SELinux & AppArmor (Linux+) Quiz: Modes & Enforcement

1. Which command is used to set SELinux to Enforcing mode permanently?

Setenforce 1

Edit /etc/selinux/config and set SELINUX=enforcing

Both a and b, but b requires a reboot

Apparmor-enforce

2. What is the primary security benefit of mandatory access control via SELinux?

It enforces security decisions at the kernel level independent of file ownership

It eliminates the need for user authentication

It prevents all network access

It replaces password-based authentication

3. Which tool is commonly used to generate SELinux policy suggestions from audit logs?

Audit2allow

Selinux-suggest

Policy-generator

Apparmor-convert

4. In SELinux policy, what does the 'allow' rule specify?

Which subjects can perform which actions on which objects

Which users have sudo privileges

Which files can be encrypted

Which network ports are open

5. What happens to a running process when SELinux is switched from Permissive to Enforcing?

The process is immediately terminated

The process continues; new denials are enforced

The process receives a warning signal

The system automatically reverts to Permissive

6. Which SELinux command is used to view audit denial messages?

Ausearch

Audit-view

Selinux-logs

Cat /var/log/secure

7. What is the relationship between SELinux & AppArmor (Linux+) on the same system?

Both can run simultaneously

Only one can be active at a time

AppArmor automatically disables SELinux

They are complementary with no conflicts

8. Which file contains SELinux configuration including the default mode?

/etc/selinux/config

/etc/security/selinux

/var/log/selinux.conf

/boot/selinux-policy

9. In SELinux, what does 'deny' in an audit log indicate?

An action was blocked by policy in Enforcing mode

An action would be blocked if not in Permissive mode

A user account was locked

A network connection was refused

10. What is the purpose of SELinux policy modules?

To extend base policies with application-specific rules

To replace the kernel entirely

To encrypt all system files

To manage user account creation

11. What is the primary function of SELinux in a Linux system?

Enforce mandatory access control based on security policies

Replace all user authentication mechanisms

Manage only file permissions at the filesystem level

Provide optional firewall rules for network traffic

12. How does AppArmor differ from SELinux in terms of policy model?

AppArmor uses path-based rules; SELinux uses context-based labels

AppArmor is more restrictive than SELinux

SELinux cannot protect system files

AppArmor requires kernel recompilation

13. What does the 'type' field in an SELinux security context represent?

The domain or role of a process or file

The file ownership structure

The encryption algorithm used

The backup category for disaster recovery

14. Which SELinux component defines the rules for access control?

Security policy

Kernel module

User authentication daemon

Filesystem journal

15. What is a security context in SELinux?

A label defining user, role, type, and level for objects

A firewall rule applied to network ports

A user group with elevated privileges

An encryption key for file protection

16. In Disabled mode, is SELinux active at the kernel level?

Yes, it monitors but does not enforce

No, SELinux is completely inactive

Yes, but only for audit purposes

No, but AppArmor takes over enforcement

17. Which command is used to check the current SELinux mode?

Sestatus

Selinux-check

Getenforce

Both a and c

18. What is the main advantage of using Permissive mode during system troubleshooting?

It eliminates all security checks temporarily

It logs denials without blocking, helping identify policy issues

It prevents any kernel-level operations

It converts SELinux policies to AppArmor rules

19. Which SELinux mode allows operations but logs policy violations without blocking them?

Enforcing

Permissive

Disabled

Audit-only

20. In Enforcing mode, what happens when SELinux policy denies an action?

The action is blocked and logged

The action is allowed with a warning

The system automatically disables SELinux

The user is prompted to override the policy

SELinux Quiz: Enforcing, Permissive or Disabled?