LCA System Security & Firewall Management 4 — Questions and Answers
Question 1: Which fail2ban component reads log files and triggers bans based on defined filters?
- fail2ban-server (Correct answer)
- fail2ban-client
- jail.conf
- filter.d
Correct answer: fail2ban-server
fail2ban-server is the daemon that monitors logs and communicates with the firewall to block offending IPs.
Question 2: What does 'restorecon -Rv /var/www/html' do?
- Recursively removes SELinux contexts from the directory
- Restores SELinux file contexts based on policy for the directory tree (Correct answer)
- Reloads the SELinux policy from /etc/selinux
- Changes all files to the httpd_sys_content_t context regardless of policy
Correct answer: Restores SELinux file contexts based on policy for the directory tree
restorecon applies the correct SELinux contexts as defined in the policy database, -R for recursive, -v for verbose.
Question 3: Which SSH configuration directive restricts login to specific users?
- AllowGroups
- AllowUsers (Correct answer)
- PermitUsers
- AuthorizedUsers
Correct answer: AllowUsers
The AllowUsers directive in sshd_config accepts a space-separated list of usernames permitted to authenticate via SSH.
Question 4: A server is experiencing a SYN flood attack. Which sysctl parameter helps mitigate this?
- net.ipv4.tcp_syncookies = 1 (Correct answer)
- net.ipv4.icmp_echo_ignore_all = 1
- net.ipv4.conf.all.rp_filter = 1
- net.ipv4.ip_local_port_range
Correct answer: net.ipv4.tcp_syncookies = 1
TCP SYN cookies allow the server to handle SYN floods without maintaining half-open connection state in the backlog queue.
Question 5: Which command in nftables lists all current rules across all tables?
- nft list ruleset (Correct answer)
- nft show all
- nft -L rules
- nft dump tables
Correct answer: nft list ruleset
nft list ruleset outputs the complete nftables configuration including all tables, chains, and rules.
Question 6: What file stores the public keys authorized for key-based SSH login for a specific user?
- ~/.ssh/id_rsa.pub
- ~/.ssh/known_hosts
- ~/.ssh/authorized_keys (Correct answer)
- /etc/ssh/authorized_keys
Correct answer: ~/.ssh/authorized_keys
The ~/.ssh/authorized_keys file holds public keys whose corresponding private keys are accepted for authentication.
Question 7: Which command shows which SELinux Boolean values are currently enabled?
- semanage boolean -l
- getsebool -a (Correct answer)
- sestatus -b
- seinfo --bool
Correct answer: getsebool -a
getsebool -a lists all SELinux Booleans and their current (on/off) state.
LCA System Security & Firewall Management 4
Which fail2ban component reads log files and triggers bans based on defined filters?