An administrator is configuring SSSD to use Kerberos for authentication against an existing KDC. The realm is EXAMPLE.COM, the KDC is at kdc.example.com, and the admin server is at admin.example.com. The administrator has set id_provider = ldap and auth_provider = krb5 in the domain section. Users can authenticate, but they cannot access Kerberized services. What is the most likely missing configuration?

The ldap_search_base is incorrect

The krb5_realm, krb5_kdcip, and krb5_server options are not set in the SSSD domain section

The SSSD cache is stale and needs to be cleared

The /etc/krb5.conf file is missing the [domain_realm] section

A company uses SSSD with an LDAP provider for authentication. The security team wants to lock out accounts after 5 failed login attempts. The administrator has added pam_faillock to the system-auth PAM file. However, after 5 failed attempts, the account is not locked. What is the most likely reason?

pam_faillock is placed after pam_sss in the auth stack, so the failure counter is not incremented when pam_sss fails

The SSSD cache is preventing pam_faillock from working

The pam_faillock module is not installed

The LDAP server does not support account lockout

A Linux administrator is evaluating SSSD for a fleet of workstations that need to authenticate users against a central directory. Which statement accurately describes the role of SSSD in this context?

SSSD is a Kerberos ticket-granting service that issues tickets for users after they authenticate against a central directory.

SSSD is a replacement for the NSS and PAM subsystems that directly queries remote directories for every user lookup and authentication request.

SSSD is a daemon that caches remote identity and authentication data locally and provides a unified interface to NSS and PAM for multiple identity sources.

SSSD is a tool that periodically synchronizes the local /etc/passwd and /etc/shadow files with a central LDAP directory.

What is 'enrollment' in the context of SSSD with IPA?

The process of obtaining a Kerberos ticket

The process of joining the client to the IPA domain

The process of enrolling users in the IPA database

The process of configuring the SSSD cache

LPIC-3 Security

Domain 2Objective 3

326.3 User Management and Authentication (weight: 5) LPIC-3-SECURITY Practice Questions (Page 3)

Part of the Topic 326: Host Security domain, which makes up ~26% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–16 in this domain), expect 2–4 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

24concepts

24 Concepts in This Objective

NSS Overview
NSS Configuration Files
NSS Modules
PAM Overview
PAM Configuration Files
PAM Module Types and Controls
Common PAM Modules
Password Complexity Policies
Periodic Password Changes
Account Lockout After Failed Attempts
SSSD Overview
SSSD Configuration
SSSD Domains and Providers
Integrating SSSD with NSS
Integrating SSSD with PAM
SSSD with Active Directory
SSSD with IPA
SSSD with LDAP
SSSD with Kerberos
SSSD with Local Domains
Kerberos Basics
Kerberos Client Configuration
Obtaining Kerberos Tickets
Managing Kerberos Tickets

Questions 11–15

11expert · hard
An administrator is configuring SSSD to use Kerberos for authentication against an existing KDC. The realm is EXAMPLE.COM, the KDC is at kdc.example.com, and the admin server is at admin.example.com. The administrator has set id_provider = ldap and auth_provider = krb5 in the domain section. Users can authenticate, but they cannot access Kerberized services. What is the most likely missing configuration?
Select an answer first
12foundation · easy
In an SSSD LDAP domain configuration, what does the 'ldap_uri' option specify?
Select an answer first
13expert · hard
A company uses SSSD with an LDAP provider for authentication. The security team wants to lock out accounts after 5 failed login attempts. The administrator has added pam_faillock to the system-auth PAM file. However, after 5 failed attempts, the account is not locked. What is the most likely reason?
Select an answer first
14foundation · medium
A Linux administrator is evaluating SSSD for a fleet of workstations that need to authenticate users against a central directory. Which statement accurately describes the role of SSSD in this context?
Select an answer first
15foundation · easy
What is 'enrollment' in the context of SSSD with IPA?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.

326.3 User Management and Authentication (weight: 5) LPIC-3-SECURITY Practice Questions (Page 3)

Questions 11–15

In an SSSD LDAP domain configuration, what does the 'ldap_uri' option specify?

A Linux administrator is evaluating SSSD for a fleet of workstations that need to authenticate users against a central directory. Which statement accurately describes the role of SSSD in this context?

What is 'enrollment' in the context of SSSD with IPA?

Keep studying — Topic 326: Host Security