Typing lsof -i | grep LISTEN as root produces three lines of output, corresponding to the sendmail, sshd, and proftpd servers. What can you conclude about the security of this system?
Everything is OK; the presence of sshd ensures that data are being encrypted via SSH.
The sendmail and sshd servers are OK, but the FTP protocol used by proftpd is insecure and should never be used.
The sendmail server should be replaced by Postfix or qmail for improved security, but sshd and proftpd are fine.
Because sendmail and proftpd both use unencrypted text-mode data transfers, neither is appropriate on a network-connected computer.
No conclusion can be drawn without further information; the listed servers may or may not be appropriate or authentic.
As part of a security audit, you plan to use Nmap to check all of the computers on your network for unnecessary servers. Which of the following tasks should you do prior to running your Nmap check?
Back up /etc/passwd on the target systems to eliminate the possibility of it being damaged.
Obtain the root passwords to the target systems so that you can properly configure them to accept the Nmap probes.
Obtain written permission from your boss to perform the Nmap sweep.
Configure /etc/sudoers on the computer you intend to use for the sweep, to give yourself the ability to run Nmap.
Disable any firewall between the computer that’s running Nmap and the servers you intend to scan.
Your login server is using PAM, and you want to limit users’ access to system resources. Which configuration file will you need to edit?
/etc/limits.conf
/etc/pam/limits.conf
/etc/security/limits.conf
/etc/security/pam/limits.conf
/usr/local/limits.conf
Which of the following tools might you use to check for open ports on a local computer? (Select three.)
Nmap
netstat
lsof
portmap
services
Which of the following commands will locate all of the program files on a computer on which the SUID bit is set?
find / -type SUID
find / -perm +4000 -type f
find / -perm +SUID -type f
find / -type +4000
find / -suid
The /etc/sudoers file on a computer includes the following line. What is its effect? %admin ALL=(ALL) ALL
Members of the admin group may run all programs with root privileges by using sudo.
Users in the admin user alias, defined earlier in the file, may run all programs with root privileges by using sudo.
The admin user alias is defined to include all users on the system.
The admin command alias is defined to include all commands.
The user admin may run all programs on the computer as root by using sudo.
Which command would you type, as root, to discover all the open network connections on a Linux computer?
lsof -c a
netstat -ap
ifconfig eth0
nmap -sT localhost
top -net
A server/computer combination appears in both hosts.allow and hosts.deny. What’s the result of this configuration when TCP wrappers runs?
TCP wrappers refuses to run and logs an error in /var/log/messages.
The system’s administrator is paged to decide whether to allow access.
hosts.deny takes precedence; the client is denied access to the server.
hosts.allow takes precedence; the client is granted access to the server.
The client is granted access to the server if no other client is currently accessing it.
When is the bind option of xinetd most useful?
When you want to run two servers on one port
When you want to specify computers by name rather than IP address
When xinetd is running on a system with two network interfaces
When resolving conflicts between different servers
When xinetd manages a DNS server program
You’ve discovered that the Waiter program (a network server) is running inappropriately on your computer. You therefore locate its startup script and shut it down by removing that script. How can you further reduce the risk that outsiders will abuse the Waiter program? (Select two.)
By blocking the Waiter program’s port using a firewall rule
By reading the Waiter program’s documentation to learn how to run it in stealth mode
By tunneling the Waiter program’s port through SSH
By uninstalling the Waiter package
By uninstalling any clients associated with Waiter from the server computer
You want to use xinetd access controls to limit who may access a server that’s launched via xinetd. Specifically, only users on the 192.168.7.0/24 network block should be able to use that server. How may you do this?
Enter hosts_allowed = 192.168.7.0/24 in the /etc/xinetd.conf configuration file for the server in question.
Enter only_from = 192.168.7.0/24 in the /etc/xinetd.conf configuration file for the server in question.
Enter server : 192.168.7., where server is the server’s name, in the /etc/ hosts.allow file.
Enter server : 192.168.7., where server is the server’s name, in the /etc/ hosts.deny file.
Type iptables -L 192.168.7.0 to enable only users of 192.168.7.0/24 to access the server.
Of the following, which is the best password?
Odysseus
iA71Oci^My~~~~~~
pickettomato
Denver2Colorado
123456
Which of the following types of attacks involves sending bogus email to lure unsuspecting individuals into divulging sensitive financial or other information?
Phishing
Script kiddies
Spoofing
Ensnaring
Hacking
Ordinary users report being unable to log onto a computer, but root has no problems doing so. What might you check to explain this situation?
A misbehaving syslogd daemon
A login process that’s running as root
The presence of an /etc/nologin file
The presence of an SUID bit on /bin/login
Inappropriate use of shadow passwords
Which servers might you consider retiring after activating an SSH server? (Select two.)
SMTP
Telnet
FTP
NTP
Samba
You find that the ssh_host_dsa_key file in /etc/ssh has 0666 (-rw-rw-rw-) permissions. Your SSH server has been in operation for several months. Should you be concerned?
Yes
No
Only if the ssh_host_dsa_key.pub file is also world-readable
Only if you’re launching SSH from a super server
Only if you’re using a laptop computer
For best SSH server security, how should you set the Protocol option in /etc/ssh/ sshd_config?
Protocol 1
Protocol 2
Protocol 1,2
Protocol 2,1
Protocol *
Why is it unwise to allow root to log on directly using SSH?
Disallowing direct root access means that the SSH server may be run by a non-root user, improving security.
The root password should never be sent over a network connection; allowing root logins in this way is inviting disaster.
SSH stores all login information, including passwords, in a publicly readable file.
When logged on using SSH, root’s commands can be easily intercepted and duplicated by undesirable elements.
Somebody with the root password but no other password can then break into the computer.
You’ve downloaded a GPG public key from a website into the file fredkey.pub. What must you do with this key to use it?
Type inspect-gpg fredkey.pub.
Type gpg --readkey fredkey.pub.
Type import-gpg fredkey.pub.
Type gpg --import fredkey.pub.
Type gpg-import fredkey.pu b.
You want to send an encrypted message to an email correspondent. You both have GPG. What do you need to exchange before you can send your encrypted message?
Your correspondent must obtain your GPG public key.
Your correspondent must obtain your GPG private key.
You must exchange private keys with your correspondent.
You must obtain your correspondent’s GPG private key.
You must obtain your correspondent’s GPG public key .
