LCA System Security & Firewall Management 2 — Questions and Answers
Question 1: Which firewalld zone is most appropriate for a highly trusted internal network interface?
- public
- trusted (Correct answer)
- internal
- dmz
Correct answer: trusted
The 'trusted' zone in firewalld accepts all connections and is designed for fully trusted networks.
Question 2: What command permanently adds HTTP service to the active firewalld zone?
- firewall-cmd --add-service=http
- firewall-cmd --permanent --add-service=http (Correct answer)
- firewall-cmd --zone=public --add-service=http
- firewall-cmd --reload --add-service=http
Correct answer: firewall-cmd --permanent --add-service=http
The --permanent flag ensures the rule persists across reboots; --reload is then needed to apply it.
Question 3: Which SELinux command is used to change a file's security context permanently?
- chcon
- semanage fcontext (Correct answer)
- restorecon
- setsebool
Correct answer: semanage fcontext
semanage fcontext adds a persistent policy rule, while chcon only changes the context temporarily.
Question 4: What does the 'nmap -sS' scan type perform?
- Full TCP connect scan
- UDP port scan
- TCP SYN (stealth) scan (Correct answer)
- OS fingerprinting scan
Correct answer: TCP SYN (stealth) scan
A SYN scan sends SYN packets and never completes the handshake, making it faster and less detectable than a full connect scan.
Question 5: Which file configures system-wide PAM password quality requirements on RHEL-based systems?
- /etc/pam.d/passwd
- /etc/security/pwquality.conf (Correct answer)
- /etc/login.defs
- /etc/shadow
Correct answer: /etc/security/pwquality.conf
pwquality.conf is read by the pam_pwquality module to enforce password complexity rules.
Question 6: Which iptables target silently drops packets without sending any response?
- REJECT
- DROP (Correct answer)
- DENY
- BLOCK
Correct answer: DROP
DROP silently discards the packet, whereas REJECT sends an ICMP error back to the sender.
Question 7: What is the purpose of the /etc/hosts.deny file in TCP Wrappers?
- Lists services exempt from firewall rules
- Denies access to specified hosts for wrapped services (Correct answer)
- Configures iptables blacklist rules
- Sets kernel network security parameters
Correct answer: Denies access to specified hosts for wrapped services
TCP Wrappers checks /etc/hosts.allow first, then /etc/hosts.deny to determine whether to permit a connection.
LCA System Security & Firewall Management 2
Which firewalld zone is most appropriate for a highly trusted internal network interface?