Security — page 2
Objective 110 of LPIC-1 Exam 102-500, worth 16.67% of the exam. This is page 2 of 3 of its question list; page one carries the full objective summary.
- Share of the exam
- 16.67%
- Questions in a real sitting
- roughly 10 of 60
- Questions in this bank
- 50
- Signed for by a person
- 0
- Machine-checked only
- 50
Partly checked. None of the 50 questions here has been read against the cited source by a person. 50 questions have been checked against their cited clause by an automated pass — which is not the same thing, and is not a signature.
Only questions a person has signed for are used in mock exams here. That is the whole difference between the two kinds of checking above.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
What this objective covers
The 50 questions written for this objective cite 3 LPI exam objectives (110.1, 110.2, 110.3) and 19 manual pages (chage(1), fuser(1), gpg(1), gpg-agent(1), hosts_access(5), inittab(5), nmap(1), nologin(8), pwconv(8), shadow(5), ss(8), ssh(1), ssh-keygen(1), ssh_config(5), sshd(8), sudoers(5), systemctl(1), systemd.socket(5), xinetd.conf(5)).
They break down as 35 single-answer questions, 8 type-the-answer questions and 7 choose-several questions.
Drill this objective
The trainer can run a short practice set drawn from this objective alone, which is what the weight column above is for: revise the heavy objectives first.
Questions on this objective (page 2 of 3)
- A contractor's account `bob` must be disabled on 31 December 2026, whatever the state of his password on that date. Which command sets that? machine-checked
- `umount /mnt/data` fails with 'target is busy'. Which command lists every process holding a file open anywhere on that mounted filesystem, so you can see who to stop first? machine-checked
- /etc/sudoers contains the line `alice db1 = (postgres) /usr/bin/psql`. What does the word `postgres` in parentheses specify? machine-checked
- You run `nmap 192.0.2.10` as an ordinary user rather than as root, and the output reports a connect scan. Why does nmap not use its usual default scan here? machine-checked
- A new policy requires the password of the existing account `alice` to be replaced at least every 90 days. Which TWO commands set that maximum password age? (Choose two.) machine-checked
- A contractor's account must be barred from obtaining an interactive login while the account, its UID and its files stay exactly as they are. Every other user must keep working normally. Which change achieves that? machine-checked
- Policy requires the account jrivera to change its password at least every 90 days, with a warning starting 7 days before expiry. Which command writes exactly that into /etc/shadow? machine-checked
- You inherit a host whose password hashes still sit in the second field of the world-readable /etc/passwd, with no /etc/shadow in place. Type the command from the shadow suite, with no options, that moves those hashes into /etc/shadow and leaves an x behind. machine-checked
- After setting a temporary password for alice by hand, you want the system to force her to choose her own at her next login, without locking or expiring the account. Which command does that, and what does it write into /etc/shadow? machine-checked
- While hunting for services to switch off, ss -ltn shows a socket listening on 0.0.0.0:8080 but gives you no idea which daemon owns it. Which invocation names the owning process? machine-checked
- A systemd host has no printers attached, yet cups.service is running and listening. Which TWO commands leave cups.service not started at the next boot? (Choose two.) machine-checked
- You ran systemctl disable --now ssh.service on a host, yet after a reboot connections to port 22 are still accepted, and an sshd process only appears in the process list once a client connects. What explains this, and what stops it? machine-checked
- A legacy host runs in.telnetd under xinetd. The service must stay enabled, but only clients in the management network 10.0.5.0/24 may reach it. Which attribute in /etc/xinetd.d/telnet expresses that? machine-checked
- You put the line `ALL: ALL` in /etc/hosts.deny expecting the host to refuse everything, yet the Apache web server keeps serving pages to any client. Why is the rule ignored? machine-checked
- On a host using TCP wrappers, /etc/hosts.deny contains only the line `in.telnetd: ALL` and /etc/hosts.allow is empty. A wrapped FTP daemon receives a connection from 203.0.113.9. What happens? machine-checked
- On a SysV-init system you must change which runlevel the machine boots into, by editing the entry whose action field is initdefault. Type the full path of the file that holds that entry. machine-checked
- A SysV-init server currently boots into the graphical runlevel 5 and you must make it come up in the multi-user text runlevel 3 instead. Which line in /etc/inittab decides that? machine-checked
- The server web01 was rebuilt from scratch and keeps its old address. Your next ssh web01 aborts with a warning that the remote host identification has changed and refuses to continue. Which command removes just the stale entry from your ~/.ssh/known_hosts? machine-checked
- Which TWO statements about OpenSSH server host keys are correct? (Choose two.) machine-checked
- You are asked to create a new Ed25519 SSH identity for your own account, in the default file names, specifying nothing but the key type. Type the complete command. machine-checked
The other objectives in LPIC-1 Exam 102-500
- 105. Shells and shell scripting — 15% of the exam
- 106. User interfaces and desktops — 6.67% of the exam
- 107. Administrative tasks — 20% of the exam
- 108. Essential system services — 18.33% of the exam
- 109. Networking fundamentals — 23.33% of the exam