LPIC-3

What is the purpose of the program snort-stat?. It displays statistics from the running Snort process. It returns the status of all configured network devices. It reports whether the Snort process is still running and processing packets. It displays the status of all Snort processes. It reads syslog files containing Snort information and generates port scan statistics.

Which of the following command lines sets the administrator password for ntop to testing 123?. ntop --set-admin-password=testing123. ntop --set-password=testing123. ntop --reset-password=testing123. ntop --set-new-password=testing123.

What is a DoS attack?. An attack that targets a specific user or organization. An attack that aims to steal sensitive information. An attack that floods a network or server with traffic to make it unavailable. An attack that exploits a vulnerability in software.

What is the purpose of NSEC3 in DNSSEC?. To provide information about DNSSEC key signing keys. To prevent zone enumeration. To authenticate a DNS server. To sign a DNS zone.

What effect does the configuration SSLStrictSNIVHostCheck on have on an Apache HTTPD virtual host?. The clients connecting to the virtual host must provide a client certificate that was issued by the same CA that issued the server's certificate. The virtual host is served only to clients that support SNI. All of the names of the virtual host must be within the same DNS zone. The virtual host is used as a fallback default for all clients that do not support SNI. Despite its configuration, the virtual host is served only on the common name and Subject.

Which of the following are differences between AppArmor and SELinux? (Choose TWO correct answers). AppArmor is implemented in user space only. SELinux is a Linux Kernel Module. AppArmor is less complex and easier to configure than SELinux. AppArmor neither requires nor allows any specific configuration. SELinux must always be manually configured. SELinux stores information in extended file attributes. AppArmor does not maintain file specific information and states. The SELinux configuration is loaded at boot time and cannot be changed later on. AppArmor provides user space tools to change its behavior.

What is a plaintext?. The original message before encryption. The encrypted message. The key used to encrypt the message. The algorithm used to encrypt the message.

Which protocol is commonly used to transmit X.509 certificates?. HTTPS. FTPS. SMTPS. LDAP.

What is a rogue access point?. A legitimate access point that is incorrectly configured. An unauthorized access point that is set up to look like a legitimate one. A type of virus. A type of phishing scam.

10 Which of the following commands changes the source IP address to 192.0.2.11 for all IPv4 packets which go through the network interface eth0?. iptables ~t nat ~A POSTROUTING ~o eth0 ~j SNAT --to~source 192.0.2.11. iptables ~t nat ~A PREROUTING ~i eth0 ~j SNAT --to~source 192.0.2.11. iptables ~t nat ~A POSTROUTING ~i eth0 ~j DNAT --to~source 192.0.2.11. iptables ~t mangle ~A POSTROUTING ~i eth0 ~j SNAT -to~source 192.0.2.11. iptables ~t mangle ~A POSTROUTING ~0 eth0 ~j SNAT -to~source 192.0.2.11.

What is the purpose of file ownership in Linux systems?. To enable multiple users to access files simultaneously. To restrict access to files only to their owner. To ensure that files are backed up regularly. To protect files from being accidentally deleted.

Which of the following utilities is used to generate keys for DNSSEC?. dnssec-dsfromkey. rndc. delv. dnssec-keygen.

Which of the following parameters to openssl s_client specifies the host name to use for TLS Server Name Indication?. -tlsname. -servername. -sniname. -vhost. -host.

Which of the following is used to perform DNSSEC validation on behalf of clients?. Recursive name server. Authoritative name server. Secondary name server. Primary name server.

Which of the following DNS record types can the command dnssec-signzone add to a zone? (Choose THREE correct answers.). ASIG. NSEC. NSEC3. NSSIG. RRSIGbehavior.

Which of the following is NOT a benefit of using HID?. Provides real-time detection of security incidents. Allows for quick response to security incidents. Helps prevent security incidents from occurring. Provides automatic removal of detected threats.

What is a Trojan?. A type of virus. A type of malware that disguises itself as legitimate software. A type of denial-of-service attack. A type of phishing scam.

What is host intrusion detection (HID)?. A system that detects malicious traffic on a network. A system that monitors and detects potential security threats on a single computer or server. A system that prevents malware from infecting a network. A system that scans files and folders for viruses.

Which directive is used in an OpenVPN server configuration in order to send network configuration information to the client? (Specify ONLY the option name without any values or parameters.).

Which command is used to set the permissions of a file in Linux?. chown. chmod. chgrp. setfacl.

What is the purpose of DNS over TLS and DNS over HTTPS?. To improve DNS performance. To provide secure communication between DNS clients and servers. To reduce DNS query times. To allow DNS servers to communicate securely with each other.

Which of the following authentication methods was added to NFS in version 4?. Kerberos authentication. SSH hostkey authentication. Winbind authentication. SSL certificate authentication.

What is a symmetric key?. A key used for encryption and decryption that is the same. A key used for encryption that is different from the key used for decryption. A key used for decryption that is different from the key used for encryption. A key used for both encryption and decryption that is generated randomly.

Which of the following commands adds a new user usera to FreeIPA?. useradd usera --directory ipa --gecos "User A". idap- useradd -H Idaps://ipa-server CN=UserA --attribs "Firstname: User: Lastname: A". ipa-admin create user --account usera --fname User --iname A. ipa user-add usera --first User --last A. ipa-user- add usera --name "User A".

When OpenVPN sends a control packet to its peer, it expects an acknowledgement in 2 seconds by default. Which of the following options changes the timeout period to 5 seconds?. -- tls-timeout 5. -- tls- timeout 500. -- tls- timer 5. -- tls- timer 500.

A LUKS device was mapped using the command: cryptsetup luksOpen/dev/sda1 crypt-vol Given that this device has three different keys, which of the following commands deletes only the first key?. cryptsetup luksDelKey /dev/sda 1 0. cryptsetup luksDelkey /dev/sda 1 1. cryptsetup luksDelKey / dev /mapper/crypt- vol 1. cryptsetup luksDelKey / dev /mapper/crypt- vol 0.

What is social engineering?. A type of virus. A type of malware that disguises itself as legitimate software. A type of denial-of-service attack. A type of attack that exploits human psychology to gain access to sensitive information.

Which of the following practices are important for the security of private keys? (choose two). Private keys should be created on the systems where they will be used and should never leave. Private keys should be uploaded to public key servers. Private keys should be included in X509 certificates. Private keys should have a sufficient length for the algorithm used for key generation. Private keys should always be stored as plain text files without any encryption.

Which tool can be used to manage the Linux Audit system?. auditd. rkhunter. chkrootkit. maldet.

Which of the following resources of a shell and its child processes can be controlled by the Bash build- in command ulimit? (Choose THREE correct answers.). The maximum size of written files. The maximum number of open file descriptors. The maximum number of newly created files. The maximum number of environment variables. The maximum number of user processes.

What is the purpose of an access control list in Linux?. To specify fine-grained permissions for users and groups. To encrypt a file for secure transmission. To compress a file to save disk space. To mark a file as executable.

Which of the following statements are true regarding the certificate of a Root CA? (Choose THREE correct answers.). It is a self-signed certificate. It does not include the private key of the CA. It must contain a host name as the common name. It has an infinite lifetime and never expires. It must contain an X509v3 Authority extension.

Which command installs and configures a new FreeIPA server, including all sub-components, and creates a new FreeIPA domain? Specially ONLY the command without any path or parameters).

Given a proper network and name resolution setup, which of the following commands establishes a trust between a FreeIPA domain and an Active Directory domain?. ipa trust-add --type ad addom --admin Administrator --password. ipa-ad -add-trust --account ADDOM\Administrator--query-password. net ad ipajoin addom -U Administrator -p. trustmanager add --domain ad: //addom --user Administrator -w. ipa ad join addom -U Administrator -w.

Which of the following prefixes could be present in the output of getcifsacl? (Choose THREE correct answers.). ACL. GRANT. GROUP. OWNER. SID.

What happens when the command getfattr afile is run while the file afile has no extended attributes set?. getfattr prints a warning and exits with a values of 0. getfattr prints a warning and exits with a value of 1. No output is produced and getfattr exits with a value of 0. No outputs is produced and getfattr exits with a value of 1.

What is the purpose of a TLSA record in DANE?. To provide information about a TLS server. To sign a TLS server's public key. To authenticate a DNS server. To map a domain name to an IP address.

What is a rootkit?. A type of virus. A type of malware that disguises itself as legitimate software. A type of denial-of-service attack. A type of phishing scam.

Which command included in the Linux Audit system provides searching and filtering of the audit log? (Specify ONLY the command without any path or parameters.).

Which of the following expressions are valid AIDE rules?(Choose TWO correct answers.). !/var/run/.*. append: /var/log/*. /usr=all. #/bin/. /etc p+i+u+g.

Which permission bit allows a user to delete a file?. Read. Write. Execute. SetUID.

Which of the following access control models is established by using SELinux?. Security Access Control (SAC). Group Access Control (GAC). User Access Control (UAC). Discretionary Access Control (DAC). Mandatory Access Control (MAC).

Which command is used to set an extended attribute on a file in Linux?. getfattr. setfattr. getfacl. setfacl.

What is a man-in-the-middle attack?. An attack that targets a specific user or organization. An attack that aims to steal sensitive information. An attack that intercepts communications between two parties to steal information. An attack that floods a network or server with traffic to make it unavailable.

Which of the following components are part of FreeIPA? (Choose THREE correct answers.). DHCP Server. Kerberos KDC. Intrusion Detection System. Public Key Infrastructure. Directory Server.

Which of the following database names can be used within a Name Service Switch (NSS). (Choose THREE correct answers). host. shadow. service. passwd. group.

Which of the following DNS records is used to publish X.509 certificate and certificate authority information in DNS?. DS. CAA. NSEC. A.

Which option of the openvpn command should be used to ensure that ephemeral keys are not written to the swap space?. --keys-no-swap. --root-swap. --no-swap. --mlock.

Linux Extended File Attributes are organized in namespaces. Which of the following names correspond to existing attribute namespaces?(Choose THREE correct answers.). default. system. owner. trusted. user.

Which of the following statements describes the purpose of ndpmon?. It monitors the network for neighbor discovery messages from new IPv6 hosts and routers. It monitors remote hosts by periodically sending echo requests to them. It monitors the availability of a network link by querying network interfaces. It monitors the network for IPv4 nodes that have not yet migrated to IPv6. It monitors log files for failed login attempts in order to block traffic from offending network.

What type of activity does HID monitor for?. Malware infections. Unauthorized access attempts. Network traffic. File and folder changes.

What is the purpose of an extended attribute in Linux?. To store additional metadata about a file. To encrypt a file for secure transmission. To compress a file to save disk space. To mark a file as executable.

Which file is used to configure rkhunter?. /etc/rkhunter.conf. /etc/audit/auditd.conf. /etc/aide/aide.conf. /etc/maldet.conf.

Which of the following commands makes the contents of the eCryptfs encrypted directory ~/Private available to the user?. ecryptfsclient. ecryptfs.mount. ecryptfs-mount-private. decryptfs. ecryptfs-manage-directory.

Which file is used to configure AIDE?. /etc/rkhunter.conf. /etc/audit/auditd.conf. /etc/aide/aide.conf. /etc/maldet.conf.

How are SELinux permissions related to standard Linux permissions? (Choose TWO correct answers.). SELinux permissions override standard Linux permissions. Standard Linux permissions override SELinux permissions. SELinux permissions are verified before standard Linux permissions. SELinux permissions are verified after standard Linux permissions.

Which of the following types can be specified within the Linux Audit system? (Choose THREE correct answers.). Control rules. File system rules. Network connection rules. Console rules. System call rules.

What is a buffer overflow?. A type of virus. A type of malware that disguises itself as legitimate software. A type of denial-of-service attack. A type of software vulnerability.

What is a ciphertext?. The original message before encryption. The encrypted message. The key used to encrypt the message. The algorithm used to encrypt the message.

What is the purpose of AIDE?. To manage system log files. To detect intrusions and system changes. To manage installed packages. To automate host scans.

What is privilege escalation?. An attack that targets a specific user or organization. An attack that aims to steal sensitive information. An attack that exploits a vulnerability to gain elevated privileges. An attack that floods a network or server with traffic to make it unavailable.

62 Which DNS label points to the DANE information used to secure HTTPS connections to https://www.example.com/?. example.comn. dane.www.example.com. soa.example.com. www.example.com. _443_tcp.www.example.com.

Which of the following is a best practice for implementing HID?. Install HID on every computer in the network. Configure HID to block all incoming traffic. Configure HID to alert security personnel of potential security incidents. Disable HID when not actively monitoring for security incidents.

Which package management tools can be used to verify the integrity of installed files on a Linux system?. RPM and DPKG. APT and YUM. dpkg and aptitude. yum and zypper.

What is a certificate chain?. A chain of digital signatures used to verify the authenticity of a certificate. A sequence of certificates used to verify the authenticity of a digital certificate. A chain of public and private keys used for encryption and decryption. A sequence of public and private keys used for encryption and decryption.

What is the purpose of a DNSKEY record in DNSSEC?. To verify the authenticity of a DNS query. To sign a DNS zone. To provide information about a DNS server. To map an IP address to a hostname.

Which of the following openssl commands generates a certificate signing request (CSR) using the already existing private key contained in the file private/ keypair.pem?. openssl req -key private/keypair.pem -out req/csr.pem. openssl req - new -key private/keypair.pem -out req/csr.pem. openssl gencsr -key private/keypair.pem -out req/csr.pem. openssl gencsr -new- key private/keypair.pem -out req/csr.pem.

Which of the following DNS records is used to map an IP address to a hostname?. PTR. SOA. NS. A.

What option of mount.cifs specifies the user that appears as the local owner of the files of a mounted CIFS share when the server does not provide ownership information? (Specify ONLY the option name without any values or parameters.).

What is a trust anchor?. A root certificate that is trusted by a particular CA. A list of public keys that are trusted by a particular CA. A list of private keys that are trusted by a particular CA. A key pair that is generated by a particular CA.

What is the purpose of file ownership in Linux systems?. To restrict access to files only to their owner. To enable multiple users to access files simultaneously. To enable multiple users to access files simultaneously. To protect files from being accidentally deleted.

Which of the following commands defines an audit rule that monitors read and write operations to the file/ etc/firewall/rules and associates the rule with the name firewall?. auditctl -N firewall -r r: /etc/firewall/rules -r w: etc/firewall/rules. auditctl -A -f /etc/firewall/rules -o r -o w -l firewall. auditctl -w /etc/firewall/rules -p rw -k firewall. auditctl --read /etc/firewall/rules --write /etc/firewall/rules --label firewall. echo "n: firewall r:/etc/firewall/rules: w:/etc/firewall/rules:" | auditctl ~.

Which of the following lines in an OpenSSL configuration adds an X 509v3 Subject Alternative Name extension for the host names example.org and www.example.org to a certificate?. subjectAltName = DNS: www.example.org, DNS:example.org. extension= SAN: www.example.org, SAN:example.org. subjectAltName: www.example.org, subjectAltName: example.org. commonName = subjectAltName= www.example.org, subjectAltName = example.org. subject= CN= www.example.org, CN=example.org.

What is OCSP stapling?. A mechanism that allows a server to provide proof of the revocation status of its own SSL/TLS certificate. A mechanism that allows a server to provide proof of the revocation status of all certificates issued by a particular Certificate Authority. A mechanism that allows a server to provide proof of its own identity to clients. A mechanism that allows a server to provide proof of a client's identity to other servers.

What is an asymmetric key?. A key used for encryption and decryption that is the same. A key used for encryption that is different from the key used for decryption. A key used for decryption that is different from the key used for encryption. A key used for both encryption and decryption that is generated in a pair.

Which option in an Apache HTTPD configuration file enables OCSP stapling? (Specify ONLY the option name without any values or parameters.).

Which of the following sections are allowed within the Kerberos configuration file krb5.conf? (Choose THREE correct answers.). [plugins]. [crypto]. [domain]. [capaths]. [realms].

What effect does the following command have on TCP packets? iptables- A INPUT d 10.142.232.1 p tcp --dport 20:21 j ACCEPT. Forward all TCP traffic not on port 20 or 21 to the IP address 10.142.232.1. Drop all TCP traffic coming from 10.142.232.1 destined for port 20 or 21. Accept only TCP traffic from 10.142.232.1 destined for port 20 or 21. Accept all TCP traffic on port 20 and 21 for the IP address 10.142.232.1.

Which PAM module checks new passwords against dictionary words and enforces complexity? (Specially the module name only without any path.).

How does TSIG authenticate name servers in order to perform secured zone transfers?. Both servers mutually verify their X509 certificates. Both servers use a secret key that is shared between the servers. Both servers verify appropriate DANE records for the labels of the NS records used to delegate the transferred zone. Both servers use DNSSEC to mutually verify that they are authoritative for the transferred zone.

What is the purpose of the Linux Audit system?. To manage system log files. To automate host scans. To detect intrusions and system changes. To manage installed packages.

What is an X.509 Certificate?. A digital document that verifies the identity of a website. A digital document that verifies the identity of a person. A digital document that verifies the identity of a device. A digital document that verifies the identity of a company.

Which of the following commands disables the automatic password expiry for the user usera?. chage --maxdays none usera. chage --maxdays 99 usera. chage --maxdays -1 usera. chage --lastday none usera. chage --lastday 0 usera.

Which of the following DNS records are used in DNSSEC?. MX. TXT. RRSIG. PTR.

What is a honeypot?. A type of virus. A network security tool designed to lure attackers into a trap. A type of phishing scam. A type of denial-of-service attack.

Which permission bit allows a file to be executed?. Read. Write. Execute. SetUID.

Which option in an Apache HTTPD configuration file enables OCSP stapling? (Specify ONLY the option name without any values or parameters.).

How can host scans be automated on a Linux system?. Using OpenSCAP. Using chkrootkit. Using Linux Audit system. Using cron.

Which option of the openvpn command should be used to ensure that ephemeral keys are not written to the swap space?. --mlock. --no-swap. --root-swap. --keys-no-swap.

What is the purpose of rkhunter?. To manage system log files. To detect rootkits and other security threats. To manage installed packages. To automate host scans.

Which of the following is an example of an HID tool?. Antivirus software. Firewall. Security information and event management (SIEM) system. Intrusion prevention system (IPS).

What is Cryptography?. The art of sending secret messages. The art of sending public messages. The art of sending anonymous messages. The art of decoding messages.

Which of the following is an example of a behavioral-based HID technique?. Signature-based detection. Anomaly-based detection. Heuristic-based detection. Rule-based detection.

Which of the following stanzas is a valid client configuration for FreeRADIUS?. client private-network-1 { ipaddr = 192.0.2.0/24 password = testing123-1 }. client private-network-1 { ip = 192.0.2.0/24 password = testing123-1 }. client private-network-1 { ip = 192.0.2.0/24 passwd = testing123-1 }. client private-network-1 { ip = 192.0.2.0/24 secret = testing123-1 }. client private-network-1 { ipaddr = 192.0.2.0/24 secret = testing123-1 }.

Which of the following statements is true about chroot environments?. Symbolic links to data outside the chroot path are followed, making files and directories accessible. Hard links to files outside the chroot path are not followed, to increase security. The chroot path needs to contain all data required by the programs running in the chroot environment. Programs are not able to set a chroot path by using a function call, they have to use the command chroot. When using the command chroot, the started command is running in its own namespace and cannot communicate with other processes.

Which command is used to run a new shell for a user changing the SELinux context? (Specify ONLY the command without any path or parameters.).

Which of the following commands adds users using SSSD's local service?. sss_adduser. sss_useradd. sss_add. sss-addlocaluser. sss_local_adduser.

What is the purpose of IP sets?. They group together IP addresses that are assigned to the same network interfaces. They group together IP addresses and networks that can be referenced by the network routing table. They group together IP addresses that can be referenced by netfilter rules. They group together IP and MAC addresses used by the neighbors on the local network. They group together IP addresses and user names that can be referenced from /etc/hosts.allow and /etc/hosts.deny.

Which of the following statements is used in a parameter file for setkey in order to create a new SPD entry?. spd. addspd. newspd. spdnew. spdadd.

What is phishing?. A type of virus. A type of malware that disguises itself as legitimate software. A type of denial-of-service attack. A type of social engineering attack.

What is the purpose of a Certificate Authority (CA)?. To issue and sign X.509 certificates. To encrypt X.509 certificates. To decrypt X.509 certificates. To decrypt X.509 certificates.

An X509 certificate contains the following information: X509v3 Basic Constraints: critical CA:TRUE, pathlen:0 Which of the following statements are true regarding the certificate? (Choose THREE correct answers.). This certificate belongs to a certification authority. This certificate may be used to sign certificates of subordinate certification authorities. This certificate may never be used to sign any other certificates. This certificate may be used to sign certificates that are not also a certification authority. This certificate will not be accepted by programs that do not understand the listed extension.

In which path is the data, which can be altered by the sysctl command, accessible?. /dev/sys/. /sys/. /proc/sys/. /sysctl/.

Which of the following statements are valid wireshark capture filters? (Choose TWO correct answers.). port range 10000:tcp-15000:tcp. port-range tcp 10000-15000. tcp portrange 10000-15000. portrange 10000/tcp-15000/tcp. portrange 10000-15000 and tcp.

Which of the following methods can be used to deactivate a rule in Snort? (Choose TWO correct answers.). By placing a # in front of the rule and restarting Snort. By placing a pass rule in local.rules and restarting Snort. By deleting the rule and waiting for Snort to reload its rules files automatically. By adding a pass rule to /etc/snort/rules.deactivated and waiting for Snort to reload its rules files automatically.

Which command revokes ACL-based write access for groups and named users on the file afile?. setfacl -x group: * : rx, user:*: rx afile. setfacl -x mask: : rx afile. setfacl ~m mask: : rx afile. setfacl ~m group: * : rx, user :*: rx afile.

Which of the following commands displays all ebtable rules contained in the table filter including their packet and byte counters?. ebtables -t nat -L -v. ebtables -L -t filter -Lv. ebtables -t filter -L --Lc. ebtables -t filter -Ln -L. ebtables -L -Lc -t filter.

Which of the following keywords are built-in chairs for the iptables nat table? (Choose THREE correct answers.). OUTPUT. MASQUERADE. PROCESSING. POSTROUTING. PREROUTING.

What is the purpose of TSIG in DNS?. To encrypt DNS queries. To sign DNS messages for secure communication. To provide information about DNS servers. To map a domain name to an IP address.

Which command is used to view the access control list of a file?. ls. chmod. getfacl. setfacl.

Which of the following information, within a DNSSEC- signed zone, is signed by the key signing key?. The non-DNSSEC records like A, AAAA or MX. The zone signing key of the zone. The RRSIG records of the zone. The NSEC or NSEC3 records of the zone. The DS records pointing to the zone.

Which tool can be used to check for rootkits on a Linux system?. chkrootkit. AIDE. OpenSCAP. rpm.

Which of the following terms refer to existing scan techniques with nmap? (Choose TWO correct answers. Xmas Scan. Zero Scan. FIN Scan. IP Scan. UDP SYN Scan.

Which of the following statements is true regarding eCryptfs?. For every file in an eCryptfs directory there exists a corresponding file that contains the encrypted content. The content of all files in an eCryptfs directory is stored in an archive file similar to a tar file with an additional index to improve performance. After unmounting an eCryptfs directory, the directory hierarchy and the original file names are still visible, although, it is not possible to view the contents of the files. When a user changes his login password, the contents of his eCryptfs home directory has to be reencrypted using his new login password. eCryptfs cannot be used to encrypt only directories that are the home directory of a regular Linux user.

What is a Certificate Revocation List (CRL)?. A list of X.509 certificates that have been issued by a particular CA. A list of X.509 certificates that have been revoked by a particular CA. A list of public keys that have been compromised. A list of private keys that have been compromised.

What is the difference between a SetUID and SetGID bit?. SetUID applies to files, while SetGID applies to directories. SetUID allows a file to be executed with the permissions of the file owner, while SetGID allows a file to be executed with the permissions of the group owner. SetUID allows a user to change the owner of a file, while SetGID allows a user to change the group owner of a file. There is no difference between SetUID and SetGID.

What is Linux Malware Detect?. A package management tool. A tool to automate host scans. A tool to detect malware on a Linux system. A configuration management tool.

Which command, included in BIND, generates DNSSEC keys? (Specify ONLY the command without any path or parameters.).

Which of the following configuration options makes Apache HTTPD require a client certificate for authentication?. Limit valid-x509. SSLRequestClientCert always. Require valid-x509. SSLVerifyClient require. SSLPolicy valid-client-cert.