Endpoint Security Linux Systems CND Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A Linux endpoint is experiencing intermittent network issues. The administrator suspects a rogue process is generating traffic. The administrator needs to identify the process and determine if it is malicious, but the process name is obfuscated and changes frequently. Which approach should be taken?

   • ARun 'top' and look for processes with high CPU usage.
   • BUse 'lsof -i' to list all network connections and correlate with process IDs, then check the process executable path with 'readlink /proc/PID/exe'.
   • CUse 'netstat -tunap' and kill any process that is not recognized.
   • DRun 'tcpdump' and capture all traffic, then analyze the packets offline.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Linux administrator wants to implement two-factor authentication for SSH logins. The system currently uses password authentication. Which PAM configuration should be used to require both a password and a one-time code from an authenticator app?

   • AConfigure pam_radius.so as the only authentication module in the sshd PAM stack.
   • BSet PasswordAuthentication no and UsePAM yes in sshd_config.
   • CConfigure pam_securetty.so in the sshd PAM stack.
   • DConfigure pam_google_authenticator.so as a required module in the sshd PAM stack, and set ChallengeResponseAuthentication yes in sshd_config.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A Linux administrator is concerned about malware that could be introduced via email attachments. The mail server is on a Linux system. Which additional security measure should be implemented?

   • AInstall ClamAV and integrate it with the mail transfer agent (MTA) to scan incoming emails.
   • BSet up a honeypot to detect malware in emails.
   • CUse iptables to block all email traffic from external sources.
   • DEnable SELinux to prevent malware from executing.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team needs to detect a potential insider threat on a Linux system. The threat involves a user who is attempting to access files outside their department. The team wants to set up auditing to capture all file access attempts, including successful and failed ones, and to be alerted in real time. Which configuration is most appropriate?

   • AEnable SELinux to log all file access denials.
   • BConfigure auditd with watches on sensitive directories and use a real-time log analysis tool like auditd's dispatcher or a SIEM.
   • CSet up a cron job to run 'last' and 'grep' for user activity.
   • DUse the 'find' command to periodically list files with recent access times.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which command is used to update package lists and upgrade all packages on a Debian-based Linux system?

   • Ayum update
   • Bpacman -Syu
   • Capt update && apt upgrade
   • Ddnf upgrade
   Reveal Solution Discussion Select an answer first