A network defender is investigating a potential intrusion on a Linux endpoint. The defender wants to see a list of all active network connections and the associated processes. Which command should be used?

Use 'ifconfig' to view network interfaces.

Use 'ss -tulpn' to display listening and established connections with process information.

Use 'ping' to test connectivity to remote hosts.

Use 'route -n' to view the routing table.

A Linux administrator is investigating a potential security incident. The administrator needs to find any failed login attempts and the source IP addresses of those attempts. Which log file and command should be used?

Grep /var/log/messages for 'login' and extract the IP addresses.

Run 'journalctl -u ssh' and look for 'Accepted' entries.

Grep /var/log/auth.log for 'Failed password' and extract the IP addresses.

Run 'lastb' and look for 'Failed' entries.

A Linux administrator is hardening a server that hosts a web application. The application requires the ability to write to a specific directory, but the administrator wants to prevent the web server process from accessing other parts of the file system. Which security control is most appropriate?

Use SELinux or AppArmor to confine the web server process to only the required directories.

Change the ownership of the web server's files to root and set permissions to 755.

Set the web server's umask to 077 to restrict file creation.

Use iptables to block the web server's network access.

EC-CouncilCertified Network Defender

Domain 2Objective 3

Endpoint Security Linux Systems CND Practice Questions (Page 8)

Part of the Perimeter and Endpoint Security domain, which makes up ~24% of our current practice bank.

47questions here

10free pages

9concepts

Questions 36–40

36application · medium
A network defender is investigating a potential intrusion on a Linux endpoint. The defender wants to see a list of all active network connections and the associated processes. Which command should be used?
Select an answer first
37application · medium
A security analyst notices unusual outbound connections from a Linux endpoint to an external IP address. The analyst needs to determine which process initiated the connections and what user account is associated with it. Which command should the analyst run?
Select an answer first
38application · medium
A Linux administrator is investigating a potential security incident. The administrator needs to find any failed login attempts and the source IP addresses of those attempts. Which log file and command should be used?
Select an answer first
39foundation · easy
Which command is used to display current firewall rules in iptables?
Select an answer first
40expert · hard
A Linux administrator is hardening a server that hosts a web application. The application requires the ability to write to a specific directory, but the administrator wants to prevent the web server process from accessing other parts of the file system. Which security control is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.

Endpoint Security Linux Systems CND Practice Questions (Page 8)

Questions 36–40

A network defender is investigating a potential intrusion on a Linux endpoint. The defender wants to see a list of all active network connections and the associated processes. Which command should be used?

A security analyst notices unusual outbound connections from a Linux endpoint to an external IP address. The analyst needs to determine which process initiated the connections and what user account is associated with it. Which command should the analyst run?

A Linux administrator is investigating a potential security incident. The administrator needs to find any failed login attempts and the source IP addresses of those attempts. Which log file and command should be used?

Which command is used to display current firewall rules in iptables?

A Linux administrator is hardening a server that hosts a web application. The application requires the ability to write to a specific directory, but the administrator wants to prevent the web server process from accessing other parts of the file system. Which security control is most appropriate?

Keep studying — Perimeter and Endpoint Security