LPIC 102-500
>>Security
Answers with explanation
Take the test here (You need an account. It's free)
1. You need to temporarily prevent users from logging in to the system using ssh or another means. Which of the following describes one method for accomplishing this task?
A. touch /etc/nologin
B. Disable sshd.
C. Remove /etc/login.
D. Add a shadow file.
ANSWER:A. If /etc/nologin exists, users will be prevented from logging in to the system. The root user can still log in, assuming that root logins are enabled within the ssh configuration.
2. Which of the following commands searches the entire filesystem for files with the setuid bit set?
A. find ./ -perm suid
B. find / -perm 4000
C. find / -type suid
D. find / -type f -perm setuid
B. The find command will be used for this purpose, and the permission can be described as 4000 to indicate the presence of the setuid bit. The -type option can be used to change the type of object to be returned but is not relevant for the scenario described.
3. Which of the following commands displays the currently open ports and the process that is using the port?
A. netstat -a
B. lsof -i
C. ps auwx
D. netlist
B. The lsof command can be used for this purpose and, with the - i option, will display the network ports along with their process. The netstat command, when run with the -a option, will display network ports but not the process. The ps command is used for processes but not network ports. Finally, there is no netlist command.
4. You are attempting to unmount a filesystem using the umount command. However, when you do so you receive a message indicating that the filesystem is in use. Which of the following commands can be used determine which process is keeping a filesystem open?
A. fuser
B. ls
C. find
D. ps
A. The fuser command can be used to determine which process is using a given file. The is command will show files and find can be used to find files but not specifically for this purpose. The ps command does show processes but not necessarily ones tied to a particular file.
5. Which of the following commands displays account information such as expiration date, last password change, and other related details?
A. usermod -l
B. userinfo -a
C. chageuser -l
D. chage -l
D. The chage command is used for working with account aging information such as expiration date, password change, days between password changes, and so on. The -l command lists information for the given account. The usermod command is used to make changes to an account, and the other two commands are not valid.
6. Which of the following commands scans the IP address 192.168.1.104 for open ports?
A. nmap 192.168.1.104
B. lsof 192.168.1.104
C. netstat 192.168.1.104
D. netmap 192.168.1.104
A. The nmap command is used to scan for open ports. By default, the nmap command will scan for open TCP ports to the address or addresses specified. The other commands shown do not scan for open ports to external (off-host) IP addresses.
7. Which command is used to create a public/private key pair for use with ssh?
A. ssh -k
B. ssh-keygen
C. ssh-genkey
D. ssh -key
B. The ssh-keygen command is used to create a key pair for use with ssh instead of a password. Of the other options, the ssh command does exist but the -k option is used to disable Generic Security Service Application Program Interface (GSSAPI) credential forwarding and not for the purpose described.
8. Which of the following configuration options sets a hard limit of 25 processes for a user called john /etc/security/limits.conf?
A. john hard proc 25
B. john hard nproc 25
C. john proc 25 hard-limit
D. proc 25 john hard
B. The format is username (or other specifier) followed by hard or soft, depending on the limit type, then the keyword followed by the value for that given keyword.
9. Within which file should you place public keys for servers from which you will accept key-based ssh authentication?
A. ~/.ssh/authorized_keys
B. ~/.ssh/keys
C. ~/.ssh/keyauth
D. ~/.sshd/authkeys
A. The authorized_keys file, stored in the .ssh directory in your home directory, contains public keys that are authorized to log in to the server using their corresponding private key.
10. The system on which you are working does not have the lsof command installed, and you are not allowed to install software without going through four levels of approval and scheduling the installation weeks in advance. However, the netstat command is available. Which option to netstat will show the process ID to which a given network port is connected?
A. -a
B. -n
C. -p
D. -l
C. The -p option shows the process ID to which a given port is connected and is useful for displaying information about which process is listening on a given port. The -a option shows listening and non-listening sockets whereas -n disables name lookups. The -l option shows listening sockets only.
11. You need to look at information on logins beyond that which is captured by the current log file for the last command. Which option to the last command can be used to load information from an alternate file?
A. -a
B. -t
C. -e
D. -f
D. Loading alternate files is accomplished using the -f option. Doing so facilitates exactly the scenario described, being able to examine logins from old log files. The -a option controls the location of the display for the host, whereas -t controls the display to output the logins as of the specified date and time. There is no -e option.
12. You need to examine who is currently logged in to the system. Which of the following commands will display this information?
A. listuser
B. fuser
C. ls -u
D. w
D. The w command shows currently logged-in users along with information such as uptime and load average. The fuser command is used to show open files, and the - u option to is controls the display for file listings. There is no listuser command.
13. You need to execute a command as a specific user. Which of the following commands enables this to occur?
A. sudo -u
B. sudo -U
C. sudo -s
D. sudo -H
A. The -u option is correct for this purpose. An uppercase -U option sets the user context for listing privileges. The -s option sets the shell, and the -H option sets the home directory.
14. Which option in /etc/sudoers will cause the specified command to not prompt for a password?
A. PASSWORD=NO
B. NOPASSWD
C. NOPASSWORD
D. NOPROMPT
B. The NOPASSWD option causes sudo to not prompt for a password for a given sudo command. This is useful for scripted scenarios where a password prompt would cause problems.
15. Which of the following commands will display the CPU time, memory, and other limits for the currently logged-in user?
A. reslimit
B. limitres -a
C. ulimit -a
D. proclimit -n
C. The ulimit command shows such limits, and the -a option shows all limits for the currently logged-in user. The other commands are not valid.
16. Which line in the /etc/hosts.deny file will prevent any host within the 192.168.1.0/24 network from accessing services that operate from xinetd?
A. BLOCK: 192.168.1.0/24
B. REJECT: 192.168.1.0
C. ALL: 192.168.1.0/255.255.255.0
D. NONE: 192.168.1/255.255.255.0
C. The syntax to block access to every service uses the ALL keyword followed by the address or network to which the policy will apply.
17. When expiring a user account with usermod -e, which of the following represents the correct date format?
A. YYYY-MM-DD
B. MM/DD/YYYY
C. DD/MM/YY
D. MM/DD/YY HH:MM:SS
A. The correct format is YYYY-MM-DD for the usermod command.
18. Which of the following directives in a configuration file found within /etc/xinetd.d will prevent the service from starting?
A. enable no
B. start no
C. disable yes
D. boot no
C. The disable option is used for the purpose described, and can be set to yes or no. The other options are not valid for this scenario.
19. You are using an RSA-based key pair for SSH. By default, what is the name of the private key file in ~/.ssh?
A. id_rsa
B. id_rsa.priv
C. id_rsa.key
D. rsa_key.priv
A. The file is named id_rsa by default, and the public key is named id_rsa.pub. For DSA keys, the names are id_dsa and id_dsa. pub. Other key names such as id_ecdsa, id_ecdsa.pub, id_ed25519, and id_ed255i9.pub are also used depending on the algorithm. For client keys, these are typically stored in ~/.ssh/ by default.
20. Which option to the su command will execute a single command with a noninteractive session?
A. -s
B. -u
C. -c
D. -e
C. The -c option executes a single command but does so without an interactive session. The -s option specifies the shell to be used. There is no -u or -e option for the su command.
21. Which file is used to enable the setting of limits for things like logins, processes, memory, and the like for users?
A. /etc/security/limits.conf
B. /etc/userlimits.conf
C. /etc/security/userlimits.conf
D. /etc/security/procmem.conf
A. The /etc/security/limits.conf file (on some Linux distributions this file could be /etc/limits.conf) enables the setting of limits for user logins, processes, memory usage, and other resources. The other files shown do not exist by default.
22. Which of the following best describes the method to use with ssh in order to execute a single command on a remote server?
A. Use the -e option followed by the command.
B. Send the command after the other options as part of the command line.
C. Use the -execute option followed by the command.
D. Use the - s option followed by the command.
B. There is no special option necessary in order to execute a single command on a remote host with ssh, although you might sometimes place the command in quotes if spaces are included. The -s option requests a subsystem and is not related to this scenario. The -e option specifies an escape character.
23. When you’re using ssh-agent, which command and option lists the currently loaded keys?
A. ssh-agent -l
B. ssh -l
C. ssh-list-keys
D. ssh-add -l
D. The ssh-add command is used to list currently loaded keys and is used in conjunction with ssh-agent. There is no -l option to ssh-agent, and the -I option to ssh specifies the login name to use. There is no ssh-list-keys command.
24. Which of the following commands should be used to edit the /etc/sudoers file?
A. Any text editor such as vi or emacs
B. editsudo
C. visudo
D. visudoers
C. While any text editor can be used, it is highly recommended that you use the visudo command to edit /etc/sudoers. Using visudo enables syntax checking, which will help to prevent issues with an invalid configuration, causing problems for those who rely on sudo.
25. Which of the following commands can be used to stop a given service, such as httpd. service, from starting on boot with a systemd-based system?
A. systemctl disable httpdservice
B. systemctl stop httpd.service
C. systemd disable httpd.service
D. systemd enable httpd.service boot=no
A. The systemctl command will be used for this purpose, and the subcommand is disable. There is a stop subcommand, but it will only stop the given service rather than prevent it from starting on boot. The other options are invalid for various reasons, including that they use systemd as the command name rather than systemctl.
26. Which of the following commands will set an account to expire based on the number of days elapsed since January 1, 1970?
A. passwd -e
B. chage -E
C. usermod -l
D. chguser
B. The chage command can be used for this purpose, and the -E option accepts days since 1/1/1970. There is no -e option to passwd, and -l for usermod will not perform the action described. There is no chguser command.
27. You need to specify a list of known hosts for SSH for certain hosts within your organization rather than each user needing to accept those keys individually. Which option within a server-wide SSH client configuration file enables this scenario?
A. KnownHosts
B. PerMachineKnownHosts
C. GlobalKnownHostsFile
D. ServerKnownHostsFile
C. The GlobalKnownHostsFile configuration option enables the specification of a server-wide known hosts file, thus preventing users from needing to accept host keys for the hosts specified therein.
28. Which option within /etc/security/limits.conf is used to control the number of times that a given account can log in simultaneously?
A. nlogins
B. loginmax
C. maxlogins
D. loginlimit
C. The maxlogins parameter is used to control the number of simultaneous logins for a given account.
29. Which file can be used to store a server-wide cache of hosts whose keys are known for ssh?
A. /etc/sshd_known_hosts
B. /etc/ssh_known_hosts
C. ~/.ssh/known_hosts
D. /root/ssh_known_hosts
B. The ssh_known_hosts file, typically kept in /etc/, is used for the purpose described. Note that on some systems, this file and other SSH-related configurations may be found in /etc/ssh/. The options that indicated ~ or within /root are incorrect because the question specified a server-wide list.
30. Within the following entry in /etc/shadow, to what does the number 15853 refer? mail:*:15553:0:99999:7:::
A. The UID of the mail user
B. The number of files owned by mail
C. The date of the last password change (since 1/1/1970)
D. The number of days until the account expires
C. The date of the last password change, as measured in days since January 1, 1970, is contained in the third field of a shadow entry. The expiration date would be the 8th field, as separated by colons.
31. Which of the following commands sets up a local port-forwarding session on local port 5150 to remote port 80 of www.example.com?
A. ssh -L 5150: www.example.com:80
B. ssh 5150: www.example.com
C. ssh -p 5150 www.example.com
D. ssh -e 5150 www.example.com:80
A. The format for local forwarding uses the - L option followed by the local port and then the remote host: port combination. This is typically followed by the user@host credential and destination information for the SSH connection itself.
32. Which option must be enabled in /etc/sshd_config on the destination server in order for X11 forwarding to work?
A. XForward yes
B. Xenable yes
C. X11Forwarding yes
D. Xconnection yes
C. The option is called x11Forwarding and it must be set to yes in order for the destination server to forward X-based windows to the local client computer. The other options shown are not valid.
33. Which of the following commands generates a GnuPG key pair?
A. gpg -gen-key
B. gpg -key
C. gpg -send-key
D. gpg -create-key
A. The -gen-key subcommand is used for the purpose described. The other options shown do not exist.
34. Signatures with gpg can be generated by using which option on the gpg command line?
A. -sign
B. -signature
C. -si
D. -dsign
A. The -sign option is used to sign files and documents with gpg. The other options shown are not valid for signatures.
35. Which option to ssh is used to set the port for the remote host?
A. -p
B. -P
C. -l
D. @
A. The -p option sets the port for login and is useful for scenarios where you cannot use the host:port syntax. There is no -P or @ option with ssh, and the -I option specifies the login name.
36. Which option to nmap sets the scan to use TCP SYN packets for finding open ports?
A. -ss
B. -sT
C. -sY
D. -type SYN
A. The -s option sets the type of scan and, when followed by an uppercase s, sets the option to SYN. The T option is a connect() scan. There is no Y or -type option for nmap.
37. Which of the following logs is used by the last command for detailing recent logins?
A. /var/log/last
B. /var/log/all.log
C. /var/log/wtmp
D. /var/log/logins
C. The wtmp file, stored in /var/log, is used to store recent login information and must be read with the last command due to its format. The other logs listed for this question are not default logs found on a Linux system.
38. Which option to ssh enables the use of a key for authentication?
A. -i
B. -k
C. -f
D. -key
A. The -i option for ssh is followed by the private key to use for authentication. Doing so implies that the public key is in the authorized_keys file on the remote host. The -k option disables sending of GSSAPI credentials, whereas -f is used to request backgrounding of ssh. There is no -key option.
39. In a scripting scenario, you need to prevent sudo from prompting for credentials or for any other reason. Which option to sudo is used to indicate this?
A. -n
B. -noprompt
C. -i
D. -q
A. The -n option facilitates the scenario described and will exit non-zero rather than prompting. The -i option sets the login name and is not valid for this scenario. The -q and the -noprompt options do not exist.
40. Which of the following commands generates an RSA key for use with ssh?
A. ssh -key rsa
B. ssh -gen-key rsa
C. ssh-keygen -t rsa
D. ssh-keygen rsa
C. The ssh-keygen command will be used for this purpose, and the -t option specifies the type of key to generate. There are no key-related generation options for the ssh command.
41. You need to disable a service found in /etc/inetd. conf. Which of the following is used as a comment character in that file?
A. -
B. #
C. /
D. %
B. Lines can be commented out of /etc/inetd.conf with a pound sign or hash mark (#). After making changes to /etc/inetd.conf, the service should be restarted.
42. Which of the following commands can be used to lock an account?
A. usermod -L
B. usermod -l
C. passwdlock
D. lockacct
A. The -L option to usermod can be used to lock an account. The lowercase version, -i, is used to change a username. The other commands do not exist.
43. Which file is used as the default storage for public keyrings for gpg?
A. publickeys.gpg
B. pubring.gpg
C. public.gpg
D. pubkeys.gpg
B. The pubring. gpg file, found in ~/.gnupg/, contains the public keyring.
44. Which file in ~/. gnupg/, if present, indicates that files have been migrated to gpg version 2.1 or later?
A. .gpg-v21
B. .gpg-updated
C. .gpg-v21-migrated
D. .gpg-files-v21
C. The .gpg-v2i-migrated file, when present, indicates that gpg version 2.1 or later is in use and that the files have been migrated for that version or a later one.
45. Which of the following commands searches a server for files with the setgid bit enabled?
A. find / -perm 4000
B. find ./ -perm setgid
C. grep setgid *
D. find / -perm 2000
D. The find command will be used for this purpose, and the - perm option is needed, specifically as the 2000 permission to indicate setgid. Note the use of / to indicate that the entire server will be searched. The grep command shown cannot be used for this purpose because it looks for the presence of the string ' setgid' within files located in the current directory only.
46. Which of the following commands creates links within /etc/rc. d/* for starting and stopping services on a Debian system?
A. createsym
B. startstop-service
C. update-rc.d
D. createconfig
C. The update-rc.d command creates symbolic links from a service file in /etc/init.d/ to the appropriate locations in /etc/rc.d/* for each runlevel. The other commands shown are not valid.
47. Which runlevel is typically used for single-user mode, as indicated in /etc/inittab?
A. 1
B. 2
C. 5
D. 6
A. Single-user mode is typically runlevel 1. In runlevel 1, no network services are started. Runlevel 2 has networking but typically not services. Runlevel 5 is full multiuser with networking, and runlevel 6 is reboot.
48. Which option to the su command is used to obtain the normal login environment?
A. -u
B. -u
C. -
D. -login
C. The - option is the typical option passed to su for login. There is no -u or -u option, and the -login option does not exist. There is a -login option with two dashes, but that is not what’s shown.
49. Which of the following commands shows network services or sockets that are currently listening along with sockets that are not listening?
A. netstat -a
B. netlink -a
C. sockets -f
D. opensock -l
A. The netstat command is used for this purpose, and the -a option displays all sockets, listening and nonlistening. Note that it’s frequently helpful to add the -n option, or combine them as in netstat -an, in order to prevent name lookup. Doing so can significantly improve the performance of the command.
50. Which of the following commands lists open files belonging to all processes except those owned by the user bind?
A. lsof -i
B. lsof -u bind
C. lsof -u ^bind
D. lsof | grep bind
C. This solution will require a way to filter out the bind user; therefore, options that grep for bind or specify bind as the user are incorrect. However, the isof command allows for negation with the caret (^) character. Therefore, listing all files except bind requires the syntax shown.
51. Which option to nmap will cause it to always perform name resolution?
A. -n
B. -R
C. -b
D. -a
B. The -R option requires an attempt at name resolution be performed. The -n option does the opposite; it disables name resolution. There is no -b or -a option.
52. Which wildcard can be used in /etc/hosts. aiiow to specify a match for a host whose name does not match its IP address?
A. *
B. ALL
C. PARANOID
D. NAMEMATCH
C. The PARANOID wildcard specifies that the hostname and IP must match. The ALL keyword is also a valid wildcard in TCPWrappers for use in both /etc/hosts.allow and /etc/hosts.deny.
53. Which of the following options within an OpenSSH server configuration is used to determine whether the root user can log in directly with an SSH client?
A. PermitRootLogin
B. AllowRoot
C. RootLogin
D. PermitDirectRootLogin
A. The PermitRootLogin directive, set to yes or no, determines whether the root user can log in directly. The other options shown are not valid.
54. Which of the following commands executes a port scan using TCP connect to the host 192.168.2.3?
A. portscan 192.168.2.3
B. nmap -sT 192.168.2.3
C. maphost 192.168.2.3
D. tcpscan -C 192.168.2.3
B. The nmap command will be used for this purpose, and the - sT option performs a TCP connect to the specified host or network. The other commands are not valid.
55. Which option to the ssh command is used for X11 application forwarding?
A. -X11
B. -A
C. -X
D. -F
C. The -X option enables X11 application forwarding through an SSH connection. The -A option is used for authentication agent forwarding, and -F indicates a per-user configuration file. There is no -X11 option.
56. Which option to gpg should be used in order to specify the destination for the encrypted file?
A. -dest
B. -output
C. -destination
D. -out
B. The -output option is used with -encrypt to send the output to a specified file. The other options shown are not valid for gpg.
57. Which command is used to add keys to the SSH agent?
A. ssh-keyadd
B. ssh-add
C. ssh-ed
D. ssh-cat
B. The ssh-add command adds keys to ssh-agent. The other commands shown are not valid.
58. Which option to the passwd command sets the maximum password age until the password needs to be changed?
A. -a
B. -x
C. -l
D. -r
B. The -x option sets the maximum password age until the password needs to be changed again. The -l option locks the account, and the other options do not exist.
59. Which option to the ulimit command enables setting of a limit on memory that can be locked?
A. -l
B. -x
C. -b
D. -t
A. The -l option sets the maximum amount of memory that can be locked. The -t option sets the maximum CPU time, and the - x and - b options do not exist.
60. Which of the following commands prints a list of existing users from the password file?
A. passwd -list
B. cat /etc/passwd | cut -d':' -f1
C. grep "USERS" /etc/passwd
D. lookup -user
B. The command shown to display the password file and pipe the output into cut will display the usernames from the password file, /etc/passwd. The /etc/shadow file would also produce the same output.
61. You are defining a service in /etc/xinetd.conf. Which option is used to configure the times that access to the service is allowed?
A. time_allowed
B. access_times
C. timed_access
D. access_when
B. The access_times configuration item sets the times in which access is allowed. The other configuration options shown are not valid.
62. What file extension is used for interprocess communication service units that are controlled by systemd?
A. .Socket
B. .ipc
C. .comm
D. .intercom
A. The . Socket file extension is used for interprocess communication, network sockets, and first-in, first-out (FIFO) queues controlled by systemd. For more information, see systemd.socket.
63. You are generating a host key for the SSH server with ssh- keygen and want to ensure that the key does not require a password when the SSH server starts. Which command-line option accomplishes this task?
A. -p
B. -P
C. -N
D. -d
C. The - N option provides the “new” passphrase, and when generating a key, it can be used to generate an empty password. The -p and -P options both work with passwords but would do so on an existing key. The -d option does not exist for ssh-keygen.
64. When working with the /etc/shadow password file, you see passwords beginning with $1$. What algorithm does $1$ indicate has been used for password storage?
A. MD5
B. Blowfish
C. RIN
D. PIK
A. The MD5 algorithm has been used if the password in /etc/shadow begins with $1$. Of the other options, shadowed passwords beginning with $2a$ or $2y$ would indicate the Blowfish algorithm. There is no RIN or PIK algorithm for shadow passwords.
65. Which option to gpg creates a detached signature?
A. -sig
B. -detach-sig
C. -det-sig
D. -sgn-det
B. The -detach-sig option creates a detached signature file so that the original file remains unchanged. Both the original file and detached signature file are needed in order to verify the signature. The other options do not exist.
66. Which of the following best describes the role of server host keys for SSH?
A. The server host key is used to connect to remote servers.
B. The server host key is used for encrypting SSL communications.
C. The server host key is used for client connections and provides a means by which the client can verify that the server has not changed.
D. The server host key provides secure DNS resolution.
C. The server host key provides a means by which clients can verify that the server host key has not changed.
67. When using a custom client configuration for SSH, which option specifies the key that will be used to connect to the host?
A. KeyFile
B. IdentityFile
C. Key
D. HostKey
B. The identityFile option specifies the key that will be used to connect to the host. The other options do not exist for client configurations in SSH.
68. Which of the following commands is used as a daemon process to manage private keys for GnuPG?
A. gpgpkd
B. gpg_pkd
C. gpg-agent
D. gpg-pkagent
C. The gpg-agent command is a daemon process to manage private keys. The gpg program and other GnuPG-related utilities use gpg- agent. The other options shown for this question are not valid.
69. You need to enable editing of certain files with root privileges but do not want to grant sudo access to an editor such as vim due to the possibility of a shell escaping. Which command can be used in place of vim to provide privileged editing of files?
A. suvim
B. nano
C. sudon
D. sudoedit
D. The sudoedit editor, part of the sudo package, can be used for the purpose described. Of the other commands, only nano is a real command, but it would also present the same possibility of shell escapes as vim would in this scenario. While there may be ways to prevent a shell escaping with both vim and nano, sudoedit is typically the preferred option.
70. Which option to the ssh command enables changing the login name for a given host?
A. -l
B. -u
C. -a
D. -m
A. The -l option changes the login name for a connection with ssh. Among the other options, only -a and -m exist and are not used for the purpose described.
71. Which option to the usermod command changes a username?
A. -l
B. -u
C. -a
D. -m
A. The -l option for usermod changes the username. It is worth noting that the user’s home directory and mail spool file do not change and would need to manually be changed following the usermod command. The other options are not used for the purpose described.
72. After specifying the key server, which option to gpg is used to specify the key to send to the key server?
A. key-name
B. keyname
C. send-keys
D. sendkey
C. The send-keys option followed by the name of the key sends the key to the key server specified by the key server option. This is a typical scenario for sending a locally generated public key to a public server for others to use. The other options do not exist.
73. Which of the following represents a group called admins within /etc/sudoers?
A. @admins
B. admins
C. -admins
D. %admins
D. The % is used to denote a group within /etc/sudoers and provides an excellent way to facilitate an administrative privileged group.
74. Which limits-related option is used to control the maximum file size that a user can create?
A. filesize
B. maxfile
C. fsmax
D. fsize
D. The fsize option is used within the limits. conf file to control the maximum size of a file that can be created by a user for whom the limit applies.
75. You are using an SSH server over a poor network connection but would like to maintain the connection in the event of keepalive messages being lost. Which client option can be set to set the number of keepalive messages that can be lost before the client will terminate the connection?
A. ServerTerminateCount
B. ServerAliveCountMax
C. ServerKeepAliveCount
D. ServerClientKeepAliveCount
B. The serverAliveCountMax option is used to set the number of keepalive messages that can be sent by the client but not responded to before the client will terminate the connection.
76. If the /etc/nologin file exists and is in use preventing users from logging in, which file can be used to provide a message to those users who are refused a login?
A. /etc/login.mesg
B. /etc/login.disabled
C. /etc/nologin
D. /etc/nologin.message
C. The /etc/nologin file prevents login when present and can also contain a message that is displayed to users when attempting to login.
77. Which option to ssh-add specifies the lifetime that a key is held in the agent?
A. -t
B. -a
C. -l
D. -c
A. The -t option specifies the lifetime for the key and is usually given in seconds but can also be given in minutes, hours, days, and weeks with qualifiers. The other options shown do not fulfill the scenario described.
78. Which option for an SSH connection sets up a remote forwarding scenario?
A. -R
B. -r
C. -e
D. -d
A. The -R option sets up a remote forward so that remote users can also connect to the tunnel being set up. The other options are not valid for the remote forwarding scenario.
79. Which option to chage sets the number of days that a user will be warned before they need to change their password?
A. -w
B. -w
C. -t
D. -a
B. The -w option sets the number of days to warn a user before their password expires. The other options do not exist for chage.
80. Another administrator made a change on the system that resulted in the /etc/shadow file becoming corrupted. Which of the following can be used to recover quickly?
A. The /etc/shadow.bak file
B. The /etc/shadow- file
C. The latest backup in /var/backups/
D. Single-user mode
B. The /etc/shadow- file contains the state of the shadow file before the last change and would likely be the first place to begin recovery. The next would likely be a backup, though /var/backups/ does not hold backups unless manually created.
81. When examining the documentation for a service, you notice that it can use libwrap. What functionality does libwrap enable?
A. Start/stop from remote
B. TCP wrappers
C. DNS resolution
D. Shadow passwords
B. Integration with the libwrap library is an indicator that a given service or daemon will be able to utilize TCP wrappers for access control.
82. Which option within /etc/sudoers enables the use of an alias for a group of users?
A. User_Alias
B. User_Group
C. User_List
D. User_Spec
A. The User_Alias option enables specification of a group of users for use elsewhere within the sudoers file.
83. You are using nmap to scan a host for open ports. However, the server is blocking ICMP echo requests. Which option to nmap can you set in order to continue the scan?
A. -P0
B. -no-ping
C. -s0
D. -ping-0
A. Setting -P0 will allow no ping requests to precede the scan and is useful for the scenario described. There is an -s option, but it is not used for this purpose. The other options are not valid.
84. Which option within a server-wide SSH client configuration specifies the name and location of the known hosts file to use?
A. KnownHosts
B. UserKnownHosts
C. UserKnownHostsFile
D. UserKnownHostsFilePath
C. The userKnownHostsFile configuration option enables specification of the location and filename for the known hosts file for users.
85. You need to generate a host key for SSH using ssh- keygen that has been generated with DSA rather than RSA. Which option and argument to that option will create a DSA key?
A. -k dsa
B. -a DSA
C. -t dsa
D. -h dsa
C. The -t argument sets the type of key to generate, and dsa creates a key with the dsa algorithm. Other types includes rsa and ecdsa. The files are normally placed in /etc/ssh and assigned names such as ssh_host_[algorithm]_key and ssh_host_[algorithm]_key.pub, where [algorithm] is one of rsa, dsa, ecdsa, or ed25519.
86. The total number of users logged in can be found with which argument to the who command?
A. -t
B. -e
C. -q
D. -l
C. The -q option prints the users who are logged in along with a count of those users. The -l option prints the login processes, the -t option prints the last system time change, and the -e option does not exist.
87. Which option to the passwd command unlocks an account?
A. -t
B. -u
C. -r
D. -l
B. The -u option unlocks an account while setting the password. The -l option locks the account, and the -t and -r options do not exist for the passwd command.
88. Which option for user limits sets the maximum number of logins that a user can have on the system?
A. maxsyslogins
B. maxuserlogins
C. maxlogins
D. kennyloggins
C. The maxlogins option is used to control the number of times that a user can log in. The only other limit-related option shown is maxsyslogins, which sets the maximum number of logins for the entire system.