A security auditor is reviewing a Linux server that hosts a public web application. The server is in a locked data center, but the auditor is concerned about physical access during maintenance windows. The server's BIOS supports a supervisor password and boot-order configuration. The GRUB 2 boot loader currently has no password set. Which two actions should the administrator take to best mitigate the risk of an attacker with physical access booting a live USB and modifying the system?

Set a GRUB 2 password and disable the GRUB menu.

Disable the USB controller in the OS and set a GRUB 2 password.

Set a BIOS supervisor password and disable boot from USB devices.

Enable Secure Boot and set a BIOS user password.

A developer wants to run an untrusted binary in a controlled environment on a Linux server. The binary only needs to access files in /srv/app and should not be able to see the rest of the filesystem. Which approach provides the most effective isolation?

Run the binary with a lower nice value.

Run the binary inside a chroot jail with /srv/app as the root directory.

Use setcap to drop all capabilities from the binary.

Set a ulimit on the binary's file size.

A system administrator is hardening a multi-user Linux server. A user has reported that their application is crashing due to memory exhaustion. The administrator suspects a fork bomb or a memory leak. Which configuration would best prevent a single user from consuming all system memory while allowing normal operation?

Set a per-user limit on the number of processes and address space in /etc/security/limits.conf.

Disable the user's account in /etc/passwd.

Set kernel.pid_max to a low value in sysctl.conf.

Use the 'kill' command to terminate the user's processes when memory is low.

LPIC-3 Security

Domain 2Objective 1

326.1 Host Hardening (weight: 3) LPIC-3-SECURITY Practice Questions (Page 5)

Part of the Topic 326: Host Security domain, which makes up ~26% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–16 in this domain), expect 2–4 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

8concepts

Questions 21–25

21foundation · easy
Which file is used to set resource limits for users via PAM?
Select an answer first
22application · medium
A security auditor is reviewing a Linux server that hosts a public web application. The server is in a locked data center, but the auditor is concerned about physical access during maintenance windows. The server's BIOS supports a supervisor password and boot-order configuration. The GRUB 2 boot loader currently has no password set. Which two actions should the administrator take to best mitigate the risk of an attacker with physical access booting a live USB and modifying the system?
Select an answer first
23application · medium
A developer wants to run an untrusted binary in a controlled environment on a Linux server. The binary only needs to access files in /srv/app and should not be able to see the rest of the filesystem. Which approach provides the most effective isolation?
Select an answer first
24foundation · easy
Which security benefit is provided by virtualization through the ability to revert to a known-good state?
Select an answer first
25expert · hard
A system administrator is hardening a multi-user Linux server. A user has reported that their application is crashing due to memory exhaustion. The administrator suspects a fork bomb or a memory leak. Which configuration would best prevent a single user from consuming all system memory while allowing normal operation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.

326.1 Host Hardening (weight: 3) LPIC-3-SECURITY Practice Questions (Page 5)

Questions 21–25

Which file is used to set resource limits for users via PAM?

A developer wants to run an untrusted binary in a controlled environment on a Linux server. The binary only needs to access files in /srv/app and should not be able to see the rest of the filesystem. Which approach provides the most effective isolation?

Which security benefit is provided by virtualization through the ability to revert to a known-good state?

Keep studying — Topic 326: Host Security