Endpoint Security Linux Systems CND Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary role of Pluggable Authentication Modules (PAM) in Linux?

   • ATo compile kernel modules
   • BTo manage disk partitions
   • CTo monitor network traffic
   • DTo provide a modular framework for authentication
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary purpose of the auditd daemon on Linux?

   • ATo schedule system backups
   • BTo manage user passwords
   • CTo configure network interfaces
   • DTo record security-relevant events for auditing and compliance
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which command is used to change the ownership of a file on Linux?

   • Achown
   • Bchmod
   • Cchgrp
   • Dumask
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst suspects that a Linux endpoint was compromised. The analyst needs to determine which commands were executed by a specific user and when, and also see if any files were modified during the suspected time window. Which logging and auditing approach provides the most comprehensive evidence?

   • AReview the syslog messages for authentication events only.
   • BCheck the bash history file of the user and compare file timestamps.
   • CUse the last command to see login times and rely on that to infer activity.
   • DEnable auditd with rules to watch user command execution and file modifications, then review the audit logs.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A Linux system has a user account 'john' who is leaving the company. The administrator needs to ensure that john's access is revoked immediately, but the files he owns must remain accessible to his manager. Which steps should be taken?

   • ADelete john's account with 'userdel john' and leave his files in place.
   • BLock john's account with 'usermod -L john' and change ownership of his files to the manager using 'chown manager:manager /home/john/*'.
   • CChange john's password to a random value and do not modify file ownership.
   • DAdd john to the manager's group and set the files to group-writable.
   Reveal Solution Discussion Select an answer first