Linux Security 4 — Questions and Answers
Question 1: What is the primary purpose of the Linux Audit daemon (auditd)?
- Record security-relevant system events to a tamper-evident log (Correct answer)
- Block unauthorized processes in real time
- Scan files for malware signatures
- Monitor network traffic for intrusions
Correct answer: Record security-relevant system events to a tamper-evident log
auditd logs security events like file access, syscalls, and authentication attempts to /var/log/audit/audit.log.
Question 2: Which iptables chain is used to filter packets destined for the local system?
- INPUT (Correct answer)
- FORWARD
- OUTPUT
- PREROUTING
Correct answer: INPUT
The INPUT chain processes packets whose destination is the local host.
Question 3: What does 'find / -perm -4000' search for?
- Files with the SUID bit set (Correct answer)
- Files readable by all users
- World-writable files
- Files owned by root
Correct answer: Files with the SUID bit set
-perm -4000 matches files where the SUID bit (4000) is set, which can be a privilege escalation risk.
Question 4: Which OpenSSL command generates a 2048-bit RSA private key?
- openssl genrsa -out key.pem 2048 (Correct answer)
- openssl rsa -new -bits 2048
- openssl req -newkey rsa:2048
- openssl create -rsa 2048 key.pem
Correct answer: openssl genrsa -out key.pem 2048
openssl genrsa -out key.pem 2048 generates a 2048-bit RSA private key and writes it to key.pem.
Question 5: What security risk is introduced by having a world-writable /tmp directory without the sticky bit?
- Any user can delete or overwrite other users' files (Correct answer)
- Files in /tmp are exposed to the network
- Programs cannot create temporary files
- The system logs are corrupted
Correct answer: Any user can delete or overwrite other users' files
Without the sticky bit, any user with write access to /tmp can delete files owned by other users, enabling attacks like symlink races.
Question 6: Which command displays the SELinux security context of a file?
- ls -Z filename (Correct answer)
- selinux -context filename
- getfattr --selinux filename
- stat --security filename
Correct answer: ls -Z filename
ls -Z shows the SELinux security context (user:role:type:level) alongside standard file metadata.
Question 7: What is the function of the /etc/hosts.deny file in TCP Wrappers?
- Specifies hosts denied access to wrapped network services (Correct answer)
- Blocks hosts at the firewall level
- Denies DNS resolution for listed hosts
- Prevents listed hosts from logging in via SSH only
Correct answer: Specifies hosts denied access to wrapped network services
TCP Wrappers checks /etc/hosts.allow first; if no match, /etc/hosts.deny is checked to block access to wrapped services.
Linux Security 4
What is the primary purpose of the Linux Audit daemon (auditd)?