LCA System Security & Firewall Management 5 — Questions and Answers
Question 1: Which mode does SELinux operate in when it logs policy violations but does not enforce them?
- Disabled
- Permissive (Correct answer)
- Enforcing
- Audit
Correct answer: Permissive
Permissive mode records AVC denials to the audit log but allows the operation, useful for troubleshooting policy issues.
Question 2: What is the purpose of the 'umask 027' setting in a shell profile?
- Grants execute permission to all new files
- Restricts new files to owner read/write and group read only (Correct answer)
- Sets the default firewall zone for new connections
- Prevents other users from viewing process listings
Correct answer: Restricts new files to owner read/write and group read only
umask 027 subtracts from 666/777 defaults, yielding 640 for files and 750 for directories, blocking world access.
Question 3: Which firewall-cmd option applies all --permanent rules without restarting the firewalld service?
- --apply
- --commit
- --reload (Correct answer)
- --refresh
Correct answer: --reload
firewall-cmd --reload re-reads the permanent configuration and applies it to the runtime configuration without service restart.
Question 4: What does the 'NOPASSWD' tag in a sudoers entry accomplish?
- Disables sudo for the specified command
- Allows the specified command to run via sudo without a password prompt (Correct answer)
- Grants the user full root access without a password
- Logs the command to syslog without prompting
Correct answer: Allows the specified command to run via sudo without a password prompt
NOPASSWD exempts that specific rule from requiring the user's password when invoking sudo for the listed commands.
Question 5: Which log file should an administrator check first to view SELinux AVC denial messages?
- /var/log/secure
- /var/log/audit/audit.log (Correct answer)
- /var/log/messages
- /var/log/selinux.log
Correct answer: /var/log/audit/audit.log
The auditd daemon writes AVC (Access Vector Cache) denial records to /var/log/audit/audit.log.
Question 6: An administrator wants to block all traffic from subnet 10.0.5.0/24 using iptables. Which command achieves this?
- iptables -A INPUT -s 10.0.5.0/24 -j REJECT
- iptables -I INPUT -s 10.0.5.0/24 -j DROP (Correct answer)
- iptables -A OUTPUT -d 10.0.5.0/24 -j DROP
- iptables -P INPUT 10.0.5.0/24 DROP
Correct answer: iptables -I INPUT -s 10.0.5.0/24 -j DROP
Using -I inserts the rule at the top of the INPUT chain, ensuring it is evaluated before any ACCEPT rules for that subnet.
Question 7: What is the function of the 'chattr +i' command on a file?
- Makes the file immutable so it cannot be modified, deleted, or renamed even by root (Correct answer)
- Sets the SUID bit on the file
- Encrypts the file using the kernel's built-in crypto layer
- Grants immutable read access to all users
Correct answer: Makes the file immutable so it cannot be modified, deleted, or renamed even by root
The +i (immutable) attribute prevents any modification, deletion, renaming, or hard-linking to the file, even by root.
LCA System Security & Firewall Management 5
Which mode does SELinux operate in when it logs policy violations but does not enforce them?