Quiz Module 9 - System Security

Instructions

This quiz contains 30 multiple-choice questions to validate your understanding of Module 9.

Tip: Answer each question before revealing the answer. The answers are hidden just after each question.

---

Question 1

Which command configures the UFW firewall on Ubuntu 24.04?

1. firewall

2. ufw

3. iptables

4. firewalld

See explanation

Correct answer: ufw

Explanation: ufw (Uncomplicated Firewall) is the default firewall on Ubuntu. Examples: sudo ufw enable (activate), sudo ufw allow 22/tcp (allow SSH), sudo ufw status (view rules), sudo ufw deny 80/tcp (block).

---

Question 2

Which command activates the UFW firewall?

1. ufw start

2. ufw enable

3. ufw on

4. ufw activate

See explanation

Correct answer: ufw enable

Explanation: sudo ufw enable activates the UFW firewall. sudo ufw disable deactivates it. sudo ufw status displays the status and rules. sudo ufw status verbose shows more details.

---

Question 3

Which command allows a port in UFW?

1. ufw open port

2. ufw allow port

3. ufw permit port

4. ufw accept port

See explanation

Correct answer: ufw allow port

Explanation: sudo ufw allow 22/tcp allows TCP port 22. sudo ufw allow 80 allows TCP and UDP on port 80. sudo ufw allow from 192.168.1.0/24 allows from a network. sudo ufw deny 80 blocks a port.

---

Question 4

Which file configures sudo?

1. /etc/sudo

2. /etc/sudoers

3. /etc/sudo.conf

4. /home/sudoers

See explanation

Correct answer: /etc/sudoers

Explanation: /etc/sudoers configures sudo permissions. Edit it with sudo visudo (checks syntax). Never edit directly with a normal editor to avoid syntax errors that could block sudo access.

---

Question 5

Which command securely edits the sudoers file?

1. sudo edit /etc/sudoers

2. sudo visudo

3. sudo nano /etc/sudoers

4. sudo vim /etc/sudoers

See explanation

Correct answer: sudo visudo

Explanation: sudo visudo opens the editor for /etc/sudoers and checks syntax before saving. If the syntax is incorrect, it refuses to save, preventing sudo access blockage. Always use visudo, never a normal editor.

---

Question 6

Which sudoers syntax allows a user to execute a command without a password?

1. user ALL=(ALL) ALL

2. user ALL=(ALL) NOPASSWD: ALL

3. user ALL=(ALL) NO_PASSWD ALL

4. user ALL=(ALL) PASSWD: NONE

See explanation

Correct answer: user ALL=(ALL) NOPASSWD: ALL

Explanation: user ALL=(ALL) NOPASSWD: ALL allows the user to execute all commands without a password. NOPASSWD: is the correct syntax. Caution: this reduces security, use with care.

---

Question 7

Which umask value gives 644 permissions for new files?

1. 022

2. 022

3. 002

4. 077

See explanation

Correct answer: 022

Explanation: umask 022 means new files will have 644 permissions (666 - 022 = 644) and directories 755 (777 - 022 = 755). umask defines permissions to remove. umask without argument displays the current value.

---

Question 8

Which command shows the current permissions of a file in detail?

1. ls -l

2. ls -l or getfacl

3. perm

4. showperm

See explanation

Correct answer: ls -l or getfacl

Explanation: ls -l file displays standard permissions. getfacl file shows complete permissions including ACLs. stat file also shows permissions with more details (inode, dates, etc.).

---

Question 9

Which command shows the status of the UFW firewall?

1. ufw show

2. ufw status

3. ufw list

4. ufw info

See explanation

Correct answer: ufw status

Explanation: sudo ufw status displays the firewall status and active rules. sudo ufw status verbose shows more details. sudo ufw status numbered numbers the rules for easier deletion.

---

Question 10

Which command deletes a UFW rule by number?

1. ufw remove number

2. ufw delete number

3. ufw del number

4. ufw rm number

See explanation

Correct answer: ufw delete number

Explanation: sudo ufw status numbered displays numbered rules. sudo ufw delete 1 deletes rule number 1. You can also delete by rule: sudo ufw delete allow 22/tcp.

---

Question 11

Which command shows system audit logs?

1. auditlog

2. ausearch or journalctl

3. audit

4. showaudit

See explanation

Correct answer: ausearch or journalctl

Explanation: ausearch queries auditd logs (if installed). journalctl displays systemd logs which include audit information. sudo auditctl -l shows active audit rules.

---

Question 12

Which command shows who has used sudo recently?

1. sudo log

2. sudo grep sudo /var/log/auth.log or journalctl | grep sudo

3. sudo history

4. sudolog

See explanation

Correct answer: sudo grep sudo /var/log/auth.log or journalctl | grep sudo

Explanation: sudo grep sudo /var/log/auth.log shows sudo usages in authentication logs. journalctl | grep sudo does the same with systemd logs. Useful for auditing sudo usage.

---

Question 13

Which command shows recent SSH connections?

1. sshlog

2. grep ssh /var/log/auth.log or journalctl -u ssh

3. ssh history

4. lastssh

See explanation

Correct answer: grep ssh /var/log/auth.log or journalctl -u ssh

Explanation: grep ssh /var/log/auth.log shows SSH connections (successes and failures). journalctl -u ssh displays SSH service logs. last also shows recent connections. Useful for detecting intrusion attempts.

---

Question 14

Which command shows failed login attempts?

1. failed

2. grep "Failed password" /var/log/auth.log or lastb

3. failedlog

4. errors

See explanation

Correct answer: grep "Failed password" /var/log/auth.log or lastb

Explanation: grep "Failed password" /var/log/auth.log shows failed login attempts. lastb also displays failed connections (sometimes requires sudo). Useful for detecting brute force attacks.

---

Question 15

Which command shows running processes with their permissions?

1. ps -p

2. ps aux or ps -eo user,pid,cmd

3. process

4. showproc

See explanation

Correct answer: ps aux or ps -eo user,pid,cmd

Explanation: ps aux shows all processes with their user. ps -eo user,pid,cmd displays a custom format. Useful for seeing which processes run with which users, important for security.

---

Question 16

Which command shows files with the SUID bit?

1. find -suid

2. find / -perm -4000

3. find -perm suid

4. suidfind

See explanation

Correct answer: find / -perm -4000

Explanation: find / -perm -4000 finds all files with the SUID bit. find / -perm -2000 finds files with SGID. find / -perm -1000 finds directories with sticky bit. Important for security: check for unexpected SUID files.

---

Question 17

Which command shows open ports on the system?

1. ports

2. ss -tuln or netstat -tuln

3. openports

4. listports

See explanation

Correct answer: ss -tuln or netstat -tuln

Explanation: ss -tuln or netstat -tuln displays all listening ports. Important for security: check which services are listening on which ports. Close unnecessary ports with UFW or disable services.

---

Question 18

Which command shows users with sudo access?

1. sudo users

2. getent group sudo or grep sudo /etc/group

3. list sudo

4. sudoers

See explanation

Correct answer: getent group sudo or grep sudo /etc/group

Explanation: getent group sudo or grep sudo /etc/group shows members of the sudo group. sudo -l (for the current user) shows sudo permissions. Important for auditing who has sudo access.

---

Question 19

Which command shows recently modified files (potentially compromised)?

1. recent

2. find / -mtime -1 or find / -mmin -60

3. modified

4. changed

See explanation

Correct answer: find / -mtime -1 or find / -mmin -60

Explanation: find / -mtime -1 finds files modified in the last 24 hours. find / -mmin -60 finds those modified in the last hour. Useful for detecting suspicious changes after a security incident.

---

Question 20

Which command shows active network connections (to detect suspicious connections)?

1. connections

2. ss -tn or netstat -tn

3. active

4. netconn

See explanation

Correct answer: ss -tn or netstat -tn

Explanation: ss -tn or netstat -tn displays active TCP connections. Useful for detecting suspicious outgoing or incoming connections. ss -tnp also shows processes, even more useful.

---

Question 21

Which command shows a file's permissions with ACLs?

1. showacl

2. getfacl

3. viewacl

4. acl

See explanation

Correct answer: getfacl

Explanation: getfacl file displays the ACLs (Access Control Lists) of a file, showing permissions for specific users and groups. setfacl sets ACLs. Useful for granular permissions.

---

Question 22

Which command shows processes with network connections?

1. netproc

2. lsof -i or ss -tulpn

3. processnet

4. netprocess

See explanation

Correct answer: lsof -i or ss -tulpn

Explanation: lsof -i lists all processes with network connections. ss -tulpn shows listening ports with PIDs. Useful for seeing which processes communicate on the network, important for security.

---

Question 23

Which command shows the last logins to the system?

1. connections

2. last

3. recent

4. logins

See explanation

Correct answer: last

Explanation: last displays the history of logins to the system (successes). last -n 10 shows the last 10. lastb shows failed attempts. w and who show currently logged-in users.

---

Question 24

Which command shows a directory's permissions with its files?

1. ls -R

2. find /path -ls or ls -laR

3. showall

4. listall

See explanation

Correct answer: find /path -ls or ls -laR

Explanation: find /path -ls displays files with their permissions. ls -laR /path lists recursively with permissions. Useful for auditing permissions in a directory and its subdirectories.

---

Question 25

Which command shows users who can log into the system?

1. users

2. getent passwd or cat /etc/passwd

3. listusers

4. showusers

See explanation

Correct answer: getent passwd or cat /etc/passwd

Explanation: getent passwd or cat /etc/passwd lists all users. Check the shell: /usr/sbin/nologin or /bin/false means the user cannot log in. Important for security: disable unused accounts.

---

Question 26

Which command shows iptables rules (low-level firewall)?

1. iptables show

2. iptables -L

3. iptables list

4. iptables -S

See explanation

Correct answer: iptables -L

Explanation: sudo iptables -L displays iptables rules. sudo iptables -L -v shows more details with counters. sudo iptables -S displays rules in command format. UFW uses iptables in the background.

---

Question 27

Which command shows files with overly permissive permissions (777, 666)?

1. find -perm 777

2. find / -perm 777 or find / -perm -666

3. find -wide

4. permissive

See explanation

Correct answer: find / -perm 777 or find / -perm -666

Explanation: find / -perm 777 finds files with exactly 777 permissions. find / -perm -666 finds files with at least rw-rw-rw- (too permissive). Important for security: correct overly permissive permissions.

---

Question 28

Which command shows processes running as root?

1. ps root

2. ps aux | grep "^root" or ps -U root

3. rootproc

4. showroot

See explanation

Correct answer: ps aux | grep "^root" or ps -U root

Explanation: ps aux | grep "^root" or ps -U root shows processes running as root. Important for security: minimize root processes, use sudo when possible. Audit regularly.

---

Question 29

Which command shows active services (potentially vulnerable)?

1. services

2. systemctl list-units --type=service --state=running

3. activeservices

4. runningservices

See explanation

Correct answer: systemctl list-units --type=service --state=running

Explanation: systemctl list-units --type=service --state=running lists all active services. Important for security: disable unnecessary services to reduce the attack surface. systemctl disable service to disable at startup.

---

Question 30

Which command shows configuration files with plaintext passwords?

1. findpass

2. grep -r "password" /etc/ or find /etc -name "*.conf" -exec grep -l "password"

3. searchpass

4. passfind

See explanation

Correct answer: grep -r "password" /etc/ or find /etc -name "*.conf" -exec grep -l "password"

Explanation: grep -r "password" /etc/ searches for occurrences of "password" in configuration files. Important for security: ensure no passwords are stored in plaintext. Use secret files or secure environment variables.

---

Quiz Result

Congratulations on completing the Module 9 quiz!

Score:

• 25-30 correct answers: Excellent! You master Linux system security.
• 20-24 correct answers: Very good! Review the concepts where you had difficulties.
• 15-19 correct answers: Good! Review the chapters on security.
• Less than 15: Recommended to review the module before continuing.

---

Next Steps

Now that you have validated your knowledge:

Module 10: Package Management
Practical Labs: Practice security with Module 9 labs

---

Quiz created on: December 2024 - Tested on Ubuntu 24.04