LCA System Security & Firewall Management

Question 1

Which command is used to check the status of the firewall on a Linux system?

Accepted Answer

firewalld-cmd --state

Answer

For systems using `firewalld`, the `firewall-cmd --state` command is used to check if the `firewalld` service is running. It will output "running" if the firewall daemon is active, or indicate if it's not. This is the standard way to quickly ascertain the operational status of `firewalld`.

Question 2

What does the Linux command 'iptables' manage?

Accepted Answer

Network traffic filtering

Answer

`iptables` is a command-line utility that allows system administrators to configure the Linux kernel firewall (netfilter). It is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. This enables precise control over incoming and outgoing network traffic, enhancing system security.

Question 3

Which tool simplifies firewall management on many Linux distributions?

Accepted Answer

firewalld

Answer

`firewalld` is a dynamic firewall management tool that simplifies firewall configuration on many Linux distributions, especially Red Hat-based ones like CentOS and Fedora. It uses zones and services to manage rules, allowing for easier and more flexible configuration compared to directly manipulating `iptables` rules. It can change rules without dropping existing connections.

Question 4

What port number does SSH use by default?

Accepted Answer

22

Answer

SSH (Secure Shell) uses port 22 by default for secure remote access to Linux systems. This port is standardized for SSH connections, allowing encrypted communication and secure command execution over an unsecured network. While it's common practice to change this default port for added security, 22 remains the standard.

Question 5

What is the primary purpose of Fail2Ban?

Accepted Answer

Intrusion prevention

Answer

Fail2Ban is an intrusion prevention software framework that protects computer servers from brute-force attacks. It works by monitoring log files for suspicious activity, such as repeated failed login attempts, and then automatically bans the offending IP addresses using firewall rules. This significantly reduces the risk of successful brute-force attacks against services like SSH or web servers.

(LCA) Certified Linux Administrator Practice Test

(LCA) Certified Linux Administrator Practice Test

LCA System Security & Firewall Management