CompTIA Linux+ Practice Questions: Security Domain

Published: September 21, 2025 | 20 min read

Test your CompTIA Linux+ knowledge with 10 practice questions from the Security domain. Includes detailed explanations and answers.

CompTIA Linux+ Practice Questions

Master the Security Domain

Test your knowledge in the Security domain with these 10 practice questions. Each question is designed to help you prepare for the CompTIA Linux+ certification exam with detailed explanations to reinforce your learning.

Question 1

Which of the following commands would you use to change the password expiration settings for a user on an Ubuntu server?

A) passwd -e username

B) chage -E username

C) usermod -e username

D) chpasswd -e username

Show Answer & Explanation

Correct Answer: B

Explanation: The 'chage -E username' command is used to set the expiration date for a user's password. Option A 'passwd -e username' forces the user to change their password at the next login. Option C 'usermod -e username' sets an expiration date for the user account, not the password. Option D 'chpasswd -e username' is not a valid command for this purpose.

Question 2

Which of the following is a common method for securing a Linux server against brute-force SSH login attempts?

A) Using a firewall to block all incoming traffic.

B) Installing and configuring fail2ban.

C) Disabling SSH service completely.

D) Reducing the SSH session timeout.

Show Answer & Explanation

Correct Answer: B

Explanation: Fail2ban is a tool that monitors log files for failed login attempts and can block IP addresses that show malicious signs, such as too many password failures. Blocking all traffic (A) is impractical, disabling SSH (C) prevents legitimate access, and reducing session timeout (D) does not prevent brute-force attempts.

Question 3

A Linux server has been compromised. Which log file would you check first to identify unauthorized access attempts?

A) /var/log/syslog

B) /var/log/auth.log

C) /var/log/dmesg

D) /var/log/kern.log

Show Answer & Explanation

Correct Answer: B

Explanation: /var/log/auth.log contains authentication-related messages and is the first place to look for unauthorized access attempts. /var/log/syslog contains general system logs. /var/log/dmesg contains kernel ring buffer messages. /var/log/kern.log contains kernel-related logs.

Question 4

In a containerized environment, which practice enhances security by restricting container permissions?

A) Running containers as root

B) Using privileged containers

C) Applying SELinux policies

D) Disabling AppArmor

Show Answer & Explanation

Correct Answer: C

Explanation: Applying SELinux policies helps restrict container permissions and enhances security. Running containers as root and using privileged containers increase security risks. Disabling AppArmor reduces security by removing an additional layer of protection.

Question 5

A security audit requires you to verify that no unauthorized users have been added to the 'sudo' group on a Linux server. Which command would you use to list the members of the 'sudo' group?

A) getent group sudo

B) cat /etc/sudoers

C) ls -l /etc/sudoers.d/

D) sudo -l

Show Answer & Explanation

Correct Answer: A

Explanation: The 'getent group sudo' command retrieves group information from the /etc/group file, showing the members of the 'sudo' group. 'cat /etc/sudoers' shows the sudoers configuration, 'ls -l /etc/sudoers.d/' lists custom sudoers files, and 'sudo -l' shows the current user's sudo privileges.

Question 6

You are tasked with securing SSH access on a Linux server. Which of the following actions should you take to enhance security?

A) Disable password authentication and use key-based authentication.

B) Enable root login for easier access.

C) Use the default SSH port 22 to avoid confusion.

D) Allow password authentication but disable key-based authentication.

Show Answer & Explanation

Correct Answer: A

Explanation: Disabling password authentication and using key-based authentication provides a more secure method of accessing the server, as it eliminates the risk of brute-force attacks on passwords. Enabling root login (B) is insecure, using the default port (C) is less secure than using a non-standard port, and allowing password authentication (D) is less secure than key-based authentication.

Question 7

Which file should you modify to change the default umask for all users on a Ubuntu system?

A) /etc/profile

B) /etc/passwd

C) /etc/bashrc

D) /etc/shadow

Show Answer & Explanation

Correct Answer: A

Explanation: '/etc/profile' is the file where you can set the default umask for all users. '/etc/passwd' and '/etc/shadow' are related to user information and passwords, while '/etc/bashrc' is used for bash shell configurations.

Question 8

In a containerized environment, which of the following practices enhances security?

A) Running containers with root privileges

B) Using the latest version of the container image

C) Keeping containers running indefinitely

D) Limiting container capabilities

Show Answer & Explanation

Correct Answer: D

Explanation: Limiting container capabilities is a security best practice to minimize the potential impact of a compromised container. Option A, running containers with root privileges, is insecure as it increases the risk of privilege escalation. Option B, using the latest version, is good for security but not as effective as limiting capabilities. Option C, keeping containers running indefinitely, does not directly enhance security.

Question 9

You are tasked with ensuring that all user passwords on an Ubuntu server expire every 90 days. Which file should you modify?

A) /etc/passwd

B) /etc/shadow

C) /etc/login.defs

D) /etc/security/limits.conf

Show Answer & Explanation

Correct Answer: C

Explanation: The '/etc/login.defs' file contains settings for password expiration policies. '/etc/passwd' contains user account information but not password policies. '/etc/shadow' contains password hashes and expiration dates but is not used for setting global policies. '/etc/security/limits.conf' is for resource limits, not password policies.

Question 10

A user reports that they cannot access a service running on port 8080 on a SUSE Linux server. Which command would you use to check if the firewall is blocking this port?

A) firewall-cmd --list-all

B) iptables -L -n

C) ufw status

D) netstat -tuln

Show Answer & Explanation

Correct Answer: B

Explanation: The command 'iptables -L -n' lists all firewall rules and is useful for checking if a specific port is blocked. 'firewall-cmd --list-all' is used with firewalld, not iptables. 'ufw status' is used on systems with UFW, not SUSE. 'netstat -tuln' shows listening ports but does not show firewall rules.

Ready to Accelerate Your CompTIA Linux+ Preparation?

Join thousands of professionals who are advancing their careers through expert certification preparation with FlashGenius.

✅ Unlimited practice questions across all CompTIA Linux+ domains
✅ Full-length exam simulations with real-time scoring
✅ AI-powered performance tracking and weak area identification
✅ Personalized study plans with adaptive learning
✅ Mobile-friendly platform for studying anywhere, anytime
✅ Expert explanations and study resources

Start Free Practice Now

Already have an account? Sign in here

About CompTIA Linux+ Certification

The CompTIA Linux+ certification validates your expertise in security and other critical domains. Our comprehensive practice questions are carefully crafted to mirror the actual exam experience and help you identify knowledge gaps before test day.