326.2 Host Intrusion Detection (weight: 4) LPIC-3-SECURITY Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of Linux Malware Detect (LMD)?

   • ATo configure the Linux Audit system
   • BTo monitor file integrity using a baseline database
   • CTo scan for malware and rootkits on Linux systems
   • DTo generate compliance reports based on SCAP
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An administrator wants to schedule a weekly security scan on a server. The scan should run every Sunday at 3:00 AM, and the output should be logged to /var/log/security-scan.log. The administrator also wants to ensure that the scan runs even if the system was off at the scheduled time. Which approach should be used?

   • AAdd an anacron job: 0 3 * * 0 /usr/local/bin/security-scan >> /var/log/security-scan.log 2>&1
   • BAdd a cron job with the @reboot directive to run the scan at boot.
   • CAdd a systemd timer that runs the scan weekly and has the Persistent=true setting.
   • DAdd a cron job: 0 3 * * 0 /usr/local/bin/security-scan >> /var/log/security-scan.log 2>&1
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An administrator has configured rkhunter to run nightly via cron. The administrator notices that the scan results are not being emailed, even though the MAILTO variable is set in the crontab. The rkhunter configuration file has the following settings: MAIL_ON_WARNING=yes, MAIL_CMD=mail -s "rkhunter scan" root@localhost. What is the most likely reason the emails are not being sent?

   • AThe cron job is not producing any output, so cron does not send an email.
   • BThe MAIL_CMD setting is incorrect; it should be set to the path of the mail command, e.g., /usr/bin/mail.
   • CThe MAIL_ON_WARNING setting is set to 'yes' but the cron job is not using the rkhunter configuration file.
   • DThe cron job is not running as root, so rkhunter cannot send emails.
   Reveal Solution Discussion Select an answer first
5. 14application · easy

   A system administrator is troubleshooting why audit rules are not being applied after a reboot. The administrator has added rules to /etc/audit/rules.d/audit.rules. Which command should the administrator run to verify that the rules are loaded?

   • Aauditctl -s
   • Bauditctl -l
   • Causearch -l
   • Daureport -l
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security administrator needs to monitor all attempts to change the system's hostname on a server running the Linux Audit daemon. The administrator wants the rule to survive a reboot and to be able to later search for events specifically related to hostname changes. Which approach should the administrator use?

   • AUse ausearch -k hostname_change to create a persistent rule that records all hostname changes.
   • BAdd a watch on /proc/sys/kernel/hostname using auditctl -w /proc/sys/kernel/hostname -p wa -k hostname_change.
   • CRun auditctl -a always,exit -F arch=b64 -S sethostname -k hostname_change and add the same rule to /etc/audit/rules.d/audit.rules for persistence.
   • DAdd a rule to /etc/audit/rules.d/audit.rules that watches the /etc/hostname file with the -p wa flag, then run auditctl -R /etc/audit/rules.d/audit.rules.
   Reveal Solution Discussion Select an answer first