What is the purpose of initializing the AIDE database?

To update the rootkit signature database

To configure the Linux Audit system

To generate a compliance report

To create a baseline snapshot of the system's files and their attributes

A security team is evaluating host-based intrusion detection tools for a server that runs a custom kernel module. The team needs to detect rootkits that may hide processes or files. They have both chkrootkit and rkhunter installed. Which statement correctly describes a limitation of chkrootkit that rkhunter addresses?

chkrootkit does not scan for rootkits that hide processes, while rkhunter does.

chkrootkit relies on system binaries that may be compromised, while rkhunter uses its own static binaries.

chkrootkit does not support signature updates, while rkhunter does.

chkrootkit cannot be run from a cron job, while rkhunter can.

After making legitimate changes to a system, what should you do to keep AIDE's database accurate?

Run 'aide --init' to create a new database from scratch

Delete the database and recreate it manually

Run 'aide --update' to update the database

Run 'aide --check' to verify the changes are legitimate

LPIC-3 Security

Domain 2Objective 2

326.2 Host Intrusion Detection (weight: 4) LPIC-3-SECURITY Practice Questions (Page 5)

Part of the Topic 326: Host Security domain, which makes up ~26% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–16 in this domain), expect 2–4 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

11concepts

Questions 21–25

21foundation · easy
What is the purpose of initializing the AIDE database?
Select an answer first
22expert · hard
A security team is evaluating host-based intrusion detection tools for a server that runs a custom kernel module. The team needs to detect rootkits that may hide processes or files. They have both chkrootkit and rkhunter installed. Which statement correctly describes a limitation of chkrootkit that rkhunter addresses?
Select an answer first
23foundation · easy
After making legitimate changes to a system, what should you do to keep AIDE's database accurate?
Select an answer first
24foundation · easy
Which command initializes the AIDE database?
Select an answer first
25foundation · easy
Which file is the main configuration file for rkhunter?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.

326.2 Host Intrusion Detection (weight: 4) LPIC-3-SECURITY Practice Questions (Page 5)

Questions 21–25

What is the purpose of initializing the AIDE database?

After making legitimate changes to a system, what should you do to keep AIDE's database accurate?

Which command initializes the AIDE database?

Which file is the main configuration file for rkhunter?

Keep studying — Topic 326: Host Security