An administrator is configuring a new Apache server with multiple HTTPS virtual hosts using SNI. After configuring the server, the administrator tests it with openssl s_client -connect server.example.com:443 -servername shop.example.com and receives the correct certificate. However, when testing with openssl s_client -connect server.example.com:443 without the -servername option, a different certificate is presented. What is the MOST likely explanation for this behavior?

The SSLProtocol directive is set differently in the two virtual hosts.

The SSLCertificateFile directive is incorrectly specified in the shop.example.com virtual host.

The server is correctly falling back to the default virtual host when no SNI is provided.

The server is configured with SSLUseStapling on, which changes the certificate presented.

Which Apache directive is commonly used to add the HSTS header to responses?

Redirect permanent / https://example.com/

Header always set Strict-Transport-Security "max-age=31536000"

SSLCertificateFile /path/to/cert.pem

An administrator has just installed a new certificate on an Apache server. The certificate file contains the server certificate and the intermediate CA certificate in a single file. The administrator wants to verify that the certificate chain is correctly configured and that the server presents the full chain to clients. Which OpenSSL command should be used to check the chain presented by the running server?

openssl verify -CAfile ca.crt cert.pem

openssl s_server -accept 443 -cert cert.pem -key key.pem

openssl x509 -in cert.pem -text -noout

openssl s_client -connect localhost:443 -showcerts

LPIC-3 Security

Domain 1Objective 2

325.2 X.509 Certificates for Encryption, Signing and Authentication (weight: 4) LPIC-3-SECURITY Practice Questions (Page 5)

Part of the Topic 325: Cryptography domain, which makes up ~28% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~10–17 in this domain), expect 3–4 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

9concepts

Questions 21–25

21foundation · easy
Which TLS version is considered deprecated and should be disabled in modern configurations due to known vulnerabilities?
Select an answer first
22expert · hard
An administrator is configuring a new Apache server with multiple HTTPS virtual hosts using SNI. After configuring the server, the administrator tests it with openssl s_client -connect server.example.com:443 -servername shop.example.com and receives the correct certificate. However, when testing with openssl s_client -connect server.example.com:443 without the -servername option, a different certificate is presented. What is the MOST likely explanation for this behavior?
Select an answer first
23foundation · easy
Which Apache directive is commonly used to add the HSTS header to responses?
Select an answer first
24foundation · easy
Which Apache module must be enabled to support HTTPS configuration?
Select an answer first
25application · medium
An administrator has just installed a new certificate on an Apache server. The certificate file contains the server certificate and the intermediate CA certificate in a single file. The administrator wants to verify that the certificate chain is correctly configured and that the server presents the full chain to clients. Which OpenSSL command should be used to check the chain presented by the running server?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.

325.2 X.509 Certificates for Encryption, Signing and Authentication (weight: 4) LPIC-3-SECURITY Practice Questions (Page 5)

Questions 21–25

Which TLS version is considered deprecated and should be disabled in modern configurations due to known vulnerabilities?

Which Apache directive is commonly used to add the HSTS header to responses?

Which Apache module must be enabled to support HTTPS configuration?

Keep studying — Topic 325: Cryptography