GSEC Practice Exam: Linux Security Domain

Correct Answer: A

Explanation: Option A is correct because 'lsmod' lists all currently loaded kernel modules, allowing you to identify any unauthorized modules. Option B, 'df -h', displays disk space usage and is not relevant for kernel modules. Option C, 'iptables -L', lists firewall rules, which is unrelated to kernel modules. Option D, 'top', shows running processes and system resource usage, not kernel modules.

Correct Answer: B

Explanation: Option B is correct because 'systemctl list-units --type=service' lists all active services managed by systemd, which is the default service manager on most modern Linux distributions. Option A 'ps aux' lists all running processes but does not specifically show services. Option C 'netstat -tuln' displays network connections, not services. Option D 'top' shows active processes and their resource usage, not a list of services.

Correct Answer: C

Explanation: The 'dd' command is used to create a bit-by-bit copy of a disk, which is essential for forensic analysis. 'cp' and 'rsync' are used for file copying, not suitable for creating disk images. 'tar' is for archiving files, not for creating disk images. Thus, 'dd' is the correct choice for creating a forensic disk image.

Correct Answer: C

Explanation: Option C is correct because inotify is a Linux kernel subsystem that monitors file system events, allowing you to set up alerts for file changes. Option A, iptables, is used for network packet filtering, not file monitoring. Option B, SELinux, is used for access control policies, not specifically for monitoring file changes. Option D, cron, is used for scheduling tasks, not monitoring files.

Correct Answer: C

Explanation: Option C is correct because disabling root login over SSH and using sudo for administrative tasks enhances security by enforcing the principle of least privilege and reducing the risk of brute force attacks. Option A is impractical as it limits remote administration capabilities. Option B, while improving password security, still allows direct root access which is a security risk. Option D restricts access but still permits root login, which is not recommended.

Correct Answer: D

Explanation: Restricting SSH access to specific IP addresses enhances security by limiting who can attempt to connect to the server, reducing attack surface without impacting usability for authorized users. Disabling SSH access entirely is impractical. Allowing root login is insecure. Using a strong password policy and disabling password authentication is contradictory; disabling passwords implies using key-based authentication.

Correct Answer: A

Explanation: Option A is correct because 'tail -f /var/log/auth.log | grep 'Failed password'' will continuously monitor the authentication log for failed login attempts, which is indicative of a brute force attack. Option B shows the SSH configuration, which is useful for configuration issues but not for monitoring real-time attacks. Option C lists processes related to SSH, but does not provide information about login attempts. Option D shows active network connections and listening ports, which does not directly indicate a brute force attack.

Correct Answer: C

Explanation: The 'iptables' command is used to configure the Linux kernel firewall, allowing the administrator to set rules for packet filtering. Option A, 'firewalld-cmd', is used with the firewalld service, not iptables. Option B, 'ufw', is a simpler interface for managing iptables, but not the direct command for iptables itself. Option D, 'selinux-config', is related to SELinux configuration, not firewall settings.

Correct Answer: C

Explanation: The '/etc/sudoers' file controls user permissions for executing commands with elevated privileges. '/etc/shadow' manages password hashes, '/etc/passwd' contains user account information, and '/etc/hosts' maps hostnames to IP addresses, none of which manage command execution permissions.

Correct Answer: C

Explanation: The 'AllowUsers admin' directive restricts SSH access to only the specified user, enhancing security by limiting access. 'PermitRootLogin yes' allows root login, which is insecure. 'PasswordAuthentication yes' allows password-based logins, which are less secure than key-based. 'PermitEmptyPasswords yes' allows empty passwords, which is highly insecure.