326.2 Host Intrusion Detection (weight: 4) LPIC-3-SECURITY Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a common practice when scheduling host scans with cron to manage scan logs?

   • ARun the scan in the background without any logging
   • BSend the output to /dev/null to avoid filling the disk
   • CRedirect the output of the scan command to a log file
   • DUse auditd to log the scan output
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary role of OpenSCAP?

   • ATo monitor file integrity using a baseline database
   • BTo configure the Linux Audit system
   • CTo scan for rootkits on the local system
   • DTo perform security compliance scanning and vulnerability assessment
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In AIDE's configuration file, what does the 'p' in a rule like 'p+i+n+u+g+s+m+c+md5' represent?

   • APath
   • BPackage
   • CProcess
   • DPermissions
   Reveal Solution Discussion Select an answer first
5. 19application · easy

   A security administrator has run chkrootkit on a server and the output includes the line 'Checking for suspicious files... Nothing found'. The administrator wants to ensure that the scan is thorough and includes checks for known rootkit signatures. Which additional tool should the administrator use to complement chkrootkit?

   • AOpenSCAP
   • Bauditd
   • Crkhunter
   • Daide
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of chkrootkit?

   • ATo generate compliance reports based on SCAP
   • BTo monitor file integrity using a baseline database
   • CTo configure the Linux Audit system
   • DTo scan for known rootkits and malware on the local system
   Reveal Solution Discussion Select an answer first