{ "While hardening a system, an administrator runs a port scan with Nmap, which returned the following output: Which of the following is the best way to address this security issue?" }

      
        { "# nmap -sS 192.168.10.25\nStarting Nmap 7.92 ( https://nmap.org )\nNmap scan report for 192.168.10.25\nHost is up (0.00042s latency).\nNot shown: 997 closed ports\nPORT   STATE SERVICE\n22/tcp open  ssh\n23/tcp open  telnet\n80/tcp open  http" }

A{ "Configuring a firewall to block traffic on port 23 on the server" }
B{ "Changing the systems administrator’s password to prevent unauthorized access" }
C{ "Closing port 80 on the network switch to block traffic" }
D{ "Disabling and removing the Telnet service on the server" }

Answer: D

{ "Port 23/tcp indicates Telnet, which is insecure because it transmits data in plaintext. The best hardening approach is to disable and remove the Telnet service entirely, eliminating the vulnerability rather than just blocking it at the firewall. Secure alternatives like SSH should be used instead." }

{ "Which of the following cryptographic functions ensures a hard drive is encrypted when not in use?" }

A{ "GPG" }
B{ "LUKS" }
C{ "PKI certificates" }
D{ "OpenSSL" }

Answer: B

{ "LUKS (Linux Unified Key Setup) provides full-disk encryption, ensuring that the data on a hard drive is protected and unreadable when the system is powered off or the drive is not in use." }

{ "Which of the following most accurately describes a webhook?" }

A{ "An authentication method for web-server communication" }
B{ "An SNMP-based API for network device monitoring" }
C{ "A means to transmit sensitive information between systems" }
D{ "An HTTP-based callback function" }

Answer: D

{ "A webhook is an HTTP-based callback that allows one system to send real-time data or notifications to another system when an event occurs." }

{ "An administrator receives reports that a web service is not responding. The administrator reviews the following outputs: Which of the following is the reason the web service is not responding?" }

A{ "The private key needs to be renamed from server.crt to server.key so the service can find it." }
B{ "The private key does not match the public key, and both keys should be replaced." }
C{ "The private key is not in the correct location and needs to be moved to the correct directory." }
D{ "The private key has the incorrect permissions and should be changed to 0755 for the service." }

Answer: C

{ "The error log shows “cannot load certificate key /etc/pki/nginx/private/server.key”, but the listing reveals that server.key is located in /etc/pki/nginx/ rather than the expected /etc/pki/nginx/private/ directory. Since the file exists but not where Nginx is configured to look, moving it to the correct directory resolves the issue." }

{ "A Linux administrator needs to securely erase the contents of a hard disk. Which of the following commands is the best for this task?" }

A{ "sudo rm -rf /dev/sda1" }
B{ "sudo shred /dev/sda1" }
C{ "sudo parted rm /dev/sda1" }
D{ "sudo dd if=/dev/null of=/dev/sda1" }

Answer: B

{ "The shred command securely erases data by overwriting the specified device or file multiple times, making recovery nearly impossible. This is the best option for securely erasing a hard disk." }

{ "Which of the following utilities supports the automation of security compliance and vulnerability management?" }

A{ "SELinux" }
B{ "Nmap" }
C{ "AIDE" }
D{ "OpenSCAP" }

Answer: D

{ "OpenSCAP is a framework that automates security compliance checking and vulnerability management by using standardized security content (SCAP). It helps administrators enforce policies and detect vulnerabilities." }

{ "Which of the following describes the method of consolidating system events to a single location?" }

A{ "Log aggregation" }
B{ "Health checks" }
C{ "Webhooks" }
D{ "Threshold monitoring" }

Answer: A

{ "Log aggregation is the process of collecting and consolidating logs from multiple sources into a single location, making it easier to analyze and manage system events." }

{ "Which of the following best describes journald?" }

A{ "A system service that collects and stores logging data" }
B{ "A feature that creates crash dumps in case of kernel failure" }
C{ "A service responsible for keeping the filesystem journal" }
D{ "A service responsible for writing audit records to a disk" }

Answer: A

{ "journald is part of systemd and is responsible for collecting, storing, and managing log data from various sources such as the kernel, services, and applications." }

{ "Which of the following is a protocol for accessing distributed directory services containing a hierarchy of users, groups, machines, and organization units?" }

A{ "SMB" }
B{ "TLS" }
C{ "LDAP" }
D{ "KRB-5" }

Answer: C

{ "LDAP (Lightweight Directory Access Protocol) is specifically designed for accessing and maintaining distributed directory services that organize users, groups, computers, and organizational units in a hierarchical structure." }

{ "A systems administrator manages multiple Linux servers and needs to set up a reliable and secure way to handle the complexity of managing event records on the OS and application levels. Which of the following should the administrator do?" }

A{ "Create an automated process to retrieve logs from the server by demand." }
B{ "Implement a centralized log aggregation solution." }
C{ "Configure daily automatic backups of logs to remote storage." }
D{ "Deploy log rotation procedures to manage the records." }

Answer: B

{ "A centralized log aggregation solution (such as Elasticsearch, Graylog, or Splunk) provides reliable and secure management of logs across multiple servers. It consolidates OS and application logs, simplifies analysis, and improves monitoring and security compared to on- demand retrieval, backups, or simple log rotation." }

{ "Which of the following passwords is the most complex?" }

A{ "H3sa1dt01d" }
B{ "he$@ID$heTold" }
C{ "H3s@1dSh3t0|d" }
D{ "HeSaidShetold" }

Answer: C

{ "This password is the most complex because it uses uppercase and lowercase letters, numbers, and multiple special characters, making it significantly harder to guess or brute-force compared to the others." }

{ "A systems administrator is deploying a new secure web server but is having issues starting it. The administrator reviews the following outputs: Which of the following commands fixes this issue while following security best practices?" }

A{ "setsebool -P http_port_t 1234" }
B{ "setenforce 0" }
C{ "semarage -a -t http_port_t -p tcp 1234" }
D{ "systemctl unmask httpd" }

Answer: C

{ "The web server is running with SELinux in enforcing mode, and Apache is denied permission to bind to TCP port 1234 because that port is not labeled for HTTP services. Adding port 1234 to the http_port_t SELinux type allows Apache to bind to the port while keeping SELinux enforcing, which follows security best practices." }

{ "Which of the following utilities can securely delete a Linux directory from a filesystem and ensure it cannot be recovered?" }

A{ "dd" }
B{ "shred" }
C{ "unlink" }
D{ "rm" }

Answer: B

{ "This utility securely overwrites data on disk to prevent recovery, making it suitable for securely deleting data from a filesystem in accordance with security best practices." }

{ "Which of the following can be implemented with PAM to detect and block dictionary attacks?" }

A{ "pam_tallу2" }
B{ "pam_limits" }
C{ "pam_unix" }
D{ "pam_idap" }

Answer: A

{ "This PAM module tracks failed authentication attempts and can automatically lock accounts after a defined threshold is exceeded, effectively detecting and blocking dictionary and brute-force attacks." }

{ "Which of the following describes the primary purpose of monitoring thresholds?" }

A{ "To generate alerts if limits are exceeded" }
B{ "To calculate the availability of a service" }
C{ "To perform health checks on devices" }
D{ "To restart a service automatically" }

Answer: A

{ "Monitoring thresholds define acceptable limits for metrics and are primarily used to trigger alerts when those limits are exceeded, allowing administrators to respond before issues escalate." }

{ "Which of the following is the term used to describe reviewing processes and file operations on a Linux system?" }

A{ "Auditing" }
B{ "Tuning" }
C{ "Journaling" }
D{ "Logging" }

Answer: A

{ "Auditing refers to the systematic review and tracking of processes and file operations on a Linux system to ensure accountability, security, and compliance." }

{ "Which of the following references is recognized and used for guiding the configuration of operating systems and applications to ensure compliance with security best practices on Linux servers?" }

A{ "GDPR" }
B{ "ISO 27001" }
C{ "CIS Benchmarks" }
D{ "CVE" }

Answer: C

{ "CIS Benchmarks provide detailed, consensus-based configuration guidelines specifically designed to harden operating systems and applications and ensure compliance with recognized security best practices." }

{ "A systems administrator is helping to secure a new web application. During the tests, the administrator obtains the following output to validate the application: Which of the following explains the validation results?" }

      
        { "$ openssl s_client -connect app.internal.example.com:443\ndepth=0 CN = app.internal.example.com\nverify error:num=20:unable to get local issuer certificate\nverify return:1\n---\nSSL handshake has read 1509 bytes and written 393 bytes\nVerify return code: 21 (unable to verify the first certificate)" }

A{ "The certificate was not signed by trusted authority, which was forcefully ignored during the tests." }
B{ "The certificate was only issued for one month, is already expired, and needs to be replaced" }
C{ "The certificate is a wildcard certificate that is highly insecure and should never be used." }
D{ "The certificate uses an outdated algorithm and should be replaced with a more secure one." }

Answer: A

{ "The validation output indicates that the certificate chain could not be verified because the local system does not trust the issuing certificate authority, and the connection proceeded anyway by ignoring the verification failure during testing." }

{ "The security manager at a company notifies a systems administrator of open vulnerabilities on the Linux system. The administrator receives the following information while logged in to the server: Which of the following is the most likely security concern?" }

      
        { "# dnf history list | head -5\nID     | Command line         | Date and time    | Action(s)      | Altered\n---------------------------------------------------------------------------\n    42 | update               | 2024-08-19 03:14 | Update         |    118\n    41 | install httpd        | 2024-07-02 11:48 | Install        |      6\n# date\nWed Sep 17 09:22:41 UTC 2025" }

A{ "The server has not been updated in a year and should be patched." }
B{ "The system has httpd installed and needs to be removed." }
C{ "The system is configured to use UTC time and should be set to EDT." }
D{ "The system has SELinux set to enforcing and needs to be disabled." }

Answer: A

{ "The package management history shows that the last system update occurred over a year ago, which strongly indicates that security patches and vulnerability fixes have not been applied, leaving the system exposed to known vulnerabilities." }

{ "Users are having issues running applications. A systems administrator thinks it is an SELinux issue. Which of the following commands should the administrator use to determine whether SELinux is enabled on the system?" }

A{ "getenforce" }
B{ "ls -lZ /" }
C{ "semanage -l" }
D{ "getsebool -l" }

Answer: A

{ "This command reports the current SELinux mode, allowing the administrator to quickly determine whether SELinux is enabled and enforcing, permissive, or disabled." }

{ "A systems administrator is having issues installing packages in a Linux system. The administrator receives the following outputs: Which of the following is the best command to fix this issue?" }

A{ "dnf reinstall ca-certificates" }
B{ "touch /etc/pki/tls/certs/ca-bundle.crt" }
C{ "restorecon -R /etc/pki/ca-trust/extracted/pem" }
D{ "setenforce 0" }

Answer: C

{ "The CA bundle path is a symlink to a file under /etc/pki/ca-trust/extracted/pem, and update-ca- trust cannot create that generated bundle while SELinux is enforcing. Restoring the default SELinux contexts on that directory allows the bundle file to be created and fixes the certificate verification failures during package installs." }

{ "An administrator wants to see all logs for the app.service systemd process. Which of the following commands should the administrator use to complete this task?" }

A{ "cat /var/log/messages" }
B{ "systemctl status app.service" }
C{ "systemd-analyze unit-files app.service" }
D{ "journalctl -u app.service" }

Answer: D

{ "The journalctl command queries the systemd journal, and using -u app.service filters the output to logs generated by that specific systemd unit." }

{ "The development team asks a Linux administrator to help diagnose a connectivity issue that is occurring with a newly developed software. The Linux administrator reviews the following output: Which of the following actions is a best way to resolve the issue?" }

      
        { "$ wget https://api.newapp.internal/health\n--2025-09-12 10:41:02--  https://api.newapp.internal/health\nResolving api.newapp.internal... 10.40.12.7\nConnecting to api.newapp.internal|10.40.12.7|:443... connected.\nERROR: cannot verify api.newapp.internal's certificate, issued by\n  \"CN=Internal Issuing CA\":\n  Unable to locally verify the issuer's authority.\nTo connect to api.newapp.internal insecurely, use `--no-check-certificate'." }

A{ "Verify the remote certificate is trustworthy, and add it to the local trusted certificates repository." }
B{ "Replace the remote certificate with a now self-signed CA and application certificate." }
C{ "Replace the expired CA certificate to permanently resolve the problem." }
D{ "Add option no check certificate to wget command to permanently resolve the problem." }

Answer: A

{ "The error shows the certificate is not trusted because the issuer is unknown to the local system. The best fix is to verify that the remote certificate and issuing CA are legitimate, then add the trusted CA certificate to the system’s certificate trust store." }

{ "Which of the following can reduce the attack surface area in relation to Linux hardening?" }

A{ "Customizing the log-in banner" }
B{ "Reducing the number of directories created" }
C{ "Extending the SSH startup timeout period" }
D{ "Enforcing password strength and complexity" }

Answer: D

{ "Reducing the attack surface area in Linux hardening refers to limiting possible points of unauthorized access. According to the CompTIA Linux+ Official Study Guide (Exam XK0-006), enforcing strong password policies is a critical aspect of security hardening. This practice ensures that user accounts are protected by passwords that are difficult to guess or crack, thus minimizing the risk of successful brute-force attacks. Implementing password complexity requirements (such as minimum length, use of uppercase, lowercase, numbers, and special characters) directly addresses one of the primary vectors for unauthorized access." }

{ "Due to some errors, a Linux administrator needs to permanently disable SELinux on one of the development machines for the time of testing. Which of the following should the administrator do to accomplish this task?" }

A{ "Use \"setenforce disabled\" command and restart the system." }
B{ "Use \"setenforce 1\" command." }
C{ "Use \"systemctl disable selinux\" command." }
D{ "Edit the \"/etc/selinux/config\" file and restart the system." }

Answer: D

{ "Changing SELINUX=enforcing to SELINUX=disabled in /etc/selinux/config and then rebooting is the only way to persistently disable SELinux; setenforce only takes effect until the next reboot." }

{ "An administrator runs the following command while troubleshooting server authentication issues: Based on the command output, which of the following is the cause of the authentication issues?" }

A{ "The LDAP server is not running on the server." }
B{ "A firewall is blocking access to the LDAP server." }
C{ "The secure LDAP server certificate is not trusted." }
D{ "SSH packets are being dropped." }

Answer: A

{ "The Nmap output shows port 636/tcp (LDAPS) as closed, which indicates that no service is currently listening on that port. This strongly suggests the LDAP server is not running." }