LCA System Security & Firewall Management 5

Question 1

Which mode does SELinux operate in when it logs policy violations but does not enforce them?

Accepted Answer

Permissive

Answer

Permissive mode records AVC denials to the audit log but allows the operation, useful for troubleshooting policy issues.

Question 2

What is the purpose of the 'umask 027' setting in a shell profile?

Accepted Answer

Restricts new files to owner read/write and group read only

Answer

umask 027 subtracts from 666/777 defaults, yielding 640 for files and 750 for directories, blocking world access.

Question 3

Which firewall-cmd option applies all --permanent rules without restarting the firewalld service?

Accepted Answer

--reload

Answer

firewall-cmd --reload re-reads the permanent configuration and applies it to the runtime configuration without service restart.

Question 4

What does the 'NOPASSWD' tag in a sudoers entry accomplish?

Accepted Answer

Allows the specified command to run via sudo without a password prompt

Answer

NOPASSWD exempts that specific rule from requiring the user's password when invoking sudo for the listed commands.

Question 5

Which log file should an administrator check first to view SELinux AVC denial messages?

Accepted Answer

/var/log/audit/audit.log

Answer

The auditd daemon writes AVC (Access Vector Cache) denial records to /var/log/audit/audit.log.

(LCA) Certified Linux Administrator Practice Test