Linux Security 3 — Questions and Answers
Question 1: Which command shows all open network ports and the processes listening on them?
- ss -tlnp (Correct answer)
- netstat -a
- lsof -i
- ifconfig -ports
Correct answer: ss -tlnp
ss -tlnp shows TCP listening ports (-t -l), numeric addresses (-n), and the owning process (-p).
Question 2: What is the correct permission octal value for a file readable and writable by owner only?
- 600 (Correct answer)
- 644
- 700
- 640
Correct answer: 600
600 grants read (4) and write (2) to the owner only; group and others have no permissions.
Question 3: Which AppArmor command places a profile into enforce mode?
- aa-enforce /etc/apparmor.d/profile (Correct answer)
- apparmor --enforce profile
- aa-status --enforce profile
- systemctl enforce apparmor profile
Correct answer: aa-enforce /etc/apparmor.d/profile
aa-enforce activates an AppArmor profile in enforce mode, blocking policy violations.
Question 4: What does the 'umask 027' command do?
- New files get permissions 640 and new directories get 750 (Correct answer)
- Removes all permissions from new files
- Sets the maximum permission to 027
- Makes all new files executable
Correct answer: New files get permissions 640 and new directories get 750
umask 027 masks out write for group and all permissions for others, resulting in 640 for files and 750 for directories.
Question 5: Which log file records failed and successful sudo usage on most Linux distributions?
- /var/log/auth.log or /var/log/secure (Correct answer)
- /var/log/sudo.log
- /var/log/syslog
- /var/log/messages
Correct answer: /var/log/auth.log or /var/log/secure
Authentication events including sudo use are written to /var/log/auth.log (Debian-based) or /var/log/secure (RHEL-based).
Question 6: What is the effect of running 'passwd -l username' on a Linux system?
- Locks the user account by prefixing a '!' to the password hash (Correct answer)
- Deletes the user's password permanently
- Sets the account to expire immediately
- Forces a password change at next login
Correct answer: Locks the user account by prefixing a '!' to the password hash
passwd -l locks an account by prepending '!' to the hashed password in /etc/shadow, preventing password-based login.
Question 7: Which command checks the integrity of installed RPM packages against their checksums?
- rpm -Va (Correct answer)
- rpm --verify-all
- yum integrity check
- checksum --rpm
Correct answer: rpm -Va
rpm -Va verifies all installed packages, reporting any files that differ from the original package metadata.
Linux Security 3
Which command shows all open network ports and the processes listening on them?