Free LPIC-3 Security Practice Questions

Sample Practice Questions

Try these 10 sample questions from the LPIC-3 Security practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An issuing CA must sign end-entity certificates but must not create subordinate CAs. Which basicConstraints value expresses that path-length restriction?

   1. A. CA:TRUE, pathlen:0
   2. B. CA:TRUE, pathlen:1
   3. C. CA:TRUE, pathlen:2
   4. D. CA:TRUE, pathlen:3

   Answer: A

   Explanation: OpenSSL states, "A pathlen of zero means the CA cannot sign any sub-CA's, and can only sign end-entity certificates." Zero therefore expresses the required restriction; positive values allow subordinate CA levels.

   Reference: OpenSSL x509v3_config — STANDARD EXTENSIONS — Basic Constraints

2. 2A systemd system service must retain only CAP_NET_BIND_SERVICE in its capability bounding set. There are no other CapabilityBoundingSet assignments, and ExecStart has no '+' prefix. Which setting implements this?

   1. A. Exclude CAP_NET_BIND_SERVICE using CapabilityBoundingSet=~CAP_NET_BIND_SERVICE.
   2. B. Add CAP_NET_BIND_SERVICE using AmbientCapabilities=CAP_NET_BIND_SERVICE.
   3. C. Retain only CAP_NET_BIND_SERVICE using CapabilityBoundingSet=CAP_NET_BIND_SERVICE.
   4. D. Prevent execution-time privilege gains using NoNewPrivileges=yes.

   Answer: C

   Explanation: systemd states, "Capabilities listed will be included in the bounding set, all others are removed." A plain list retains only the named capability. A tilde inverts selection; ambient capabilities and NoNewPrivileges do not select this bounding set.

   Reference: systemd.exec — Execution Environment Configuration — Capabilities — CapabilityBoundingSet=

3. 3A file's access ACL includes user:lisa:rw- and mask::r--. Lisa is not the file owner and has no overriding capabilities. What access does her named-user ACL entry effectively grant?

   1. A. Read only
   2. B. Write only
   3. C. Read and write
   4. D. Read and execute

   Answer: A

   Explanation: The ACL_MASK entry denotes "the maximum access rights that can be granted" by named-user and relevant group entries. Intersecting the rw- entry with r-- leaves read permission only; the mask removes write and cannot add execute.

   Reference: Linux Access Control Lists acl(5) — ACL ENTRIES — ACL_MASK

4. 4An analyst applies a Wireshark display filter to an existing packet capture. What happens to packets excluded from the current display?

   1. A. They are deleted from the original capture file when the filter is applied.
   2. B. They are retained only until the capture file is next saved.
   3. C. They remain in the capture file and can be displayed after clearing the filter.
   4. D. They are moved to a second capture file containing rejected packets.

   Answer: C

   Explanation: The guide states, "When using a display filter, all packets remain in the capture file." Display filtering changes the view, so clearing it restores visibility; it does not delete, move, or automatically discard hidden packets.

   Reference: Wireshark User's Guide — Filtering Packets While Viewing — 6.3 Filtering Packets While Viewing — Note

5. 5After gaining privileged access, an attacker installs tools that conceal malicious activity and preserve covert privileged access. Which threat category best describes these tools?

   1. A. A rootkit
   2. B. A keylogger
   3. C. A file-infecting virus
   4. D. A credential-stealing Trojan

   Answer: A

   Explanation: NIST describes rootkit tools used after root-level access "to conceal the attacker's activities on the host". Covert privileged persistence and concealment identify the rootkit role. Keylogging captures input, file-infecting viruses propagate through files, and credential-stealing Trojans focus on deceptive delivery and theft.

   Reference: NIST CSRC Glossary — Rootkit — Definitions — CNSSI 4009-2022

6. 6Which extendedKeyUsage value identifies a certificate public key intended for TLS client authentication?

   1. A. serverAuth
   2. B. clientAuth
   3. C. codeSigning
   4. D. emailProtection

   Answer: B

   Explanation: The extended key usage table lists "clientAuth SSL/TLS WWW Client Authentication". serverAuth identifies server authentication, while codeSigning and emailProtection identify different certificate purposes.

   Reference: OpenSSL x509v3_config — STANDARD EXTENSIONS — Extended Key Usage

7. 7Which systemd setting prevents a service process and its descendants from gaining new privileges through execve(), including through setuid executables?

   1. A. NoNewPrivileges=yes
   2. B. PrivateTmp=yes
   3. C. PrivateDevices=yes
   4. D. ProtectHome=yes

   Answer: A

   Explanation: NoNewPrivileges ensures that the service and children "can never gain new privileges through execve()". The other settings isolate temporary directories, devices, or home directories rather than applying this execution privilege constraint.

   Reference: systemd.exec — Execution Environment Configuration — Security — NoNewPrivileges=

8. 8Which directory setting supplies inherited access-control entries for newly created objects, subject to the permissions requested at creation?

   1. A. The directory's access ACL
   2. B. The creating process's umask
   3. C. The directory's default ACL
   4. D. The creator's supplementary group list

   Answer: C

   Explanation: The ACL manual states, "The new object inherits the default ACL of the containing directory as its access ACL." The creation mode can restrict corresponding permissions. The access ACL governs the directory itself, and umask or group membership does not supply inherited named ACL entries.

   Reference: Linux Access Control Lists acl(5) — OBJECT CREATION AND DEFAULT ACLs — step 1

9. 9Which libpcap capture filter selects TCP packets destined for IPv4 host 192.0.2.10 and destination port 443?

   1. A. tcp and dst host 192.0.2.10 and dst port 443
   2. B. tcp and src host 192.0.2.10 and dst port 443
   3. C. tcp and dst host 192.0.2.10 and src port 443
   4. D. udp and dst host 192.0.2.10 and dst port 443

   Answer: A

   Explanation: The manual illustrates destination TCP port syntax with "tcp dst port 80" and combines filter primitives using "and". Applying those rules selects the required protocol, destination host, and destination port. The other filters change the host direction, port direction, or transport.

   Reference: libpcap pcap-filter(7) — DESCRIPTION — qualifier order and compound expressions

10. 10A message impersonates a company's support team and sends users to a fake sign-in page to collect their credentials. Which attack is illustrated?

    1. A. A credential-stuffing attack
    2. B. A password brute-force attack
    3. C. An offline rainbow-table attack
    4. D. A phishing attempt

    Answer: D

    Explanation: NIST defines phishing as a fraudulent solicitation in which "the perpetrator masquerades as a legitimate business or reputable person." Here credentials are obtained by impersonation and a fake page. The other attacks reuse credentials, guess passwords, or use precomputed password-hash lookups.

    Reference: NIST CSRC Glossary — Phishing — Definitions — NIST SP 800-12 Rev. 1