Endpoint Security Linux Systems CND Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company runs a Linux mail server that also handles file transfers via vsftpd. The administrator wants to protect the server from malware that could be uploaded through FTP or delivered via email attachments. Which approach should be taken?

   • AInstall ClamAV and configure it to scan the FTP upload directory and the mail spool directory on a scheduled basis.
   • BEnable SELinux and set the FTP and mail services to permissive mode.
   • CSet the vsftpd configuration to allow anonymous uploads and rely on the mail server's built-in filtering.
   • DUse iptables to block all incoming traffic on ports 21 and 25.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A Linux server is being attacked with a distributed denial-of-service (DDoS) attack that uses many different source IPs. The administrator needs to mitigate the attack while maintaining service availability. Which action is most effective?

   • AIncrease the server's bandwidth to absorb the attack traffic.
   • BDisable the affected service to stop the attack.
   • CUse iptables to rate-limit incoming connections and enable SYN cookies.
   • DBlock all traffic from the IP ranges used in the attack.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has a mix of Linux and Windows systems. The security team wants to ensure that malware detected on Windows systems does not spread to Linux servers via shared files. Which approach is most effective?

   • ADisable all file sharing protocols like SMB and NFS on Linux servers.
   • BUse SELinux to prevent malware from executing on Linux.
   • CDeploy ClamAV on Linux servers and configure it to scan files on shared mounts and email attachments.
   • DSet up a firewall to block all traffic between Windows and Linux systems.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Linux server is being hardened. The administrator wants to ensure that only necessary services are running and that unused network ports are closed. Which sequence of actions should the administrator take?

   • ARun 'systemctl list-unit-files --type=service' to list services, then disable and stop any that are not required, and finally use 'ss -tuln' to verify listening ports.
   • BRun 'iptables -F' to flush all firewall rules, then rely on the default policy to block everything.
   • CRun 'systemctl stop firewalld' and then check open ports with 'netstat -l'.
   • DRun 'ss -tuln' first, then disable all services that are listening on any port.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which PAM module is commonly used to enforce password complexity requirements?

   • Apam_nologin.so
   • Bpam_limits.so
   • Cpam_pwquality.so
   • Dpam_unix.so
   Reveal Solution Discussion Select an answer first