Mail ExamTopics
MAIL US team@examtopics.com

ECCouncil 312-38 (Certified Network Defender) Practice Test 9

Question 80

A bastion host permits SSH access to named administrators but security policy forbids direct SSH login as root. Which sshd setting is central to enforcement?

  1. LogLevel QUIET
  2. PermitRootLogin no
  3. PasswordAuthentication yes
  4. X11Forwarding yes

Explanation

Correct Answer

B:

This directive disallows root authentication over SSH while allowing authorized administrators to authenticate individually and elevate afterward.

Incorrect Answers

A:

Reducing logging does not prevent privileged SSH authentication and could hide useful account access evidence.

C:

Enabling passwords changes one authentication method but does not specifically prohibit direct login by root.

D:

X11 forwarding controls graphical display tunneling, not whether the root account can authenticate directly via SSH.

Question 81

SSH keys are deployed throughout a fleet, and the organization wants to prohibit fallback to passwords on hardened administration hosts. Which sshd change is appropriate after validating key access?

  1. PasswordAuthentication no
  2. PermitEmptyPasswords yes
  3. GatewayPorts yes
  4. TCPKeepAlive yes

Explanation

Correct Answer

A:

Disabling password-based SSH authentication reduces online password-guessing exposure while retaining configured authorized public-key access.

Incorrect Answers

B:

Allowing empty passwords weakens account authentication and is the opposite of the requested hardened posture.

C:

GatewayPorts changes forwarding bind behavior and may expand exposure without prohibiting SSH passwords.

D:

Keepalive settings affect connection behavior, not whether reusable passwords remain acceptable for authentication.

Question 82

A public SSH service receives many rapid login failures from one external address. Which compensating automation can temporarily block repeat sources?

  1. Increasing the SSH banner message length
  2. Fail2ban with a validated SSH log filter
  3. A static sshd AllowUsers rule listing the same administrator accounts
  4. The Linux locate database

Explanation

Correct Answer

B:

Fail2ban reacts to repeated matching authentication failures and applies temporary bans, complementing stronger authentication controls.

Incorrect Answers

A:

A longer legal banner neither authenticates clients nor prevents automated attempts to guess their passwords.

C:

AllowUsers can restrict identities that authenticate, but it does not dynamically identify and temporarily ban a source generating repeated failed logons.

D:

The file-location index speeds searches but has no mechanism to evaluate SSH login failures or block addresses.

Question 83

A process runs under a service account but unexpectedly cannot open a file whose UNIX permissions permit access. Which additional enforcement layer should be examined on a SELinux-enabled host?

  1. SELinux type-enforcement policy and audit denials
  2. The system's DNS search suffix
  3. The switch's configured native VLAN
  4. A Linux audit rule watching file opens

Explanation

Correct Answer

A:

Mandatory access controls can block a process even when discretionary file permissions allow it; AVC records identify relevant denials.

Incorrect Answers

B:

Resolver search order does not govern SELinux process domains or file type permissions.

C:

VLAN tags determine network segmentation and cannot explain a local kernel mandatory-access denial on a file.

D:

Audit rules provide records about access attempts but do not themselves grant permission to open a file blocked by SELinux.

Question 84

An Ubuntu application is restricted by per-program profiles controlling filesystem and network access. Which Linux security framework is most likely in use?

  1. AppArmor
  2. NTP
  3. LVM
  4. BIND DNS

Explanation

Correct Answer

A:

AppArmor uses profiles associated with programs to constrain operations, providing mandatory access controls beyond ordinary UNIX permissions.

Incorrect Answers

B:

NTP synchronizes time sources; it does not define confinement rules for application file and network operations.

C:

Logical Volume Manager organizes storage volumes but does not confine executable behavior according to security profiles.

D:

BIND provides name-resolution services and is not a general per-executable mandatory access-control mechanism.

Question 85

A Linux firewall currently uses nftables. Which principle prevents inbound access to a new database listener while preserving explicitly allowed operations?

  1. Flush every filter rule and accept all packets
  2. An ingress policy that drops unsolicited traffic except approved flows
  3. Change the system hostname without editing rules
  4. Restrict only outbound DNS requests

Explanation

Correct Answer

B:

An allowlist at the relevant chain and hook blocks unexpected reachability while preserving identified application and management paths.

Incorrect Answers

A:

Removing packet policy opens the database to any network path with routing reachability, directly contrary to the restriction.

C:

Hostnames help identify a host but do not enforce packet admission at the netfilter hooks.

D:

DNS egress policy does not close an inbound database port exposed to unauthorized client connections.

Question 86

A package repository mirror is compromised and serves an altered update, but the attacker cannot sign repository metadata with the trusted key. What protects the Linux update workflow?

  1. Reliance on an HTTP mirror URL alone
  2. Verification of signed package metadata and trusted repository keys
  3. Ignoring package verification warnings
  4. Use an automatic patch job while disabling repository metadata verification

Explanation

Correct Answer

B:

A trusted signing chain detects unauthorized repository content when package-manager signature validation is enforced correctly.

Incorrect Answers

A:

A transport address does not establish package publisher authenticity, especially if the mirror itself serves altered content.

C:

Bypassing signature failures defeats the mechanism designed to detect the compromised mirror's substitution.

D:

Unattended installs can accelerate updates but do not prevent accepting a tampered repository response when signature checking is bypassed.

Question 87

A systemd service processes untrusted documents and should not write to most of the operating system. Which hardening approach is most relevant?

  1. Add users to the service's administrative group indiscriminately
  2. Set the unit to run as UID 0 with unrestricted filesystem access
  3. A container image scan performed once at build time
  4. Disable journaling for all critical services
  5. Use service sandboxing directives such as ProtectSystem and restricted writable paths

Explanation

Correct Answer

E:

Systemd can narrow filesystem exposure per unit, reducing what a compromised process can modify beyond its intended data locations.

Incorrect Answers

A:

More privileged members increase the potential avenues for accidental or malicious modification of protected resources.

B:

Root authority plus broad writes enlarges the attack impact rather than confining the document-processing service.

C:

Image scanning may identify known defects but does not restrict runtime filesystem writes by an exploited systemd document service.

D:

Removing logs hides evidence of abuse and does not restrict the process's filesystem capabilities.

Question 88

Security engineers need an audit trail for changes to a sensitive Linux configuration file and privileged command execution. Which subsystem is designed for this task?

  1. A generic file size limit alone
  2. Linux auditd with appropriate audit rules
  3. The systemd journal with ordinary application messages
  4. The DNS round-robin record list

Explanation

Correct Answer

B:

The Linux audit framework can collect policy-defined file-access and syscall records suitable for investigation and compliance evidence.

Incorrect Answers

A:

Limiting file sizes may constrain resource use but does not record who altered a protected configuration file.

C:

Journald records service output but does not automatically produce policy-defined audit events for privileged file changes and system calls.

D:

DNS records influence service resolution and contain no kernel audit trail for local configuration writes.

Question 89

A Linux intrusion leaves a suspicious cron entry under a privileged account. What is the security relevance of the entry?

  1. A cron entry proves the network interface is physically damaged
  2. Cron entries are harmless if they use absolute paths
  3. Cron automatically encrypts every scheduled command
  4. Scheduled execution can provide persistence after initial compromise

Explanation

Correct Answer

D:

An attacker-controlled cron task can repeatedly run commands at scheduled times, so removal must include identifying its origin and payload.

Incorrect Answers

A:

Scheduling metadata does not show a hardware failure; it describes commands triggered at recurring times.

B:

Absolute paths may improve reliability but cannot establish that a command is trustworthy or authorized.

C:

Cron schedules execution; it does not turn script content into encrypted, authenticated code.

Question 90

A Linux laptop stores sensitive field data and can be physically stolen while powered off. Which control protects the volume against offline disk removal?

  1. Remote syslog forwarding alone
  2. A login screen password without disk encryption
  3. Full-disk or volume encryption with LUKS and managed unlocking
  4. A restrictive shell prompt configuration

Explanation

Correct Answer

C:

LUKS protects stored sectors from offline inspection when keys are properly protected and the encrypted volume is locked.

Incorrect Answers

A:

Remote logs aid incident review but do not encrypt sensitive files on a stolen, powered-down drive.

B:

An attacker with physical access may bypass the installed operating system and read unencrypted sectors directly.

D:

Prompt formatting is a user-interface preference and offers no protection against offline storage analysis.

Certified Network Defender (312-38) Practice Tests