110.2 Setup Host Security LPIC-1 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A service (sshd) is protected by TCP wrappers. The administrator wants to allow SSH from the management network 10.10.10.0/24 and from the local host, but deny all other sources. The /etc/hosts.allow file contains: 'sshd: 10.10.10.' and /etc/hosts.deny contains: 'sshd: ALL'. However, a user from 192.168.1.50 is still able to connect. What is the most likely cause?

   • AThe /etc/hosts.deny rule is not being read because the service is started before the file is loaded.
   • BThe /etc/hosts.deny file has a syntax error.
   • CThe sshd service does not use TCP wrappers.
   • DThe IP 192.168.1.50 is in the /etc/hosts.allow file.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which command is used to enable and manage disk quotas for users on a Linux filesystem?

   • A`quotaon`
   • B`repquota`
   • C`quotacheck`
   • D`edquota`
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A web server on a Debian system with AppArmor is failing to write to a new directory /srv/www/uploads. The directory has correct ownership and permissions (www-data:www-data, 755). The administrator has confirmed that AppArmor is in enforcing mode. Which command should be used to allow the web server to write to this directory?

   • ARun apparmor_parser -R /etc/apparmor.d/usr.sbin.apache2 to remove the profile.
   • BRun aa-complain /usr/sbin/apache2 to set the profile to complain mode.
   • CEdit the AppArmor profile for the web server to include a write rule for /srv/www/uploads/ and reload the profile.
   • DRun chmod 777 /srv/www/uploads to allow all users to write.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following best describes the purpose of auditing host security on a Linux system?

   • ATo review system logs and configuration files to identify potential security issues
   • BTo automatically block all network traffic from untrusted hosts
   • CTo replace the need for regular system updates
   • DTo encrypt all data stored on the system
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company runs a public-facing SSH server. Security audits require that root login is disabled and only key-based authentication is used. Additionally, the server must be reachable on a non-standard port to reduce automated attacks. The administrator has configured sshd_config accordingly. Which additional step is necessary to ensure the firewall allows the new SSH port?

   • AAdd an iptables rule to ACCEPT TCP traffic on the new port.
   • BRestart the sshd service to apply the new port.
   • CChange the SELinux context of the sshd binary.
   • DDisable the old SSH port in the firewall.
   Reveal Solution Discussion Select an answer first