LPI LPIC-3 (303-300) Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the LPI Security - 303 exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the 303-300 certification test. To get familiar with real exam environment, we suggest you try our Sample LPI LPIC-3 Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual LPIC-3 Security certification exam.
These sample questions are simple and basic questions that represent likeness to the real LPI 303-300 exam questions. To assess your readiness and performance with real time scenario based questions, we suggest you prepare with our Premium LPI LPIC-3 Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
LPI 303-300 Sample Questions:
01. The mail domain example.org publishes these records:
_25._tcp.mail.example.org. IN TLSA 3 1 1 9B0A…
example.org. IN CAA 0 issue "ca.example.net"
dig +short example.org DNSKEY returns nothing, and delv _25._tcp.mail.example.org TLSA reports ; unsigned answer. Sending mail servers that support DANE do not enforce the TLSA record.
Which two changes are required before those servers will enforce it?
(Choose two.)
a) Sign the example.org zone so that it serves DNSKEY and RRSIG records
b) Add example.org. IN CAA 0 iodef "mailto:security@example.org" to the zone
c) Protect zone transfers to the secondary name servers with a TSIG key
d) Change the TLSA record to 2 0 1 so that it pins the issuing CA
e) Publish a DS record for the zone's KSK in the parent org zone
02. An intermediate CA signs server certificates with openssl ca. Requesters put their host names in the CSR, so the [ CA_default ] section sets copy_extensions = copy. A review finds that a requester could also place basicConstraints = CA:TRUE in a CSR.
Which configuration still copies requested subject alternative names but prevents a CSR from producing a CA certificate?
a) Set copy_extensions = copyall and define basicConstraints = critical, CA:FALSE in the signing extension section
b) Set copy_extensions = none and define basicConstraints = critical, CA:FALSE in the signing extension section
c) Keep copy_extensions = copy and change policy to a section that requires matching subject fields
d) Keep copy_extensions = copy and define basicConstraints = critical, CA:FALSE in the signing extension section
e) Keep copy_extensions = copy and tell requesters to add basicConstraints = CA:FALSE to their [v3_req] section
03. On an x86-64 database host, /sys/devices/system/cpu/vulnerabilities/meltdown reports Mitigation: PTI. After a risk review, the team accepts disabling only kernel page-table isolation, the Meltdown mitigation, to recover system-call performance. Every Spectre mitigation must stay active.
Which two kernel command-line parameters meet the requirement?
(Choose two.)
a) mitigations=off
b) pti=off
c) nospectre_v2
d) nokaslr
e) nopti
04. During an authorised assessment, a tester runs an nmap UDP scan against 203.0.113.10. A service is known to be listening, yet the scan reports:
PORT STATE SERVICE
53/udp open|filtered domain
123/udp open ntp
Why does nmap mark 53/udp as open|filtered rather than open?
a) The probe produced a service banner that nmap received but could not match to a known version signature
b) The port is closed, which nmap determined from an ICMP port-unreachable reply to the probe
c) nmap completed a TCP three-way handshake to the port but received no application-layer data in return
d) The probe drew no response at all, so nmap cannot distinguish an open UDP port that stayed silent from one whose reply a firewall is dropping
05. Within Metasploit, an exploit module has successfully triggered a vulnerability on a target. The operator now needs the component that is actually delivered to the target and executed there to open an interactive session, such as a Meterpreter session.
Which module or component type provides this?
a) An exploit module
b) An auxiliary module
c) A post module
d) An encoder
e) A payload
06. getenforce on a server prints Enforcing. A newly deployed reporting service works normally, yet the audit log keeps recording entries such as:
avc: denied { write } for pid=2207 comm="reportd" name="spool" scontext=system_u:system_r:reportd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=1
Other confined services on the host are being blocked by SELinux as expected.
Which explanation fits all of these observations?
a) A dontaudit rule matches the write, so the access is logged but allowed
b) The reportd_t domain is a permissive type, so its denials are only logged
c) A local module built by audit2allow allows the write, so the record is informational
d) The configuration file sets SELINUX=permissive, which takes effect for new services
e) The kernel was booted with enforcing=0, which exempts services started after boot
07. A LUKS1 data volume /dev/sdc1 has passphrases in key slots 0 and 1. A contractor who knew the slot 1 passphrase, and who had root access, has left. The administrator runs cryptsetup luksKillSlot /dev/sdc1 1, and cryptsetup luksDump /dev/sdc1 now shows slot 1 as DISABLED. A luksHeaderBackup file made while the contractor was still employed is then found in a shared directory.
Which statement correctly evaluates the remaining exposure?
a) None remains, because luksKillSlot generated a new volume key and left the backup's slots wrapping a key the data no longer uses
b) Little remains, because luksHeaderRestore refuses a backup whose key slots differ from the header now on the device
c) The backup still holds slot 1 with the unchanged volume key, so the old passphrase can decrypt the data
d) It ends once the slot 0 passphrase is also replaced with cryptsetup luksChangeKey
08. ndpmon has raised alerts about an unexpected router on an IPv6 segment. To corroborate them, the team wants a tcpdump capture that keeps only ICMPv6 router advertisements. Packets on this segment carry no IPv6 extension headers, so the ICMPv6 header starts immediately after the 40-byte IPv6 header.
Which capture filter should the team use?
a) icmp6 and ip6[40] == 133
b) icmp6 and ip6[41] == 134
c) ip6 and udp port 547
d) icmp6 and ip6[40] == 134
e) icmp6 and ip6[40] == 136
09. After identifying the live hosts in scope, a tester interacts directly with their services: querying SMB to list valid user accounts, shares and group memberships, and polling SNMP for device details, in order to build a target list for later access attempts. No vulnerability is exploited and no foothold is gained.
Which phase of a penetration test best describes this activity?
a) Passive information gathering
b) Enumeration
c) Gaining access
d) Privilege escalation
e) Covering tracks
10. Since a key change this morning, validating resolvers return SERVFAIL for every name in example.org, while non-validating resolvers answer normally. The administrator collects:
dig +short example.org DS returns 41522 13 2 6F1C…
example.org. DNSKEY 257 3 13 (…) ; KSK; key id = 50217
example.org. DNSKEY 256 3 13 (…) ; ZSK; key id = 18843
Every RRset in the zone carries an RRSIG made by key 18843, and the DNSKEY RRset carries an RRSIG made by key 50217.
What is the root cause?
a) The parent's DS still names key 41522, which is no longer in the DNSKEY RRset
b) Key 18843 is published with flags 256 rather than 257, so resolvers will not verify signatures with it
c) The zone has no NSEC3PARAM record, so resolvers cannot verify answers for existing names
d) The DNSKEY RRset must be signed by key 18843 as well as by key 50217
e) Algorithm 13 in the DS record does not match the algorithm of the zone's signing keys
Answers:
|
Question: 01 Answer: a, e |
Question: 02 Answer: d |
Question: 03 Answer: b, e |
Question: 04 Answer: d |
Question: 05 Answer: e |
|
Question: 06 Answer: b |
Question: 07 Answer: c |
Question: 08 Answer: d |
Question: 09 Answer: b |
Question: 10 Answer: a |
Note: For any error in LPIC-3 Security (303-300) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
