Free Practice Questions for LPI 202-450 Exam

 To log into a remote SSH server using SSH keys, the client needs to generate a public and private key pair using the ssh-keygen utility. The private key (~/.ssh/id_rsa) should be kept secret and protected by a passphrase, while the public key (~/.ssh/id_rsa.pub) should be copied to the remote server’s authorized_keys file (~/.ssh/authorized_keys) using the ssh-copy-id utility or manually. The authorized_keys file contains the public keys of the clients that are allowed to log into the server using SSH keys. The client can then use the ssh command with the -i option to specify the private key file to authenticate to the server without entering a password. References:

LPIC-2 Exam 202 Objectives, Topic 212: System Security, 212.3 Secure shell (SSH) (weight: 4)

How To Configure SSH Key-Based Authentication on a Linux Server

How To Configure SSH Key-Based Authentication on a Linux Server

The commands nc and telnet can be used to connect and interact with remote TCP network services. nc stands for netcat, a utility that can read and write data across network connections using TCP or UDP protocols. telnet is a client-server protocol that allows a user to communicate with a remote host using a virtual terminal. Both commands can be used to test the connectivity and functionality of network services such as web servers, mail servers, FTP servers, etc. by specifying the host name or IP address and the port number of the service. References:

LPIC-2 exam 201 topics, section 205.1, “Use and configure network monitoring tools”.

LPIC-2 exam 202 topics, section 208.1, “Implementing a web server”.

Linux Essentials 010 exam objectives, section 4.3, “Basic network configuration and troubleshooting”.

 The Alias and Redirect directives in Apache HTTPD’s configuration file have different purposes and effects. The Alias directive maps a URL path to a file system path, allowing the server to serve content that is not under the DocumentRoot. The Redirect directive instructs the client to make a new request with a different URL, which can be used to redirect requests to another server or location. The Redirect directive can use either a fixed URL or a regular expression to match and replace the original URL.

The difference between Alias and Redirect is that Alias is handled on the server side, meaning that the client does not see the file system path that the server uses to serve the content. The Redirect directive is handled on the client side, meaning that the client sees the new URL that the server sends back as a response. The client then makes a new request with the new URL, which may or may not be handled by the same server.

Therefore, the correct statements are C and D. Statement A is false because Alias can reference files outside of the DocumentRoot. Statement B is false because RedirectMatch is the directive that works with regular expressions, not Redirect. Statement E is false because Alias is a valid configuration directive.

References:

mod_alias - Apache HTTP Server Version 2.4

How to Redirect a Web Page with Apache - W3docs

 Reverse DNS queries are used to find the domain name associated with an IP address. To perform reverse DNS queries, DNS servers use a special type of record called PTR (pointer) record. A PTR record maps an IP address to a hostname in the reverse lookup zone. For example, a PTR record for the IP address 185.230.63.186 would point to the hostname unalocated.63.wixsite.com. Reverse DNS queries are useful for validating email servers, troubleshooting network problems, and identifying malicious hosts. References:

2 Ways to Perform Reverse DNS lookups in Linux - howtouselinux

Linux managing DNS servers (LPIC-2) · GitHub

LPI Linux Certification/LPIC2 Exam 202/DNS - Wikibooks

When using a web server certificate that is signed by an intermediate certification authority, the web server must also send the intermediate certificate to the client browser, so that the browser can verify the whole chain of trust. To do this, the web server must have both the web server certificate and the intermediate certificate in one file, which is specified in the SSLCertificateFile directive of Apache HTTPD. This way, the web server can send both certificates to the client in one response. The order of the certificates in the file is important: the web server certificate must come first, followed by the intermediate certificate. The file can be created by concatenating the two certificates with a text editor or the cat command. References:

LPIC-2 202 exam objectives, topic 218.1: Implementing HTTPS

Apache HTTPD documentation, section: SSLCertificateFile Directive

How to install an Intermediate SSL Certificate on Apache

 In the context of configuring Nginx for reverse proxy, the proxy_pass directive is used to specify the protocol and address of a proxied server and an optional URI to which a location should be mapped. So, in the provided configuration sample, “proxy_pass” is the missing keyword that should precede “http://proxiedserver:8080;”.

References:

[NGINX Docs | NGINX Reverse Proxy]: The official documentation of Nginx on how to set up a reverse proxy with Nginx.

[How To Configure Nginx as a Web Server and Reverse Proxy for Apache on One Ubuntu 20.04 Server | DigitalOcean]: A tutorial from DigitalOcean on how to configure Nginx as a web server and reverse proxy for Apache on Ubuntu 20.04, which includes the use of the proxy_pass directive.

The sshd configuration file is used to customize the behavior of the SSH server daemon. Some of the lines in the file can affect the security of the server and should be modified accordingly. The following are two examples of such lines:

Protocol 2, 1: This line specifies the SSH protocol versions that are supported by the server. The possible values are 1 and 2, where 1 is the older and less secure version and 2 is the newer and more secure version. The recommended value is 2, as it provides stronger encryption, authentication, and integrity mechanisms. Allowing protocol 1 can expose the server to various attacks, such as man-in-the-middle, replay, and insertion attacks. Therefore, this line should be changed to Protocol 2 or commented out (as protocol 2 is the default value).

PermitRootLogin yes: This line determines whether root login is allowed on the server. The possible values are yes, no, prohibit-password, and without-password. The value yes allows root login with any authentication method, including password. This can pose a serious security risk, as root is the most privileged user on the system and can perform any action. If an attacker manages to guess or obtain the root password, they can gain full control over the server. Therefore, this line should be changed to no or prohibit-password (which allows root login only with public key authentication) or commented out (as no is the default value).

References: LPIC-2 202 exam objectives, LPIC-2 202-450 Exam Prep: Network Configuration, The Best Ways to Secure Your SSH Server, Configure the /etc/ssh/sshd_config file

Linux SSH Server (sshd) Configuration and Security Options With ...1

The Best Ways to Secure Your SSH Server - How-To Geek

DANE stands for DNS-based Authentication of Named Entities. It is a protocol that provides a way to verify the association of X 509 certificates to DNS host names. X 509 certificates are digital documents that contain the public key and identity information of an entity, such as a web server or an email server. They are used to establish secure connections and authenticate the identity of the entity. However, the traditional way of obtaining and validating X 509 certificates relies on a hierarchical system of trusted third parties, called certificate authorities (CAs), which can be vulnerable to attacks or compromise. DANE aims to enhance the security and trust of X 509 certificates by using DNSSEC, which is a set of extensions to DNS that provide cryptographic signatures and validation for DNS records. DANE allows the owner of a domain name to publish the X 509 certificate or its fingerprint in a DNS record, called a TLSA record, which can be verified by the DNSSEC chain of trust. This way, the client can check the authenticity of the certificate directly from the DNS, without relying on external CAs. DANE can also be used to specify which CAs are authorized to issue certificates for a domain name, or to indicate that no CA is needed at all. DANE can be applied to various protocols that use X 509 certificates, such as HTTPS, SMTP, IMAP, POP3, etc.

References:

DANE - Wikipedia

DNS-Based Authentication of Named Entities (DANE) - Internet Society

DANE: Taking TLS Authentication to the Next Level Using DNSSEC

The listen directive in a Nginx server configuration block defines the TCP ports on which the virtual host will be available, and which protocols it will use. The listen directive takes one or more parameters, such as the port number, the IP address, and the protocol name. For example, the following directive tells Nginx to listen for HTTP requests on port 80 on all network interfaces:

listen 80;

The following directive tells Nginx to listen for HTTPS requests on port 443 on the 192.0.2.1 IP address:

listen 192.0.2.1:443 ssl;

The following directive tells Nginx to listen for both TCP and UDP traffic on port 53 on the 192.0.2.2 IP address:

listen 192.0.2.2:53 udp tcp;

The listen directive can also take some options, such as default_server, which specifies that the server block should act as the default server for the given port, or backlog, which sets the maximum number of pending connections for the socket.

References:

Server Block Examples | NGINX

NGINX Docs | Configuring HTTP Servers

Which directive in a Nginx server configuration block defines the TCP ports on which the virtual host will be available, and which protocols it will use?

 The BIND option that should be used to limit the IP addresses from which slave name servers may connect is allow-transfer. This option specifies a list of IP addresses or networks that are allowed to request zone transfers from the master name server. Zone transfers are the mechanism by which slave name servers obtain a copy of the zone data from the master name server. By limiting the IP addresses that can request zone transfers, the master name server can prevent unauthorized access to the zone data and reduce the network load123 References:

LPIC-2 Overview

LPIC-2 202-450

BIND 9 Administrator Reference Manual