325.3 Encrypted File Systems (weight: 3) LPIC-3-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which scenario is a typical use case for file-level encryption rather than block device encryption?

   • AEncrypting a swap partition to prevent sensitive data from being written to swap
   • BEncrypting a user's home directory on a system where the rest of the disk is unencrypted
   • CEncrypting an entire disk that contains the operating system and all user data
   • DEncrypting a database data directory that must be accessed by multiple users without individual passwords
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A database administrator needs to encrypt a new data partition on a server. The requirement is that the encryption must be transparent to the database software and must protect against offline attacks where the disk is removed from the server. The administrator also wants to be able to add and remove passphrases without re-encrypting the data. Which approach should be taken?

   • AUse LUKS to encrypt the entire partition
   • BUse eCryptfs on the database data directory
   • CUse plain dm-crypt without LUKS
   • DUse EncFS on the database data directory
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which PAM module is commonly used to integrate eCryptfs with the login process?

   • Apam_ecryptfs.so
   • Bpam_unix.so
   • Cpam_mount.so
   • Dpam_cryptsetup.so
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a limitation of plain dm-crypt (without LUKS)?

   • AIt does not provide a standardized on-disk format for storing encryption metadata, so the cipher, key, and other parameters must be provided manually each time.
   • BIt cannot encrypt block devices, only files.
   • CIt does not support the AES cipher.
   • DIt is only available on non-Linux systems.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A LUKS-encrypted disk's header was accidentally overwritten by a failed partitioning operation. The administrator has a recent backup of the LUKS header stored on a USB drive. The data on the disk is still intact, but the device cannot be opened. Which sequence of commands should the administrator run to restore access to the data?

   • Acryptsetup open --type plain /dev/sdd data
   • Bcryptsetup luksFormat /dev/sdd && cryptsetup open /dev/sdd data
   • Ccryptsetup luksHeaderRestore /dev/sdd --header-backup-file /mnt/usb/luks-header.bak && cryptsetup open /dev/sdd data
   • Dcryptsetup luksHeaderBackup /dev/sdd --header-backup-file /mnt/usb/luks-header.bak
   Reveal Solution Discussion Select an answer first