A Linux administrator wants to enforce a password policy that requires all users to change their password every 90 days and disallows reuse of the last 5 passwords. Which file and configuration approach should be used?

Use chage -M 90 for each user and set the 'remember' option in /etc/pam.d/common-password.

Edit /etc/shadow to set the maximum age field for each user to 90 and the password history to 5.

Edit /etc/login.defs to set PASS_MAX_DAYS 90 and configure PAM's pam_pwhistory module to remember 5 passwords.

Set PASS_MAX_DAYS 90 in /etc/passwd and add 'remember=5' to /etc/pam.d/login.

A Linux security analyst is investigating a potential intrusion. The system uses systemd with journald, and the analyst needs to find all commands executed by a specific user 'bob' with sudo privileges, including the command arguments. The audit daemon (auditd) is running. Which approach will provide the most complete and reliable evidence?

Use 'ausearch -u bob -sc execve' to query auditd logs for execve events by that user.

Check the shell history file /home/bob/.bash_history.

Search journald logs using 'journalctl _UID=1000' to see all commands run by bob.

Review /var/log/auth.log for sudo entries, which include the command and arguments.

A Windows administrator needs to track who attempts to access a sensitive folder on a file server. The folder is on an NTFS volume. The administrator has enabled Object Access auditing in the Local Security Policy. What additional step is required to generate audit events for each file access attempt?

Enable 'Audit object access' in the GPO and restart the server.

Run 'gpupdate /force' to apply the policy immediately.

Set the folder's DACL to deny 'Everyone' and then allow specific users.

Configure the SACL on the folder and its files to audit 'Everyone' for 'Read' and 'Write'.

EC-CouncilSOC Essentials

Domain 1Objective 4

Windows and Unix/Linux Security SCE Practice Questions (Page 5)

Part of the Computer Network and Security Fundamentals domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

11concepts

11 Concepts in This Objective

Windows Security Architecture
Windows Authentication and Authorization
Windows Security Policies and Group Policy
Windows Auditing and Logging
Windows Defender and Built-in Security Tools
Unix/Linux Security Architecture
Unix/Linux Authentication and PAM
Unix/Linux File Permissions and Access Control
Unix/Linux Security Hardening
Unix/Linux Auditing and Logging
Unix/Linux Security Tools

Questions 21–25

21application · medium
A Linux administrator wants to enforce a password policy that requires all users to change their password every 90 days and disallows reuse of the last 5 passwords. Which file and configuration approach should be used?
Select an answer first
22expert · hard
A Linux security analyst is investigating a potential intrusion. The system uses systemd with journald, and the analyst needs to find all commands executed by a specific user 'bob' with sudo privileges, including the command arguments. The audit daemon (auditd) is running. Which approach will provide the most complete and reliable evidence?
Select an answer first
23application · medium
A Windows administrator needs to track who attempts to access a sensitive folder on a file server. The folder is on an NTFS volume. The administrator has enabled Object Access auditing in the Local Security Policy. What additional step is required to generate audit events for each file access attempt?
Select an answer first
24foundation · easy
Which Linux logging service is the traditional system that collects log messages from various programs and writes them to files such as /var/log/syslog or /var/log/messages?
Select an answer first
25foundation · easy
Which command is used to update package lists and upgrade installed packages on a Debian/Ubuntu system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Windows and Unix/Linux Security SCE Practice Questions (Page 5)

Questions 21–25

A Linux administrator wants to enforce a password policy that requires all users to change their password every 90 days and disallows reuse of the last 5 passwords. Which file and configuration approach should be used?

Which Linux logging service is the traditional system that collects log messages from various programs and writes them to files such as /var/log/syslog or /var/log/messages?

Which command is used to update package lists and upgrade installed packages on a Debian/Ubuntu system?

Keep studying — Computer Network and Security Fundamentals