327.2 Mandatory Access Control (weight: 4) LPIC-3-SECURITY Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a key limitation of Discretionary Access Control that Mandatory Access Control addresses?

   • ADAC allows a malicious program running as a user to modify files that user owns, even if the system administrator wants to prevent it.
   • BDAC cannot prevent a user from reading a file they own.
   • CDAC cannot be used with network filesystems.
   • DDAC is too slow for modern systems.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which tool generates a human-readable explanation of an SELinux denial and suggests possible fixes?

   • Aausearch
   • Baudit2why
   • Csealert
   • Dgetenforce
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which SELinux mode logs denials but does not enforce the policy?

   • APermissive
   • BAudit
   • CDisabled
   • DEnforcing
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   How does Smack make access control decisions?

   • ABy using a central policy server over the network
   • BBy checking the Unix user ID and group ID of the process
   • CBy comparing the security label of the subject to the security label of the object
   • DBy comparing the pathname of the executable to a list of allowed paths
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the defining characteristic of Mandatory Access Control (MAC) compared to Discretionary Access Control (DAC)?

   • AMAC is only available on Windows operating systems.
   • BMAC relies on file permissions set by the user who created the file.
   • CMAC allows the owner of a resource to decide who can access it.
   • DMAC enforces a system-wide policy that users cannot override, even if they own the resource.
   Reveal Solution Discussion Select an answer first