IT Security and Linux System Administration Quiz

Security and Networking Concepts

• Exam 303-300: LPIC-3 Security

File Systems and Permissions

• File ownership in Linux systems restricts access to files only to their owner
• chown command is used to change the ownership of a file
• chmod command is used to set the permissions of a file
• Extended attributes in Linux store additional metadata about a file
• getfacl command is used to view the access control list of a file
• setfacl command is used to set the access control list of a file

Network Security

• DNSSEC (Domain Name System Security Extensions) is a security protocol for DNS
• NSEC3 is a type of DNS record used in DNSSEC
• RRSIG is a type of DNS record used in DNSSEC
• TSIG is used to sign DNS messages for secure communication
• IP sets group together IP addresses that can be referenced by netfilter rules

Cryptography and Certification

• Asymmetric key: a key used for encryption and decryption that is generated in a pair
• Symmetric key: a key used for encryption and decryption that is the same
• Certificate Authority (CA) issues and signs X.509 certificates
• Trust anchor: a root certificate that is trusted by a particular CA
• TLSA record in DANE publishes X.509 certificate and certificate authority information in DNS

Linux Security

• Linux Audit system detects intrusions and system changes
• ausearch command is used to search and filter the audit log
• auditd is the Linux Audit system's daemon
• SELinux (Security-Enhanced Linux) is a Mandatory Access Control (MAC) system

Network Attacks and Defenses

• Buffer overflow: a type of software vulnerability
• Man-in-the-middle attack: an attack that intercepts communications between two parties
• DoS (Denial of Service) attack: an attack that floods a network or server with traffic to make it unavailable
• Trojan: a type of malware that disguises itself as legitimate software
• Rogue access point: an unauthorized access point that is set up to look like a legitimate one

Firewalls and Networking

• iptables command is used to configure the Linux firewall
• nmap is a network exploration and security auditing tool
• OpenVPN is a virtual private network (VPN) solution

Other Security Concepts

• Privilege escalation: an attack that exploits a vulnerability to gain elevated privileges
• Honeypot: a network security tool designed to lure attackers into a trap
• AIDE (Advanced Intrusion Detection Environment) is a file integrity checker and incident response tool
• rkhunter is a tool to detect rootkits and other security threats### Security Fundamentals
• Host intrusion detection (HID) monitors a single computer or server for potential security threats.
• HID can detect unauthorized access attempts, but does not provide automatic removal of detected threats.
• Cryptography is the art of sending secret messages.

File Permissions and Access Control

• SELinux permissions are verified before standard Linux permissions.
• The chown command is used to set the owner and group of a file in Linux.
• Access control lists (ACLs) in Linux specify fine-grained permissions for users and groups.

Network Security

• OCSP stapling is a mechanism that allows a server to provide proof of the revocation status of its own SSL/TLS certificate.
• LUKS (Linux Unified Key Setup) is a disk encryption system.
• cryptsetup is used to set up and configure LUKS devices.
• getfattr displays extended attributes of a file or directory.

Certificates and Authentication

• X.509 certificates are digital documents that verify the identity of a website, person, device, or company.
• A Certificate Revocation List (CRL) is a list of X.509 certificates that have been revoked by a particular CA.
• DNSSEC (Domain Name System Security Extensions) is a set of extensions to DNS that provide security by verifying the authenticity of DNS data.
• TSIG (Transaction Signature) authenticates name servers in order to perform secured zone transfers.
• eCryptfs is a stacked Linux filesystem that provides encryption and access control for directories.

System Security

• chage is used to change the password expiry information for a user.
• snort-stat displays statistics from the running Snort process.
• chkrootkit is a tool that checks for rootkits on a Linux system.
• AppArmor and SELinux are both mandatory access control systems, but they have different implementation and configuration approaches.
• aide is a tool that detects intrusions and system changes.

DNS Security

• DNSSEC-signed zones use a key signing key to sign the zone signing key of the zone.
• The DNSKEY record in DNSSEC is used to sign a DNS zone.
• DNS over TLS and DNS over HTTPS provide secure communication between DNS clients and servers.
• DANE (DNS-based Authentication of Named Entities) is used to secure HTTPS connections.

Other Security Concepts

• Phishing is a type of social engineering attack that exploits human psychology to gain access to sensitive information.
• Social engineering is a type of attack that exploits human psychology to gain access to sensitive information.
• Rootkits are a type of malware that disguises itself as legitimate software.
• openvas-nvt-sync is a command that updates NVTs (Network Vulnerability Tests) from the OpenVAS NVT feed.
• ipa-server-install is a command that installs and configures a new FreeIPA server, including all sub-components, and creates a new FreeIPA domain.

Security and Networking Concepts

• Exam 303-300: LPIC-3 Security

File Systems and Permissions

• File ownership in Linux systems restricts access to files only to their owner
• chown command is used to change the ownership of a file
• chmod command is used to set the permissions of a file
• Extended attributes in Linux store additional metadata about a file
• getfacl command is used to view the access control list of a file
• setfacl command is used to set the access control list of a file

Network Security

• DNSSEC (Domain Name System Security Extensions) is a security protocol for DNS
• NSEC3 is a type of DNS record used in DNSSEC
• RRSIG is a type of DNS record used in DNSSEC
• TSIG is used to sign DNS messages for secure communication
• IP sets group together IP addresses that can be referenced by netfilter rules

Cryptography and Certification

• Asymmetric key: a key used for encryption and decryption that is generated in a pair
• Symmetric key: a key used for encryption and decryption that is the same
• Certificate Authority (CA) issues and signs X.509 certificates
• Trust anchor: a root certificate that is trusted by a particular CA
• TLSA record in DANE publishes X.509 certificate and certificate authority information in DNS

Linux Security

• Linux Audit system detects intrusions and system changes
• ausearch command is used to search and filter the audit log
• auditd is the Linux Audit system's daemon
• SELinux (Security-Enhanced Linux) is a Mandatory Access Control (MAC) system

Network Attacks and Defenses

• Buffer overflow: a type of software vulnerability
• Man-in-the-middle attack: an attack that intercepts communications between two parties
• DoS (Denial of Service) attack: an attack that floods a network or server with traffic to make it unavailable
• Trojan: a type of malware that disguises itself as legitimate software
• Rogue access point: an unauthorized access point that is set up to look like a legitimate one

Firewalls and Networking

• iptables command is used to configure the Linux firewall
• nmap is a network exploration and security auditing tool
• OpenVPN is a virtual private network (VPN) solution

Other Security Concepts

• Privilege escalation: an attack that exploits a vulnerability to gain elevated privileges
• Honeypot: a network security tool designed to lure attackers into a trap
• AIDE (Advanced Intrusion Detection Environment) is a file integrity checker and incident response tool
• rkhunter is a tool to detect rootkits and other security threats### Security Fundamentals
• Host intrusion detection (HID) monitors a single computer or server for potential security threats.
• HID can detect unauthorized access attempts, but does not provide automatic removal of detected threats.
• Cryptography is the art of sending secret messages.

File Permissions and Access Control

• SELinux permissions are verified before standard Linux permissions.
• The chown command is used to set the owner and group of a file in Linux.
• Access control lists (ACLs) in Linux specify fine-grained permissions for users and groups.

Network Security

• OCSP stapling is a mechanism that allows a server to provide proof of the revocation status of its own SSL/TLS certificate.
• LUKS (Linux Unified Key Setup) is a disk encryption system.
• cryptsetup is used to set up and configure LUKS devices.
• getfattr displays extended attributes of a file or directory.

Certificates and Authentication

• X.509 certificates are digital documents that verify the identity of a website, person, device, or company.
• A Certificate Revocation List (CRL) is a list of X.509 certificates that have been revoked by a particular CA.
• DNSSEC (Domain Name System Security Extensions) is a set of extensions to DNS that provide security by verifying the authenticity of DNS data.
• TSIG (Transaction Signature) authenticates name servers in order to perform secured zone transfers.
• eCryptfs is a stacked Linux filesystem that provides encryption and access control for directories.

System Security

• chage is used to change the password expiry information for a user.
• snort-stat displays statistics from the running Snort process.
• chkrootkit is a tool that checks for rootkits on a Linux system.
• AppArmor and SELinux are both mandatory access control systems, but they have different implementation and configuration approaches.
• aide is a tool that detects intrusions and system changes.

DNS Security

• DNSSEC-signed zones use a key signing key to sign the zone signing key of the zone.
• The DNSKEY record in DNSSEC is used to sign a DNS zone.
• DNS over TLS and DNS over HTTPS provide secure communication between DNS clients and servers.
• DANE (DNS-based Authentication of Named Entities) is used to secure HTTPS connections.

Other Security Concepts

• Phishing is a type of social engineering attack that exploits human psychology to gain access to sensitive information.
• Social engineering is a type of attack that exploits human psychology to gain access to sensitive information.
• Rootkits are a type of malware that disguises itself as legitimate software.
• openvas-nvt-sync is a command that updates NVTs (Network Vulnerability Tests) from the OpenVAS NVT feed.
• ipa-server-install is a command that installs and configures a new FreeIPA server, including all sub-components, and creates a new FreeIPA domain.