After a legitimate software update, an AIDE integrity check reports changes to several files in /usr/bin. The administrator has verified that the changes are expected. What should the administrator do to prevent these changes from being reported in future checks?

Delete the AIDE database and reinitialize it from scratch.

Run aide --update and then replace the original database with the newly generated one.

Edit the AIDE database file manually to remove the changed files.

An auditor has requested a report of all failed login attempts on a server that uses the Linux Audit system. The audit rules already log all login-related events with the key 'login'. Which command should the administrator use to generate a summary report of failed logins?

ausearch -k login -m USER_AUTH --failed

ausearch -k login -m USER_LOGIN -sv no

Which command would you use to add a temporary audit rule that watches the file /etc/passwd for write access?

auditctl -w /etc/passwd -p wa -k passwd_changes

aureport -w /etc/passwd -p wa -k passwd_changes

auditd -w /etc/passwd -p wa -k passwd_changes

ausearch -w /etc/passwd -p wa -k passwd_changes

LPIC-3 Security

Domain 2Objective 2

326.2 Host Intrusion Detection (weight: 4) LPIC-3-SECURITY Practice Questions (Page 1)

Part of the Topic 326: Host Security domain, which makes up ~26% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–16 in this domain), expect 2–4 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

11concepts

Questions 1–5

1foundation · easy
Where should persistent audit rules be placed so they are loaded automatically when the audit daemon starts?
Select an answer first
2application · medium
After a legitimate software update, an AIDE integrity check reports changes to several files in /usr/bin. The administrator has verified that the changes are expected. What should the administrator do to prevent these changes from being reported in future checks?
Select an answer first
3foundation · easy
Which tool would you use to generate a report showing the number of failed login attempts over a given period?
Select an answer first
4expert · medium
An auditor has requested a report of all failed login attempts on a server that uses the Linux Audit system. The audit rules already log all login-related events with the key 'login'. Which command should the administrator use to generate a summary report of failed logins?
Select an answer first
5foundation · easy
Which command would you use to add a temporary audit rule that watches the file /etc/passwd for write access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.

326.2 Host Intrusion Detection (weight: 4) LPIC-3-SECURITY Practice Questions (Page 1)

Questions 1–5

Where should persistent audit rules be placed so they are loaded automatically when the audit daemon starts?

After a legitimate software update, an AIDE integrity check reports changes to several files in /usr/bin. The administrator has verified that the changes are expected. What should the administrator do to prevent these changes from being reported in future checks?

Which tool would you use to generate a report showing the number of failed login attempts over a given period?

An auditor has requested a report of all failed login attempts on a server that uses the Linux Audit system. The audit rules already log all login-related events with the key 'login'. Which command should the administrator use to generate a summary report of failed logins?

Which command would you use to add a temporary audit rule that watches the file /etc/passwd for write access?

Keep studying — Topic 326: Host Security