Describe Basic SELinux Use Cases F5N4 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which command changes the SELinux type of a file to match the default policy for web content?

   • Arestorecon -v /var/www/html/index.html
   • Bsemanage fcontext -d /var/www/html/index.html
   • Csetenforce 0 /var/www/html/index.html
   • Dchmod 755 /var/www/html/index.html
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which command searches the audit log for SELinux denials related to a specific process or time frame?

   • Agetenforce -m avc
   • Bausearch -m avc -ts recent
   • Cseinfo -m avc
   • Daudit2why -m avc
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A junior admin is troubleshooting an NGINX issue. They run getenforce and see 'Permissive'. The NGINX error log shows no SELinux-related messages, but the application is still failing with a 403 on a file that has correct Unix permissions. What is the most accurate interpretation of this situation?

   • AThe NGINX process is running in an unconfined domain, so SELinux does not apply to it.
   • BSELinux is still enforcing; Permissive only affects new processes, so NGINX is still blocked.
   • CThe system is in Permissive mode, so SELinux is disabled and cannot log denials.
   • DSELinux is not the cause of the 403; in Permissive mode, denials are logged but not enforced, so the issue lies elsewhere.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   NGINX returns a 403 Forbidden error when serving files from a custom directory. SELinux is in Enforcing mode. What is a common SELinux-related cause?

   • AThe files have incorrect Unix permissions
   • BThe files have the wrong SELinux type, such as var_t instead of httpd_sys_content_t
   • CThe NGINX worker processes are running in Permissive mode
   • DThe custom directory is not in the NGINX configuration
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An NGINX reverse proxy is configured to forward requests to a backend API server on a different host (192.168.10.50:8443). The proxy returns 502 Bad Gateway. The error log shows 'connect() to 192.168.10.50:8443 failed (13: Permission denied)'. ausearch -m avc -ts recent shows an AVC denial for httpd_t trying to connect to a port with tcp_socket. What is the correct resolution?

   • AChange the backend port to 80 or 443, which are already allowed by default.
   • BEnable the httpd_can_network_connect boolean with setsebool -P httpd_can_network_connect 1.
   • CAdd a semanage port rule: semanage port -a -t http_port_t -p tcp 8443.
   • DSet the backend server's SELinux context to httpd_sys_content_t with chcon.
   Reveal Solution Discussion Select an answer first