potential security incidents. Disable HID when not actively monitoring for security incidents.

What is a symmetric key?. A key used for encryption and decryption that is the same. A key used for encryption that is different from the key used for decryption. A key used for decryption that is different from the key used for encryption. A key used for both encryption and decryption that is generated randomly.

What is the purpose of the Linux Audit system?. To manage system log files. To automate host scans. To detect intrusions and system changes. To manage installed packages.

Which of the following statements is true regarding eCryptfs?. For every file in an eCryptfs directory there exists a corresponding file that contains the encrypted content. The content of all files in an eCryptfs directory is stored in an archive file similar to a tar file with an additional index to improve performance. After unmounting an eCryptfs directory, the directory hierarchy and the original file names are still visible, although, it is not possible to view the contents of the files. When a user changes his login password, the contents of his eCryptfs home directory has to be reencrypted using his new login password. eCryptfs cannot be used to encrypt only directories that are the home directory of a regular Linux user.

What is a rogue access point?. A legitimate access point that is incorrectly configured. An unauthorized access point that is set up to look like a legitimate one. A type of virus. A type of phishing scam.

Which option in an Apache HTTPD configuration file enables OCSP stapling? (Specify ONLY the option name without any values or parameters.).

What is the purpose of the OpenVPN "tls-auth" or "tls-crypt" directive?. To disable TLS entirely and use a static key instead. To add an additional layer of HMAC authentication (or full encryption, with tls-crypt) to the TLS control channel, protecting against certain DoS and port-scanning attacks. To generate the server's X.509 certificate automatically. To compress the VPN traffic.

In apache configuration which directives are used to restrict access based on host/domain name and IP address?. restrict and allow. order, allow from and deny from. deny and accept. allow IP, deny IP, allow DOMAIN and deny DOMAIN. order, deny and accept.

Which mount option prevents the execution of binaries located on the mounted filesystem?. nodev. ro. nosuid. noexec.

Which of the following types can be specified within the Linux Audit system? (Choose THREE correct answers.). Control rules. File system rules. Network connection rules. Console rules. System call rules.

What is phishing?. A type of virus. A type of malware that disguises itself as legitimate software. A type of denial-of-service attack. A type of social engineering attack.

Which package management tools can be used to verify the integrity of installed files on a Linux system?. RPM and DPKG. APT and YUM. yum and zypper. dpkg and aptitude.

What happens when the command getfattr afile is run while the file afile has no extended attributes set?. getfattr prints a warning and exits with a values of 0. getfattr prints a warning and exits with a value of 1. No output is produced and getfattr exits with a value of 0. No outputs is produced and getfattr exits with a value of 1.

What is the purpose of a LUKS key slot?. It stores a copy of the encrypted data for redundancy. It stores an encrypted copy of the master key, protected by a specific passphrase or keyfile, allowing multiple independent unlock methods. It defines the filesystem type used on the encrypted volume. It stores the device's UUID.

Which command is used to add a temporary audit rule that monitors write access to the /etc/passwd file?. auditctl -w /etc/passwd -p wa -k passwd_changes. ausearch -f /etc/passwd. aureport -f /etc/passwd. auditd -w /etc/passwd.

Which mount option prevents the execution of binaries located on the mounted filesystem?. nosuid. noexec. nodev. ro.

What is the purpose of the pam_tally2 or pam_faillock module?. To enforce password expiration policies. To track failed login attempts and lock an account after a specified number of failures. To restrict resource usage per user session. To require multi-factor authentication.

Which command-line tool is commonly used to test and verify TLS/SSL configuration and certificate details of a remote server?. openssl s_clien. nmap -sV. tcpdump. ss -tlnp.

Which SELinux mode logs policy violations without actually enforcing the policy?. Enforcing. Permissive. Disabled. Targeted.

Which of the following commands changes the source IP address to 192.0.2.11 for all IPv4 packets which go through the network interface eth0?. iptables ~t nat ~A POSTROUTING ~o eth0 ~j SNAT --to~source 192.0.2.11. iptables ~t nat ~A PREROUTING ~i eth0 ~j SNAT --to~source 192.0.2.11. iptables ~t nat ~A POSTROUTING ~i eth0 ~j DNAT --to~source 192.0.2.11. iptables ~t mangle ~A POSTROUTING ~i eth0 ~j SNAT -to~source 192.0.2.11. iptables ~t mangle ~A POSTROUTING ~0 eth0 ~j SNAT -to~source 192.0.2.11.