LPIC3 303 Security Practice Test

These questions are part of the practice quiz. Start practicing

• Which of the following statements about an X509 certificate with Basic Constraints CA:TRUE is correct?
• What is the main premise behind the Zero Trust Architecture model?
• What type of key exchange does OpenVPN primarily use?
• Which of the following names corresponds to existing attribute namespaces in Linux Extended File Attributes? (Choose THREE correct answers.)
• Which sections are allowed within the Kerberos configuration file krb5.conf? (Choose THREE correct answers.)
• What is a common goal of encryption?
• What does the directive "keepalive" in OpenVPN configuration do?
• Which of the following is a type of firewall?
• When adding additional users to a file's extended ACLs, what is true about the default behavior of the ACL mask for the file?
• Describe the role of Active Directory in security management.
• What OpenSSL parameter is used to specify the host name for TLS Server Name Indication?
• How can you revoke write access for all groups and named users on a file?
• Which command generates DNSSEC keys in BIND?
• What is malware?
• Which tool, distributed with BIND 9, will check the syntax of a named configuration file?
• Which of the following is a key benefit of using TLS in OpenVPN?
• Which command will set the user.author attribute on the file afile.txt?
• For improved security, what is often combined with username/password authentication in OpenVPN?
• What does network segmentation involve?
• Which command can be used to decode a file in Data Encryption Standard format?
• What are the required steps to enable secure serverwide zone transfers between two BIND 9 servers using TSIG?
• What defines a security incident?
• What does the command iptables -A INPUT -s 208.77.188.166 -d 10.142.232.1 -p tcp --dport 22 -j ACCEPT accomplish?
• What OpenSSL command will generate a certificate signing request (CSR) using the private key file privkey.pem?
• Which option changes the acknowledgment timeout period to 5 seconds for OpenVPN control packets?
• Which command can display the date information from a certificate?
• Which option in an Apache HTTPD configuration file enables OCSP stapling?
• What are valid security types for NFSv4?
• What characterizes a Denial-of-Service (DoS) attack?
• What does the command iptables -A INPUT -s !127.0.0.0/8 -p tcp --dport 111 -j DROP do?
• What does the command iptables -A INPUT -s 208.77.188.166 -j DROP accomplish?
• What does the term 'security through obscurity' imply?
• What does an Intrusion Detection System (IDS) do?
• What role does a password manager play in password creation?
• What effect does the command iptables -A INPUT -d 10.142.232.1 -p tcp --dport 20:21 -j ACCEPT have on TCP packets?
• What is data encryption in transit?
• Which command establishes a trust between a FreeIPA domain and an Active Directory domain?
• In a setkey parameter file, which statement is used to create a new SPD entry?
• Which combination of OpenVPN authentication modes is correct?
• What is the role of network access control (NAC)?
• What OpenSSL command connects to a remote POP3S server for testing?
• What does two-factor authentication (2FA) involve?
• How can one inspect the information in a X509 certificate using OpenSSL?
• Which command is used to run a new shell for a user changing the SELinux context?
• What is a honeypot in cybersecurity?
• In OpenVPN, what is the role of a "client certificate"?
• What is the function of a Virtual Private Network (VPN)?
• Which of the following types can be specified within the Linux Audit system?
• What is Zero Trust Architecture?
• Which LUKS action initializes a LUKS partition and sets the initial key?
• Which practices are recommended for securing private keys?
• What is phishing?
• In Apache's configuration, what directive is used to control whether authentication is required for a user?
• What is the main purpose of using cryptsetup in Linux?
• Which of the following methods can be used to deactivate a rule in Snort? (Choose TWO correct answers.)
• Which command changes the source IP address to 192.0.2.11 for all IPv4 packets going through eth0?
• What is the purpose of a Digital Certificate?
• What are the main components of an effective security awareness program?
• Which command mounts the contents of the eCryptfs encrypted directory ~/Private?
• What is patch management?
• What does SSL stand for in network security?
• Which option in the OpenSSL command is used to define the validity of a certificate?
• What is the purpose of the program snort-stat?
• Which statement is true regarding eCryptfs?
• Which information in a DNSSEC-signed zone is signed by the key signing key?
• Which command adds a new user usera to FreeIPA?
• Which command is used to convert a PEM certificate to DER format?
• What does SELinux enforce to ensure minimum privileges for user space programs?
• What is a Primary function of Public Key Infrastructure (PKI)?
• Which statement describes the nature of a Root CA certificate?
• In which path is the data, which can be altered by the sysctl command, accessible?
• Which of the following statements is true when querying the extended attributes of a file that has no extended attributes set?
• How does symmetric encryption differ from asymmetric encryption?
• What is the purpose of the NSEC record in DNSSEC?
• What command is used to update NVTs from the OpenVAS NVT feed?
• Which of the following protocols is commonly used for secure email communication?
• Which of the following are valid dmcrypt modes? (Choose 3 correct answers)
• Which PAM module checks new passwords against dictionary words and enforces complexity?
• What command is used to create a Basic Authentication password file for Apache?
• What is a characteristic of private keys regarding their length?
• What is the significance of a digital footprint?
• What is an SO rule in the context of Snort?
• How do you properly add an X509v3 Subject Alternative Name for multiple host names using OpenSSL?
• How does a risk assessment differ from a vulnerability assessment?
• Which OpenSSL command is used to sign a certificate with a private key?
• Which of the following database names can be used within a Name Service Switch (NSS) configuration file?
• Which command adds users using SSSD's local service?
• What can be determined about the permissions for the file afile given the output from getfacl?
• What kind of model does SELinux utilize for access control?
• What does effective backup strategy promote in a business?
• Which of the following best describes social engineering?
• Which statements are true of the following Wireshark capture filter? (Select 2 correct answers)
• What is a common sign of a phishing attempt?
• What does data sanitization refer to?
• What is the primary goal of a penetration test?
• What is the primary purpose of a security policy?
• What is the purpose of IP sets in the context of network security?
• What does the CIA triad stand for in information security?
• Which term best describes the process of converting information into a code to prevent unauthorized access?
• What is the purpose of the ndpmon utility?
• What does risk mitigation involve?
• Which of the following are built-in chains for the iptables nat table? (Select THREE correct answers)
• What is one advantage of DNSSEC for DNS integrity?
• Which command allows you to verify a connection to LDAP over SSL?
• What is the role of antivirus software in security?
• Which access control model is established by using SELinux?
• What does the "verb" directive control in an OpenVPN configuration file?
• What is the purpose of a security policy?
• What is a security policy?
• Which file is primarily used for specifying the configuration of LUKS encrypted devices?
• Which command defines an audit rule that monitors read and write operations to the file /etc/firewall/rules and associates the rule with the name firewall?
• Which command generates a self-signed test certificate?
• Why is a cybersecurity framework important?
• What is a critical step required before using OpenVPN?
• What is the primary purpose of security questionnaires?
• What option of mount.cifs specifies the local owner of files on a mounted CIFS share?
• How does AppArmor configure access control settings?
• What does an incident response plan aim to document?
• Which command effectively initiates a connection to a remote server with SSL/TLS support using OpenSSL?
• What does the log message indicate when user hugh attempts to access /etc/shadow?
• What is two-factor authentication?
• What is the main function of a password manager?
• What is the purpose of the subject key identifier in a certificate?
• Which line in the OpenVPN server.conf file supplies a DNS server for DHCP clients?
• What command allows you to create a new key in a LUKS device?
• What is the default UDP port for OpenVPN traffic?
• What option should be used with the openvpn command to prevent ephemeral keys from being written to swap space?
• What action does the AllowOverride directive permit for .htaccess files?
• What is the command used to change the context of a file in SELinux?
• What types of attacks are DNS servers vulnerable to? (Select 3 correct answers)
• What does 'BYOD' stand for?
• What happens when the command getfattr afile is run while the file afile has no extended attributes set?
• What is social engineering in the context of security?
• Which of the following expressions are valid AIDE rules?
• In OpenVPN configuration, which directive specifies the remote server and port for connection?
• How does an Intrusion Prevention System (IPS) differ from an IDS?
• Which configuration option in Apache HTTPD requires a client certificate for authentication?
• What line in the /etc/pam.d/su file allows root to use su without supplying passwords?
• What is the key objective of risk mitigation strategies?
• Which command installs and configures a new FreeIPA server, including all sub-components?
• What is a primary use of SSL?
• What does a Security Information and Event Management (SIEM) system do?
• What are security patches designed to do?
• Which of the following is a valid OpenVPN authentication mode?
• Which DNS label points to the DANE information used for HTTPS connections to https://www.example.com/?
• What is the primary function of a firewall?
• Which utility is used to manage NFSv4 ACLs?
• What does data loss prevention (DLP) aim to achieve?
• What command generates a certificate signing request (CSR) using an existing private key?
• Which command disables the automatic password expiry for the user usera?
• What does session hijacking entail?
• Why is logging and monitoring important in security?
• What does the term 'insider threat' refer to?
• Which of the following resources of a shell and its child processes can be controlled by the Bash built-in command ulimit?
• What is meant by the term 'threat landscape'?
• Which DNS record types can the command dnssec-signzone add to a zone? (Choose 3 correct answers)
• What is one of the main advantages of Smack compared to SELinux?
• How is 'tokenization' defined in data security?
• Which command is used to run a new shell for a user in a new context under SELinux?
• What command deletes the first key from a mapped LUKS device?
• What is the purpose of the AllowOverride None directive in the Apache configuration?
• Which acronym is used to define the revocation of a certificate?
• What is the significance of a security audit?
• What is a significant advantage of Mandatory Access Control over Discretionary Access Control?
• What is a main focus of a Security Operations Center (SOC)?
• Which directive in an OpenVPN server configuration sends network configuration information to the client?
• What is the purpose of a Network Security Group (NSG)?
• In cybersecurity, what does 'SOC' stand for?
• Which Apache directives restrict access based on host/domain name and IP address?
• What is the outcome of effective network segmentation?
• Which actions can help secure a BIND server? (Select 3 correct answers)
• Which of the following are valid ntop deployment scenarios? (Select all that apply)
• Which of the following commands creates a certificate signing request while including certain subject attributes?
• Which of the following is NOT included in a Snort rule header?
• Which of the following terms refer to existing scan techniques with nmap? (Choose TWO correct answers.)
• Which of the following describes a key characteristic of SELinux?
• Which security feature allows BIND to specify which clients can query the server?
• What does the principle of least privilege entail?
• Which of the following best defines 'tokenization' in the context of data security?
• What are security patches?
• Which of the following statements are valid Wireshark capture filters? (Choose TWO correct answers.)
• Which command will list all of the extended attributes on the file afile.txt with the values?
• What effect does the configuration SSLStrictSNIVHostCheck have on an Apache HTTPD virtual host?
• What does the error message "TLS Error: TLS key negotiation failed to occur within 60 seconds" indicate?
• Which OpenSSL command is often used to generate a new private key?
• Which of the following describes the essence of multi-factor authentication (MFA)?
• You receive an error when trying to set an ACL on a file. What is the most likely reason?
• What is a security breach?
• What is multi-factor authentication (MFA)?
• What is vulnerability scanning?
• Which components are part of FreeIPA? (Choose THREE correct answers.)
• How does network access control (NAC) enhance security?
• Which of the following is a recommended practice for operating a DNS server securely?
• How does TSIG authenticate name servers to perform secured zone transfers?
• What command switches SELinux into permissive mode?
• What is the difference between an SELinux domain and an SELinux type?
• Which file extension is commonly used for OpenVPN configuration files?
• In which scenario must an administrator use ethernet bridging instead of routing in OpenVPN configuration? (Select 2 correct answers)
• What aspect of security does two-factor authentication (2FA) primarily improve?
• Why is monitoring essential in data loss prevention strategies?
• What is a common method for securing sensitive data?
• Which algorithm uses prime numbers?
• Which type of firewall inspects packets at the network layer?
• What is the primary purpose of encryption?
• Which protocol is primarily used by OpenVPN to secure data?
• What does 'encryption at rest' refer to?
• What command would be used for changing file contexts in SELinux?
• Which command included in the Linux Audit system provides searching and filtering of the audit log?
• Which type of key can be generated to enhance security in DNS server configurations?
• Which command is used to start the OpenVPN service on a Unix-based system?
• What is meant by 'whaling' in the context of phishing attacks?
• Which prefixes may appear in the output of getcifsacl?
• Which command displays all ebtables rules contained in the filter table with their packet and byte counters?
• An administrator is capturing traffic with Wireshark and is only seeing ARP traffic. What is the most likely cause of this?
• Which of the following is a benefit of using an IDS?
• What is a rootkit?
• What is the purpose of the "push" directive in OpenVPN client configuration?
• Which command revokes ACL-based write access for groups and named users on the file afile?
• What is the purpose of a strong password policy?
• What is the correct format for specifying the SELinux security context for files in /opt?
• The command "nmap -sS -O 10.142.232.10" produces a specific output. Which of the following statements are true? (Select 2 correct answers)
• What is a difference between AppArmor and SELinux?
• What file is used to automate responses during certificate generation using OpenSSL?
• Which configuration file must be edited to fix the error regarding /dev/mapper/cryptvol not existing?
• Which statement is true about Linux Extended Attributes on files? (Select 2 correct answers)
• How do SELinux permissions interact with standard Linux permissions?
• Which of the following are characteristics of strong encryption algorithms?
• Under which path is the SELinux pseudofilesystem located?
• What does the acronym 'NIST' stand for?
• Which of the following is a key characteristic of a firewall?
• Why are backups critical in a security strategy?
• Which authentication method was introduced in NFS version 4?
• What command will generate a private RSA key without a passphrase?
• Which command is used to check the validity of a digital signature on a message?
• What role does access control play in information security?
• Which of the following command lines sets the administrator password for ntop to testing123?
• What command lists basic information about all targets available to cryptmount?
• What is the purpose of Snort inline?
• What feature does SELinux provide concerning Mandatory Access Control?
• What is missing in this Apache configuration for the members area to work properly?
• In SELinux, what role does the policy framework play?
• Which of the following statements is true about chroot environments?