LCA System Security & Firewall Management 3 — Questions and Answers
Question 1: Which command lists all open firewalld zones and their active interfaces?
- firewall-cmd --list-zones
- firewall-cmd --get-active-zones (Correct answer)
- firewall-cmd --info-zone
- firewall-cmd --state
Correct answer: firewall-cmd --get-active-zones
firewall-cmd --get-active-zones shows each zone that has at least one interface or source assigned.
Question 2: What does setting 'PermitRootLogin no' in /etc/ssh/sshd_config accomplish?
- Disables SSH entirely for root
- Prevents direct root login via SSH while allowing su after login (Correct answer)
- Removes root from the sudoers file
- Locks the root account password
Correct answer: Prevents direct root login via SSH while allowing su after login
This setting blocks SSH authentication as root but does not affect local console login or su/sudo elevation.
Question 3: Which auditd rule syntax watches for writes to /etc/passwd?
- -w /etc/passwd -p wa -k passwd_changes (Correct answer)
- -a always,exit -S write -F path=/etc/passwd
- -w /etc/passwd -p r -k passwd_read
- -W /etc/passwd --write --key passwd
Correct answer: -w /etc/passwd -p wa -k passwd_changes
The -w flag specifies the watch path, -p wa means watch for writes and attribute changes, and -k sets the key label.
Question 4: Which kernel parameter, set via sysctl, disables ICMP echo (ping) responses?
- net.ipv4.icmp_echo_ignore_all = 1 (Correct answer)
- net.ipv4.conf.all.accept_redirects = 0
- net.ipv4.ip_forward = 0
- net.ipv4.tcp_syncookies = 1
Correct answer: net.ipv4.icmp_echo_ignore_all = 1
Setting icmp_echo_ignore_all to 1 instructs the kernel to silently discard all ICMP echo requests.
Question 5: In SELinux, what does the Boolean 'httpd_can_network_connect' control?
- Whether Apache can bind to privileged ports
- Whether the httpd process can initiate outbound network connections (Correct answer)
- Whether SELinux enforces labels on Apache config files
- Whether Apache can read NFS-mounted directories
Correct answer: Whether the httpd process can initiate outbound network connections
This Boolean allows or denies the Apache httpd daemon from making outbound TCP connections, useful for reverse-proxy scenarios.
Question 6: What is the effect of running 'chmod 4755' on an executable?
- Sets the sticky bit and makes it world-writable
- Sets the SUID bit so the file runs with the owner's privileges (Correct answer)
- Sets the SGID bit so the file runs with group privileges
- Removes all special permission bits
Correct answer: Sets the SUID bit so the file runs with the owner's privileges
The leading '4' in octal notation sets the Set-UID bit, causing execution under the file owner's UID.
Question 7: Which command shows all current iptables rules in the filter table with line numbers?
- iptables -L --line-numbers
- iptables -S -n
- iptables -t filter -L -n --line-numbers (Correct answer)
- iptables --show-rules
Correct answer: iptables -t filter -L -n --line-numbers
Combining -t filter, -L (list), -n (numeric), and --line-numbers gives a numbered, numeric listing of filter table rules.
LCA System Security & Firewall Management 3
Which command lists all open firewalld zones and their active interfaces?