Linux+ CompTIA Linux+ Security and Access Control 2 — Questions and Answers
Question 1: Which command displays the current SELinux enforcement mode?
- sestatus
- getenforce (Correct answer)
- setenforce
- seinfo
Correct answer: getenforce
getenforce prints the current SELinux mode: Enforcing, Permissive, or Disabled.
Question 2: A file has permissions -rwsr-xr-x. What does the 's' in the owner execute position indicate?
- Sticky bit is set
- SGID bit is set
- SUID bit is set (Correct answer)
- Immutable flag is set
Correct answer: SUID bit is set
An 's' in the owner execute position means the SUID (Set User ID) bit is set, causing the file to run with the owner's privileges.
Question 3: Which PAM module enforces password complexity requirements on Linux?
- pam_unix.so
- pam_tally2.so
- pam_pwquality.so (Correct answer)
- pam_limits.so
Correct answer: pam_pwquality.so
pam_pwquality.so checks password strength and enforces complexity rules such as minimum length and character classes.
Question 4: What does the 'sticky bit' do when applied to a directory like /tmp?
- Prevents the directory from being deleted
- Allows only the file owner or root to delete files within it (Correct answer)
- Makes all files in the directory executable
- Prevents files from being written to the directory
Correct answer: Allows only the file owner or root to delete files within it
The sticky bit on a directory restricts file deletion so only the file's owner, the directory's owner, or root can remove files.
Question 5: Which file defines the default password aging policy for new user accounts on a Linux system?
- /etc/passwd
- /etc/shadow
- /etc/login.defs (Correct answer)
- /etc/pam.d/common-password
Correct answer: /etc/login.defs
/etc/login.defs contains system-wide defaults for password aging, UID/GID ranges, and other account parameters.
Question 6: A sysadmin wants to prevent a user from logging in interactively. Which shell assignment achieves this?
- /bin/bash
- /bin/sh
- /sbin/nologin (Correct answer)
- /bin/false
Correct answer: /sbin/nologin
/sbin/nologin is the standard shell to assign when blocking interactive logins while still allowing service accounts to function.
Question 7: Which command is used to add a user to a supplementary group without removing existing group memberships?
- usermod -g groupname username
- groupadd username groupname
- usermod -aG groupname username (Correct answer)
- gpasswd groupname username
Correct answer: usermod -aG groupname username
usermod -aG appends the user to the specified group; without -a, the -G option would replace all supplementary groups.
Linux+ CompTIA Linux+ Security and Access Control 2
Which command displays the current SELinux enforcement mode?