Linux Security 4

Question 1

What is the primary purpose of the Linux Audit daemon (auditd)?

Accepted Answer

Record security-relevant system events to a tamper-evident log

Answer

auditd logs security events like file access, syscalls, and authentication attempts to /var/log/audit/audit.log.

Question 2

Which iptables chain is used to filter packets destined for the local system?

Accepted Answer

INPUT

Answer

The INPUT chain processes packets whose destination is the local host.

Question 3

What does 'find / -perm -4000' search for?

Accepted Answer

Files with the SUID bit set

Answer

-perm -4000 matches files where the SUID bit (4000) is set, which can be a privilege escalation risk.

Question 4

Which OpenSSL command generates a 2048-bit RSA private key?

Accepted Answer

openssl genrsa -out key.pem 2048

Answer

openssl genrsa -out key.pem 2048 generates a 2048-bit RSA private key and writes it to key.pem.

Question 5

What security risk is introduced by having a world-writable /tmp directory without the sticky bit?

Accepted Answer

Any user can delete or overwrite other users' files

Answer

Without the sticky bit, any user with write access to /tmp can delete files owned by other users, enabling attacks like symlink races.

Linux Practice Test