Deck 10: Security

Question 1

Which of the following resources of a shell and its child processes can be controlled by the Bash build-in command ulimit?

A) The maximum size of written files
B) The maximum number of open file descriptors
C) The maximum number of newly created files
D) The maximum number of environment variables
E) The maximum number of user processes

Answer 1

The maximum size of written files
The maximum number of open file descriptors
The maximum number of user processes

Question 2

Which of the following commands defines an audit rule that monitors read and write operations to the file/ etc/firewall/rules and associates the rule with the name firewall?

A) auditctl -N firewall -r r: /etc/firewall/rules -r w:     etc/firewall/rules
B) auditctl -A -f /etc/firewall/rules -o r -o w -l firewall
C) auditctl -w /etc/firewall/rules -p rw -k firewall
D) auditctl --read /etc/firewall/rules --write /etc/firewall/rules     --label firewall
E) echo "n: firewall  r:/etc/firewall/rules: w:/     etc/firewall/rules:" | auditctl ~

Answer 2

auditctl -w /etc/firewall/rules -p rw -k firewall

Question 3

Which of the following expressions are valid AIDE rules?

A) !/var/run/.*
B) append: /var/log/*
C) /usr=all
D) #/bin/
E) /etc p+i+u+g

Answer 3

!/var/run/.*
/etc p+i+u+g

Question 4

Which of the following authentication methods was added to NFS in version 4?

A) Kerberos authentication
B) SSH hostkey authentication
C) Winbind authentication
D) SSL certificate authentication

Question 5

Which of the following access control models is established by using SELinux?

A) Security Access Control (SAC)
B) Group Access Control (GAC)
C) User Access Control (UAC)
D) Discretionary Access Control (DAC)
E) Mandatory Access Control (MAC)

Question 6

Which of the following components are part of FreeIPA?

A) DHCP Server
B) Kerberos KDC
C) Intrusion Detection System
D) Public Key Infrastructure
E) Directory Server

Question 7

SIMULATION Which command installs and configures a new FreeIPA server, including all sub-components, and creates a new FreeIPA domain? (Specially ONLY the command without any path or parameters).

Question 8

Which of the following database names can be used within a Name Service Switch (NSS) configuration file? .

A) host
B) shadow
C) service
D) passwd
E) group

Question 9

Which of the following commands disables the automatic password expiry for the user usera?

A) chage --maxdays none usera
B) chage --maxdays 99 usera
C) chage --maxdays -1 usera
D) chage --lastday none usera
E) chage --lastday 0 usera

Question 10

Which of the following types can be specified within the Linux Audit system?

A) Control rules
B) File system rules
C) Network connection rules
D) Console rules
E) System call rules

Question 11

Which command revokes ACL-based write access for groups and named users on the file afile?

A) setfacl -x group: * : rx, user:*: rx afile
B) setfacl -x mask: : rx afile
C) setfacl ~m mask: : rx afile
D) setfacl ~m group: * : rx, user :*: rx afile

Question 12

Which of the following prefixes could be present in the output of getcifsacl?

A) ACL
B) GRANT
C) GROUP
D) OWNER
E) SID

Question 13

SIMULATION What option of mount.cifs specifies the user that appears as the local owner of the files of a mounted CIFS share when the server does not provide ownership information? (Specify ONLY the option name without any values or parameters.)

Question 14

Which of the following are differences between AppArmor and SELinux? .

A) AppArmor is implemented in user space only. SELinux is a Linux Kernel Module.
B) AppArmor is less complex and easier to configure than SELinux.
C) AppArmor neither requires nor allows any specific configuration. SELinux must always be manually configured.
D) SELinux stores information in extended file attributes. AppArmor does not maintain file specific information and states.
E) The SELinux configuration is loaded at boot time and cannot be changed later on. AppArmor provides user space tools to change its behavior.

Question 15

Which of the following sections are allowed within the Kerberos configuration file krb5.conf?

A) [plugins]
B) [crypto]
C) [domain]
D) [capaths]
E) [realms]

Question 16

SIMULATION Which PAM module checks new passwords against dictionary words and enforces complexity? (Specially the module name only without any path .)

Question 17

SIMULATION Which command is used to run a new shell for a user changing the SELinux context? (Specify ONLY the command without any path or parameters.)

Question 18

How are SELinux permissions related to standard Linux permissions?

A) SELinux permissions override standard Linux permissions.
B) Standard Linux permissions override SELinux permissions.
C) SELinux permissions are verified before standard Linux permissions.
D) SELinux permissions are verified after standard Linux permissions.

Question 19

What happens when the command getfattr afile is run while the file afile has no extended attributes set?

A) getfattr prints a warning and exits with a values of 0.
B) getfattr prints a warning and exits with a value of 1.
C) No output is produced and getfattr exits with a value of 0.
D) No outputs is produced and getfattr exits with a value of 1.

Question 20

Linux Extended File Attributes are organized in namespaces. Which of the following names correspond to existing attribute namespaces?

A) default
B) system
C) owner
D) trusted
E) user

Question 21

What is the purpose of the program snort-stat?

A) It displays statistics from the running Snort process.
B) It returns the status of all configured network devices.
C) It reports whether the Snort process is still running and processing packets.
D) It displays the status of all Snort processes.
E) It reads syslog files containing Snort information and generates port scan statistics.

Question 22

SIMULATION Which command included in the Linux Audit system provides searching and filtering of the audit log? (Specify ONLY the command without any path or parameters.)

Question 23

Which of the following openssl commands generates a certificate signing request (CSR) using the already existing private key contained in the file private/keypair.pem?

A) openssl req -key private/keypair.pem -out req/csr.pem
B) openssl req - new -key private/keypair.pem -out req/csr.pem
C) openssl gencsr -key private/keypair.pem -out req/csr.pem
D) openssl gencsr -new- key private/keypair.pem -out req/csr.pem

Question 24

Which of the following parameters to openssl s_client specifies the host name to use for TLS Server Name Indication?

A) -tlsname
B) -servername
C) -sniname
D) -vhost
E) -host

Question 25

Which DNS label points to the DANE information used to secure HTTPS connections to https://www.example.com/?

A) example.com
B) dane.www.example.com
C) soa.example.com
D) www.example.com
E) _443_tcp.www.example.com

Question 26

Which of the following lines in an OpenSSL configuration adds an X 509v3 Subject Alternative Name extension for the host names example.org and www.example.org to a certificate?

A) subjectAltName = DNS: www.example.org, DNS:example.org
B) extension= SAN: www.example.org, SAN:example.org
C) subjectAltName: www.example.org, subjectAltName: example.org
D) commonName = subjectAltName= www.example.org,     subjectAltName = example.org
E) subject= CN= www.example.org, CN=example.org

Question 27

Which of the following commands changes the source IP address to 192.0.2.11 for all IPv4 packets which go through the network interface eth0?

A) iptables ~t nat ~A POSTROUTING ~o eth0 ~j SNAT --to~source 192.0.2.11
B) iptables ~t nat ~A PREROUTING ~i eth0 ~j SNAT --to~source 192.0.2.11
C) iptables ~t nat ~A POSTROUTING ~i eth0 ~j DNAT --to~source 192.0.2.11
D) iptables ~t mangle ~A POSTROUTING ~i eth0 ~j SNAT -to~source 192.0.2.11
E) iptables ~t mangle ~A POSTROUTING ~0 eth0 ~j SNAT -to~source 192.0.2.11

Question 28

In which path is the data, which can be altered by the sysctl command, accessible?

A) /dev/sys/
B) /sys/
C) /proc/sys/
D) /sysctl/

Question 29

Which of the following statements is true regarding eCryptfs?

A) For every file in an eCryptfs directory there exists a corresponding file that contains the encrypted content.
B) The content of all files in an eCryptfs directory is stored in an archive file similar to a tar file with an additional index to improve performance.
C) After unmounting an eCryptfs directory, the directory hierarchy and the original file names are still visible, although, it is not possible to view the contents of the files.
D) When a user changes his login password, the contents of his eCryptfs home directory has to be re-encrypted using his new login password.
E) eCryptfs cannot be used to encrypt only directories that are the home directory of a regular Linux user.

Question 30

Which of the following statements are true regarding the certificate of a Root CA?

A) It is a self-signed certificate.
B) It does not include the private key of the CA.
C) It must contain a host name as the common name.
D) It has an infinite lifetime and never expires.
E) It must contain an X509v3 Authority extension.

Question 31

Which of the following commands adds a new user usera to FreeIPA?

A) useradd usera --directory ipa --gecos "User A"
B) idap- useradd -H Idaps://ipa-server CN=UserA --attribs     "Firstname: User: Lastname: A"
C) ipa-admin create user --account usera --fname User --iname A
D) ipa user-add usera --first User --last A
E) ipa-user- add usera --name "User A"

Question 32

Given a proper network and name resolution setup, which of the following commands establishes a trust between a FreeIPA domain and an Active Directory domain?

A) ipa trust-add --type ad addom --admin Administrator --password
B) ipa-ad -add-trust --account ADDOM\Administrator--query-password
C) net ad ipajoin addom -U Administrator -p
D) trustmanager add --domain ad: //addom --user Administrator -w
E) ipa ad join addom -U Administrator -w

Question 33

Which of the following practices are important for the security of private keys?

A) Private keys should be created on the systems where they will be used and should never leave them.
B) Private keys should be uploaded to public key servers.
C) Private keys should be included in X509 certificates.
D) Private keys should have a sufficient length for the algorithm used for key generation.
E) Private keys should always be stored as plain text files without any encryption.

Question 34

Which of the following DNS record types can the command dnssec-signzone add to a zone?

A) ASIG
B) NSEC
C) NSEC3
D) NSSIG
E) RRSIG

Question 35

How does TSIG authenticate name servers in order to perform secured zone transfers?

A) Both servers mutually verify their X509 certificates.
B) Both servers use a secret key that is shared between the servers.
C) Both servers verify appropriate DANE records for the labels of the NS records used to delegate the transferred zone.
D) Both servers use DNSSEC to mutually verify that they are authoritative for the transferred zone.

Question 36

What effect does the configuration SSLStrictSNIVHostCheck on have on an Apache HTTPD virtual host?

A) The clients connecting to the virtual host must provide a client certificate that was issued by the same CA that issued the server's certificate.
B) The virtual host is served only to clients that support SNI.
C) All of the names of the virtual host must be within the same DNS zone.
D) The virtual host is used as a fallback default for all clients that do not support SNI.
E) Despite its configuration, the virtual host is served only on the common name and Subject Alternative Names of the server certificates.

Question 37

An X509 certificate contains the following information:    X509v3 Basic Constraints: critical      CA:TRUE, pathlen:0 Which of the following statements are true regarding the certificate?

A) This certificate belongs to a certification authority.
B) This certificate may be used to sign certificates of subordinate certification authorities.
C) This certificate may never be used to sign any other certificates.
D) This certificate may be used to sign certificates that are not also a certification authority.
E) This certificate will not be accepted by programs that do not understand the listed extension.

Question 38

A LUKS device was mapped using the command:    cryptsetup luksOpen/dev/sdal crypt-vol Given that this device has three different keys, which of the following commands deletes only the first key?

A) cryptsetup luksDelKey /dev/sda 1 0
B) cryptsetup luksDelkey /dev/sda 1 1
C) cryptsetup luksDelKey / dev /mapper/crypt- vol 1
D) cryptsetup luksDelKey / dev /mapper/crypt- vol 0

Question 39

Which of the following statements is true about chroot environments?

A) Symbolic links to data outside the chroot path are followed, making files and directories accessible
B) Hard links to files outside the chroot path are not followed, to increase security
C) The chroot path needs to contain all data required by the programs running in the chroot environment
D) Programs are not able to set a chroot path by using a function call, they have to use the command chroot
E) When using the command chroot, the started command is running in its own namespace and cannot communicate with other processes

Question 40

Which of the following commands adds users using SSSD's local service?

A) sss_adduser
B) sss_useradd
C) sss_add
D) sss-addlocaluser
E) sss_local_adduser

Question 41

Which of the following keywords are built-in chairs for the iptables nat table?

A) OUTPUT
B) MASQUERADE
C) PROCESSING
D) POSTROUTING
E) PREROUTING

Question 42

When OpenVPN sends a control packet to its peer, it expects an acknowledgement in 2 seconds by default. Which of the following options changes the timeout period to 5 seconds?

A) -- tls-timeout 5
B) -- tls- timeout 500
C) -- tls- timer 5
D) -- tls- timer 500

Question 43

Which of the following statements is used in a parameter file for setkey in order to create a new SPD entry?

A) spd
B) addspd
C) newspd
D) spdnew
E) spdadd

Question 44

Which of the following terms refer to existing scan techniques with nmap?

A) Xmas Scan
B) Zero Scan
C) FIN Scan
D) IP Scan
E) UDP SYN Scan

Question 45

What is the purpose of IP sets?

A) They group together IP addresses that are assigned to the same network interfaces.
B) They group together IP addresses and networks that can be referenced by the network routing table.
C) They group together IP addresses that can be referenced by netfilter rules.
D) They group together IP and MAC addresses used by the neighbors on the local network.
E) They group together IP addresses and user names that can be referenced from /etc/hosts.allow and /etc/hosts.deny

Question 46

Which of the following command lines sets the administrator password for ntop to testing 123?

A) ntop --set-admin-password=testing123
B) ntop --set-password=testing123
C) ntop --reset-password=testing123
D) ntop --set-new-password=testing123

Question 47

Which of the following statements are valid wireshark capture filters?

A) port range 10000:tcp-15000:tcp
B) port-range tcp 10000-15000
C) tcp portrange 10000-15000
D) portrange 10000/tcp-15000/tcp
E) portrange 10000-15000 and tcp

Question 48

Which of the following statements describes the purpose of ndpmon?

A) It monitors the network for neighbor discovery messages from new IPv6 hosts and routers.
B) It monitors remote hosts by periodically sending echo requests to them.
C) It monitors the availability of a network link by querying network interfaces.
D) It monitors the network for IPv4 nodes that have not yet migrated to IPv6.
E) It monitors log files for failed login attempts in order to block traffic from offending network nodes.