Linux Security Free Practice Test — 30 Questions
This practice bank exercises key Linux security domains: mandatory access control (SELinux), network security (iptables/nftables), vulnerability management, and incident response. Scenarios require balancing compliance (PCI DSS, GDPR) with agility, applying least privilege, and using tools like seccomp, HIDS, and kernel live-patching. Decisions test understanding of SELinux contexts, firewall rules, process isolation, and forensic preservation. Ideal for administrators preparing for certification-level Linux security assessments.
What this Linux Security practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
SELinux and Mandatory Access Control
Multiple questions involve SELinux contexts and policy enforcement, such as denying `httpd_t` access to `finance_data_t` files or handling AVC denials when a daemon fails to bind a port. The practice bank emphasizes that SELinux operates alongside traditional Unix permissions and ACLs, with the most restrictive setting prevailing. Administrators must understand type enforcement, booleans, and how to associate ports with correct types when deploying custom services.
- SELinux uses type enforcement: subjects (processes) and objects (files/ports) have contexts; actions are allowed only if policy permits.
- A common error is forgetting to set proper context on files or configure booleans like `httpd_can_network_listen` for non‑standard ports.
- MAC frameworks like SELinux provide mandatory controls even if Unix permissions are permissive.
Network Security and Firewalls
Scenarios involve configuring `iptables` or `nftables` to restrict outbound traffic, segment networks, or isolate compromised hosts. The practice bank stresses the principle of least privilege: allowing only essential ports and services. In incident response, immediate network isolation (e.g., moving host to a quarantined VLAN) halts data exfiltration. Tools like `nftables` are used for temporary access controls when a patch cannot be applied immediately.
- Host‑based firewalls should default deny inbound and outbound; allow only explicitly required destinations.
- Network segmentation (e.g., moving a server to a restricted VLAN) prevents lateral movement.
- Rate limiting and deep packet inspection help mitigate zero‑day exploits while waiting for patches.
Incident Response and Forensics
The practice bank repeatedly tests the correct first step in a breach: isolate the affected system to stop further damage. Then preserve evidence (memory dump, disk image, logs). Questions highlight the need to balance containment with evidence preservation and regulatory notifications (GDPR, PCI DSS). A common pitfall is killing a process instead of isolating the host, which may destroy forensic clues or allow the attacker to execute further commands.
- Isolate the server from the network before taking any other action (e.g., killing a process could alert the attacker).
- Capture live memory and disk images for analysis after isolation.
- Document all steps for compliance and potential legal proceedings.
Compliance and Adaptability
Many scenarios require aligning security decisions with frameworks like PCI DSS, GDPR, HIPAA, or NIST. The practice bank tests the ability to choose adaptive responses (e.g., deploying HIDS with anomaly detection vs. signature‑based) and to prioritize availability when patching a zero‑day (e.g., using kernel live‑patching). Administrators must demonstrate flexibility, balancing immediate risk mitigation with long‑term stability and regulatory obligations.
- Regulatory mandates often require specific controls (e.g., PCI DSS v3.2.1 requires kernel live‑patching for critical systems).
- Behavioral competencies like adaptability are tested through scenarios with ambiguous or evolving threats.
- A proactive posture (e.g., seccomp‑bpf, tailored HIDS rules) reduces attack surface without relying solely on patch cycles.
Practice Linux Security with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 30-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
Anya, a seasoned Linux administrator, is tasked with fortifying a new e-commerce platform hosted on a cluster of RHEL servers. The platform processes significant volumes of personally identifiable information (PII) and financial transactions, necessitating strict compliance with regulations such as the Payment Card Industry Data Security Standard (PCI DSS) and the General Data Protection Regulation (GDPR). Anya must implement a security framework that not only meets these compliance mandates but also remains agile enough to counter emerging cyber threats without hindering the development team\'s agile workflow. She needs to prioritize proactive threat detection, granular access control, and robust data protection mechanisms. Which of the following approaches best embodies Anya\'s need for adaptable, compliant, and effective Linux security?
Study workflow
Turn one Linux Security attempt into a study plan
- 1
Implement SELinux Policy for a Custom Service
When deploying a daemon that listens on a non‑standard port, first create a custom SELinux policy module or use existing types. Use `semanage port -a -t http_port_t -p tcp 8443` to associate the port with an appropriate type, and enable booleans (e.g., `httpd_can_network_listen`) if needed. Then test with `ausearch -m avc` to confirm no denials.
- 2
Contain a Breach via Network Isolation
If you detect suspicious outbound traffic, immediately reconfigure the host's firewall (e.g., with `nftables`) to drop all non‑essential traffic, or move the server to a quarantined VLAN. Document the rule changes and notify the incident response team. Do not kill the suspicious process until forensics capture is complete.
- 3
Apply a Kernel Live Patch for Zero‑Day Vulnerabilities
Use a tool like kpatch or Ksplice to apply security updates without rebooting. Download the patch from your vendor, verify its signature, and install using `kpatch load patch.ko`. Monitor `/sys/kernel/livepatch` to confirm applied state. This maintains uptime while addressing critical kernel flaws.
- 4
Configure seccomp-bpf to Restrict System Calls
In your application startup script, use `seccomp_load` with a BPF program that whitelists only necessary system calls (e.g., `read`, `write`, `open`). Use tools like `strace` to determine required syscalls. This sandboxes the process, preventing exploits from making unauthorized kernel calls even if the application is compromised.
- 5
Set Up Anomaly‑Based HIDS on a Critical Server
Deploy OSSEC or Wazuh on the server. Configure it to monitor file integrity, logins, and process behavior. Create custom rules for expected application patterns (e.g., outbound connections to known IPs). Enable real‑time alerts and integrate with a SIEM. This provides early detection of zero‑day exploits that signature‑based systems miss.
FAQ
Questions about this exam practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
What is the first step in responding to a suspected data exfiltration from a Linux server?+
Isolate the server from the network using firewall rules or by moving it to a quarantined VLAN. This prevents further data loss and stops lateral movement. Only after containment should you begin forensic imaging and log analysis.
How does SELinux differ from standard Unix permissions?+
SELinux implements mandatory access control (MAC) where every process and file has a security context. Even if Unix permissions allow access, SELinux can deny it based on policy. It overrides discretionary controls and is enforced at the kernel level.
When would you use `seccomp-bpf` instead of SELinux for application hardening?+
Seccomp-bpf restricts system calls, while SELinux controls access to files, ports, and processes. Use seccomp when you need to tightly sandbox an application’s kernel interactions without a full SELinux policy. It is lightweight and ideal for containerized or legacy services.
How do you handle a zero‑day vulnerability when a full patch requires a reboot that cannot be scheduled immediately?+
Apply a kernel live patch (e.g., using kpatch) to fix the vulnerability without rebooting. Simultaneously, implement temporary network‑level controls (firewall rules) to block exploit patterns. Schedule the vendor patch during the next maintenance window.
What is the role of `nftables` in Linux security incident response?+
Nftables is the modern successor to iptables and allows dynamic rule changes. During an incident, you can quickly create rules to block malicious IPs, isolate a host, or limit traffic types. Its atomic rule replacement and named sets facilitate rapid, auditable changes.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.