LCA System Security & Firewall Management 4

Question 1

Which fail2ban component reads log files and triggers bans based on defined filters?

Accepted Answer

fail2ban-server

Answer

fail2ban-server is the daemon that monitors logs and communicates with the firewall to block offending IPs.

Question 2

What does 'restorecon -Rv /var/www/html' do?

Accepted Answer

Restores SELinux file contexts based on policy for the directory tree

Answer

restorecon applies the correct SELinux contexts as defined in the policy database, -R for recursive, -v for verbose.

Question 3

Which SSH configuration directive restricts login to specific users?

Accepted Answer

AllowUsers

Answer

The AllowUsers directive in sshd_config accepts a space-separated list of usernames permitted to authenticate via SSH.

Question 4

A server is experiencing a SYN flood attack. Which sysctl parameter helps mitigate this?

Accepted Answer

net.ipv4.tcp_syncookies = 1

Answer

TCP SYN cookies allow the server to handle SYN floods without maintaining half-open connection state in the backlog queue.

Question 5

Which command in nftables lists all current rules across all tables?

Accepted Answer

nft list ruleset

Answer

nft list ruleset outputs the complete nftables configuration including all tables, chains, and rules.

(LCA) Certified Linux Administrator Practice Test