Linux Security and Hardening GSEC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a common sign that a Linux system may be infected with malware or a rootkit?

   • AThe /etc/passwd file contains only system accounts.
   • BThe system has a firewall enabled.
   • CUnexpected network connections to unknown remote hosts.
   • DThe system's uptime is longer than 30 days.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which special permission bit, when set on a directory, prevents users from deleting files that they do not own, even if they have write permission on the directory?

   • AImmutable attribute
   • BSetgid bit
   • CSetuid bit
   • DSticky bit
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst suspects that a Linux server has been compromised. The analyst needs to determine which processes have been running, which files were accessed, and whether any user accounts were created or modified during the suspected timeframe. Which combination of auditing and logging tools should the analyst use to gather this evidence?

   • AUse 'ps aux' to list current processes, 'stat' on suspicious files, and 'grep' in /var/log/syslog for error messages.
   • BUse 'last' to review login history, 'cat /var/log/auth.log' for authentication events, and 'auditctl -w /etc/passwd -p wa -k userinfo' to monitor changes to user account files.
   • CUse 'top' to monitor real-time processes, 'lsof' to list open files, and 'lastlog' to see last login times.
   • DUse 'journalctl' to review the systemd journal, 'ausearch -m execve' to find executed processes, and 'auditctl -w /etc/passwd -p wa -k userinfo' to monitor changes to user account files.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of verifying package integrity using checksums or digital signatures?

   • ATo automatically resolve dependency conflicts.
   • BTo remove unnecessary files from the system.
   • CTo ensure that the package has not been tampered with or corrupted during download.
   • DTo speed up the installation process.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a recommended practice for hardening services on a Linux system?

   • ARun all services as the root user to simplify management.
   • BDisable any unnecessary daemons and services that are not required for the system's role.
   • CUse the same password for all service accounts.
   • DEnable every available service to ensure functionality.
   Reveal Solution Discussion Select an answer first