110.1 Perform Security Administration Tasks Flashcards

1
Q

Gain privileges for user bob, load bob’s home directory and environment variables.

A

su - bob

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Executes a command as user moo and immediately returns to your user account.

A

su -c some_command moo

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Shows who is logged on and what they are doing.

A

w

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Shows who is currently logged in.

A

who

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Shows the history of user login and logout along with the time and date.

A

last

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Scan all devices on the 192.168.1.0 network for open ports, timing 5 seconds.

A

nmap -T5 192.168.1.0/24

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Scan all hosts on 192.168.1.0 network for ports 1-12345, treat all hosts as online to avoid ICMP (ping).

A

nmap -Pn -p1-12345 192.168.1.0/24

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Scan all devices on the 192.168.1.0 network and determine the operating systems for each host.

A

sudo nmap -O 192.168.1.0/24

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Show protocol statistics for IP, TCP, UDP, ICMP.

A

netstat -s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Show the routing table.

A

netstat -r

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Show all ports on the network in numeric format.

A

netstat -na

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Show only listening sockets in numeric format.

A

netstat -nl

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Find out which process is using port 33737/tcp, verbose.

A

fuser -v -n tcp 33737

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

List open files for device sda3, like a USB flash drive needing to be unmounted.

A

lsof | grep ‘/dev/sda3’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

List processes listening on port 23.

A

lsof -i :23

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Kills all processes using the Data file system or folder so that it can be unmounted.

A

fuser -km Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Find files owned by root under / with mounted filesystems excluded and suid or sgid bit set.

A

find / -xdev -user root ( -perm -4000 -o -perm -2000 )

find / -xdev -user root ( -perm /u=s -o -perm /g=s )

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Find files in home directory modified in the last 24 hours (last access time / 24 with remainder < 24).

A

find $HOME -mtime 0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Find files in home directory modified in the last 24 hours, exclude hidden files and directories.

A

find $HOME ( ! -regex ‘./..’ ) -mtime 0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Where is the EDITOR environment variable set?

A

~/.bashrc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Sets the max amount of virtual memory available to the shell.

A

ulimit -v

22
Q

View the user hard limit for the max number of open files.

A

ulimit -Hn

23
Q

Prevent application crashes from creating core dumps.

A

ulimit -c 0

24
Q

List all user limits.

A

ulimit -a

25
Q

Set user CPU limits.

A

ulimit -t

26
Q

Change login name for user moo to zoo.

A

usermod -l zoo moo

27
Q

Set the day the password was last changed so user moo will be prompted to enter a new password on login.

A

chage -d 0 moo

28
Q

List password info for user moo.

A

chage -l moo

29
Q

Expire user moo’s password and force them to change it on next login.

A

passwd -e moo

30
Q

show the password status for all users.

A

passwd -a -S

31
Q

Delete moo’s password thus disabling moo’s ability to log in.

A

passwd -d moo

32
Q

Unlock moo’s account.

A

passwd -u moo

usermod -U moo

33
Q

Lock moo’s account.

A

passwd -l moo

usermod -L moo

34
Q

Change password for user moo.

A

sudo passwd moo

35
Q

Command used to audit the system including suid system calls and the /etc/audit/audit.rules log file.

A

auditd

36
Q

Sets the memory usage limit on your system.

A

setrlimit

37
Q

Gets the memory usage limit on your system.

A

getrlimit

38
Q

The file that overrides the limits.conf file.

A

limits.d

39
Q

Full path to the file that contains the config info for sudo, modified with visudo.

A

/etc/sudoers

40
Q

Full path to file that if changed requires restarting auditd service, and the command to perform the restart.

A

/etc/audit/audit.rules
service auditd restart
systemctl restart auditd

41
Q

Find files in /usr/bin with suid set.

A

find /usr/bin -perm -u+s
find /usr/bin -perm -4000
find /usr/bin -perm /u=s

42
Q

Permissions when sgid is set on a file.

A

Permissions of the set group rather than permissions of the current user’s group.

43
Q

su stands for what?

A

substitute user

44
Q

Add new user moo and create their home directory.

A

useradd -m moo

45
Q

Clear any credentials for yourself.

A

sudo -k

46
Q

Give regular user moo permission to run useradd and passwd commands but not to change the root user’s password.

A

sudo visudo

moo ALL=(root) /usr/sbin/useradd, /etc/passwd, !/etc/passwd root

47
Q

Add moo to the sudo secondary group.

A

usermod -G 27 moo

48
Q

View permissions for user moo.

A

id moo

49
Q

Temporarily increase the number of open files limit for your user account to 2048.

A

ulimit -n 2048

Display open file limit:
ulimit -n
2048

50
Q

Full path to limits.conf file.

A

/etc/security/limits.conf

51
Q

Find files in /usr/bin with sgid set.

A

find /usr/bin -perm -g+s
find /usr/bin -perm -2000
find /usr/bin -perm /g=s