Linux Security 2 — Questions and Answers
Question 1: Which command displays the current SELinux enforcement mode?
- getenforce (Correct answer)
- selinuxstatus
- sestatus --mode
- selinux -q
Correct answer: getenforce
getenforce prints the current SELinux mode: Enforcing, Permissive, or Disabled.
Question 2: What does the sticky bit do when set on a directory?
- Only the file owner or root can delete files within it (Correct answer)
- Files in the directory cannot be modified
- The directory is hidden from non-root users
- Files are automatically encrypted
Correct answer: Only the file owner or root can delete files within it
The sticky bit on a directory prevents users from deleting or renaming files they do not own, even if they have write permission on the directory.
Question 3: Which firewalld command adds a service permanently to the public zone?
- firewall-cmd --zone=public --add-service=http --permanent (Correct answer)
- firewall-cmd --add-service=http --zone=public
- firewall-cmd --permanent --service=http
- firewall-cmd --zone=public --open=http
Correct answer: firewall-cmd --zone=public --add-service=http --permanent
The --permanent flag makes the rule persist across reboots; without it the change is runtime-only.
Question 4: What is the purpose of the /etc/sudoers file?
- Define which users can run commands as root or another user (Correct answer)
- Store hashed passwords for sudo users
- Log all sudo command executions
- Set password expiration policies
Correct answer: Define which users can run commands as root or another user
/etc/sudoers specifies user and group privileges for running commands via sudo.
Question 5: Which SSH configuration option disables password-based login, allowing only key-based authentication?
- PasswordAuthentication no (Correct answer)
- AllowPassword false
- AuthMethod key-only
- DisablePassword yes
Correct answer: PasswordAuthentication no
Setting PasswordAuthentication no in /etc/ssh/sshd_config forces clients to use key-based authentication.
Question 6: What does 'chattr +i /etc/passwd' accomplish?
- Makes the file immutable so no user, including root, can modify or delete it (Correct answer)
- Sets the immutable bit only for non-root users
- Encrypts the file contents
- Marks the file for integrity checking by aide
Correct answer: Makes the file immutable so no user, including root, can modify or delete it
The +i attribute makes a file immutable; even root cannot alter it until the attribute is removed with chattr -i.
Question 7: Which tool is used to audit Linux system calls made by a process for security analysis?
- strace (Correct answer)
- ltrace
- auditd
- lsof
Correct answer: strace
strace intercepts and records system calls made by a process, useful for identifying suspicious behavior.
Linux Security 2
Which command displays the current SELinux enforcement mode?