A Linux endpoint is experiencing a denial-of-service attack with a high volume of SYN packets. The administrator wants to mitigate the attack at the host level. Which iptables rule is most effective?

Add a rule to limit the rate of new TCP connections using the 'limit' match.

Drop all incoming packets from the attacker's IP address.

Increase the backlog queue size to handle more connections.

Disable the TCP stack's SYN cookies.

A company stores customer records in /data/customers.db. The file is owned by root:dbadmin with permissions 640. The dbadmin group contains the database administrators. A new auditor needs read-only access to this file, but should not be able to modify it or access other files in /data. Which approach should the administrator take?

Change the file owner to the auditor and set permissions to 400.

Copy the file to /tmp and give the auditor read permissions on the copy.

Add the auditor to the dbadmin group and change the file permissions to 644.

Create a new group 'auditors', add the auditor to it, and set an ACL granting read access to that group on the file.

Which of the following is a core security principle that should be applied to Linux endpoints to reduce the risk of privilege escalation?

Disabling all firewall rules to avoid connectivity issues

Granting all users sudo access to simplify administration

Running services with the minimum required privileges

Using the root account for daily administrative tasks

EC-CouncilCertified Network Defender

Domain 2Objective 3

Endpoint Security Linux Systems CND Practice Questions (Page 6)

Part of the Perimeter and Endpoint Security domain, which makes up ~24% of our current practice bank.

47questions here

10free pages

9concepts

Questions 26–30

26application · medium
A Linux endpoint is experiencing a denial-of-service attack with a high volume of SYN packets. The administrator wants to mitigate the attack at the host level. Which iptables rule is most effective?
Select an answer first
27foundation · easy
Which of the following is an open-source intrusion detection system (IDS) commonly used on Linux?
Select an answer first
28application · medium
A company stores customer records in /data/customers.db. The file is owned by root:dbadmin with permissions 640. The dbadmin group contains the database administrators. A new auditor needs read-only access to this file, but should not be able to modify it or access other files in /data. Which approach should the administrator take?
Select an answer first
29foundation · easy
Which of the following is a core security principle that should be applied to Linux endpoints to reduce the risk of privilege escalation?
Select an answer first
30foundation · easy
Which log file typically contains authentication-related events on a Linux system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.

Endpoint Security Linux Systems CND Practice Questions (Page 6)

Questions 26–30

A Linux endpoint is experiencing a denial-of-service attack with a high volume of SYN packets. The administrator wants to mitigate the attack at the host level. Which iptables rule is most effective?

Which of the following is an open-source intrusion detection system (IDS) commonly used on Linux?

Which of the following is a core security principle that should be applied to Linux endpoints to reduce the risk of privilege escalation?

Which log file typically contains authentication-related events on a Linux system?

Keep studying — Perimeter and Endpoint Security