Linux Security 5 — Questions and Answers
Question 1: Which command forces all users to change their passwords on their next login?
- chage -d 0 username (Correct answer)
- passwd --expire username
- usermod --force-reset username
- chage --reset-all username
Correct answer: chage -d 0 username
chage -d 0 sets the last password change date to epoch, forcing an immediate password change at next login.
Question 2: What is the risk of having NOPASSWD in a sudoers entry?
- The user can run sudo commands without entering a password, bypassing authentication (Correct answer)
- The account password is deleted from /etc/shadow
- Root login is enabled without a password
- All users on the system gain root access
Correct answer: The user can run sudo commands without entering a password, bypassing authentication
NOPASSWD allows a user to invoke sudo without a password, which eliminates a key authentication checkpoint.
Question 3: Which nmap flag performs a SYN (stealth) scan without completing the TCP handshake?
- -sS (Correct answer)
- -sT
- -sU
- -sA
Correct answer: -sS
nmap -sS sends SYN packets and never completes the handshake, making the scan less likely to appear in connection logs.
Question 4: What does 'gpg --verify file.sig file' accomplish?
- Checks that the file's signature matches the signer's public key (Correct answer)
- Decrypts an encrypted file using the signature
- Generates a new GPG signature for the file
- Imports the signing key from the signature file
Correct answer: Checks that the file's signature matches the signer's public key
gpg --verify validates the detached signature file against the data file using the signer's public key in your keyring.
Question 5: Which file defines password complexity and aging policies for PAM-based authentication on RHEL/CentOS?
- /etc/security/pwquality.conf (Correct answer)
- /etc/pam.d/password-policy
- /etc/login.defs only
- /etc/passwd.rules
Correct answer: /etc/security/pwquality.conf
pwquality.conf controls minimum length, character class requirements, and other complexity rules enforced by pam_pwquality.
Question 6: What is a bind mount in the context of container security?
- Mounting a host directory into a container, potentially exposing host files (Correct answer)
- Restricting a container to a specific CPU core
- Binding a container's network namespace to the host
- Locking a container's filesystem as read-only
Correct answer: Mounting a host directory into a container, potentially exposing host files
Bind mounts share a host path inside a container; if sensitive directories like /etc are mounted, they can be read or modified by the container.
Question 7: Which command installs and activates fail2ban to protect SSH from brute-force attacks?
- systemctl enable --now fail2ban (Correct answer)
- fail2ban-client start sshd
- service fail2ban install && start
- apt install fail2ban --activate-ssh
Correct answer: systemctl enable --now fail2ban
After installing fail2ban, systemctl enable --now fail2ban starts the service immediately and enables it at boot.
Linux Security 5
Which command forces all users to change their passwords on their next login?