Linux+ V7 Security Auditing Tools Quiz

1. What is the primary purpose of the auditd daemon?

Monitor network traffic

Log system calls and file access for compliance

Manage user authentication

Perform vulnerability scans

2. Which file contains audit rules in Linux?

/etc/audit/audit.rules

/var/log/audit/audit.log

/etc/syslog.conf

/var/audit/rules

3. The auditctl command is used to manage audit rules. True or False?

True

False

4. Which command displays real-time system calls made by a process?

Strace

Ltrace

Auditctl

Netstat

5. The 'getfacl' command is used to view Access Control Lists (ACLs) on files. True or False?

True

False

6. The /var/log/secure file typically contains authentication-related logs. True or False?

True

False

7. Which tool detects rootkits and kernel-level compromises?

Chkrootkit

Nmap

Tcpdump

Lsof

8. The 'sudo' command logs its usage in audit logs for accountability. True or False?

True

False

9. What is the purpose of the 'journalctl' command?

Query and display systemd journal logs

Manage firewall rules

Monitor CPU usage

Configure audit rules

10. The 'umask' setting controls default file and directory permissions for new files. True or False?

True

False

11. What does the 'last' command display?

Recent login history of users

Last modified files

Last system errors

Last installed packages

12. Which tool captures and analyzes network traffic for security analysis?

Tcpdump

Auditd

Tripwire

Chkrootkit

13. Which command displays the audit log in a human-readable format?

Ausearch

Auditctl

Auditd

Audit

14. SELinux contexts consist of user, role, type, and level components. True or False?

True

False

15. Which command shows all open files and network connections for a process?

Lsof

Ps

Top

Netstat

16. What does SELinux provide for Linux systems?

Mandatory access control framework

File compression

Network routing

Package management

17. Which command logs user login and logout events?

Lastlog

Wtmp

Auditd

Syslog

18. AIDE (Advanced Intrusion Detection Environment) is used for file integrity monitoring. True or False?

True

False

19. What does the 'w' command display?

Who is currently logged in and their activity

File write permissions

Network bandwidth usage

Disk write speed

20. Which tool scans for open ports and services running on a system?

Nmap

Tripwire

Chkrootkit

Aide

Linux+ V7 Security Auditing Tools for Linux Quiz

1. What is the primary purpose of the auditd daemon?

2.

What first name or nickname would you like us to use?

2. Which file contains audit rules in Linux?

3. The auditctl command is used to manage audit rules. True or False?

4. Which command displays real-time system calls made by a process?

5. The 'getfacl' command is used to view Access Control Lists (ACLs) on files. True or False?

6. The /var/log/secure file typically contains authentication-related logs. True or False?

7. Which tool detects rootkits and kernel-level compromises?

8. The 'sudo' command logs its usage in audit logs for accountability. True or False?

9. What is the purpose of the 'journalctl' command?

10. The 'umask' setting controls default file and directory permissions for new files. True or False?

11. What does the 'last' command display?

12. Which tool captures and analyzes network traffic for security analysis?

13. Which command displays the audit log in a human-readable format?

14. SELinux contexts consist of user, role, type, and level components. True or False?

15. Which command shows all open files and network connections for a process?

16. What does SELinux provide for Linux systems?

17. Which command logs user login and logout events?

18. AIDE (Advanced Intrusion Detection Environment) is used for file integrity monitoring. True or False?

19. What does the 'w' command display?

20. Which tool scans for open ports and services running on a system?