CompTIA Linux+ Security and Access Control Flashcards

Which command displays the current SELinux enforcement mode?

Answer: getenforce

getenforce prints the current SELinux mode: Enforcing, Permissive, or Disabled.

A file has permissions -rwsr-xr-x. What does the 's' in the owner execute position indicate?

Answer: SUID bit is set

An 's' in the owner execute position means the SUID (Set User ID) bit is set, causing the file to run with the owner's privileges.

Which PAM module enforces password complexity requirements on Linux?

Answer: pam_pwquality.so

pam_pwquality.so checks password strength and enforces complexity rules such as minimum length and character classes.

What does the 'sticky bit' do when applied to a directory like /tmp?

Answer: Allows only the file owner or root to delete files within it

The sticky bit on a directory restricts file deletion so only the file's owner, the directory's owner, or root can remove files.

Which file defines the default password aging policy for new user accounts on a Linux system?

Answer: /etc/login.defs

/etc/login.defs contains system-wide defaults for password aging, UID/GID ranges, and other account parameters.

A sysadmin wants to prevent a user from logging in interactively. Which shell assignment achieves this?

Answer: /sbin/nologin

/sbin/nologin is the standard shell to assign when blocking interactive logins while still allowing service accounts to function.

Which command is used to add a user to a supplementary group without removing existing group memberships?

Answer: usermod -aG groupname username

usermod -aG appends the user to the specified group; without -a, the -G option would replace all supplementary groups.