Using its standard configuration, how does fail2ban block offending SSH clients?
Correct Answer: C
Explanation Fail2ban is a tool that monitors the system logs for failed login attempts and blocks the offending IP addresses using netfilter rules. Netfilter is a framework that provides packet filtering, network address translation, and other functions for the Linux kernel. Fail2ban uses the iptables command to manipulate the netfilter rules and create chains of rules that match the source IP address of the attacker and drop or reject the packets from that IP address. Fail2ban can also use other firewall tools, such as firewalld or ufw, to create the netfilter rules. Fail2ban can block the IP addresses for a specified amount of time, or permanently, depending on the configuration. Fail2ban can protect various services, such as SSH, HTTP, FTP, etc., by creating different jails for each service. A jail is a set of parameters that define how to monitor a log file, how to detect a failed login attempt, how to ban an IP address, and how long to keep the ban. Fail2ban does not block offending SSH clients by any of the other options. It does not act as a proxy in front of SSHD, nor does it modify the SSHD configuration. It does not create null routes that drop any answer packets sent to the client, nor does it modify the TCP Wrapper configuration for SSHD. References: How To Protect SSH with Fail2Ban on Ubuntu 20.04 How To Prevent SSH Brute Force Attacks Using Fail2ban In Linux Fail2ban - Wikipedia Fail2ban Manual
Question 42
Which attitude of an object in LDAP defines which other attributes can be set for the object? (Specify ONLY the attribute name without any values.)
Correct Answer:
class
Question 43
Which of the statements below are correct regarding the following commands, which are executed on a Linux router? (Choose two.)
Correct Answer: A,D
Explanation The two commands shown in the image are used to drop packets with source or destination addresses from fe80::/64 in the FORWARD chain. The first command drops packets with source addresses from fe80::/64, while the second command drops packets with destination addresses from fe80::/64. Both commands will complete without an error message or warning because the affected network is not already part of another rule. The other statements are incorrect for the following reasons: B). The rules disable packet forwarding because network nodes always use addresses from fe80::/64 to identify routers in their routing tables. This is false because network nodes do not use link-local addresses to identify routers in their routing tables. Instead, they use global or unique local addresses that are advertised by routers through router advertisements or DHCPv6. C). ip6tables returns an error for the second command because the affected network is already part of another rule. This is false because there is no indication that the affected network is already part of another rule. Even if it was, ip6tables would not return an error, but rather append the new rule to the existing ones, unless the -I option was used to insert the new rule at a specific position. E). The rules suppress any automatic configuration through router advertisements or DHCPv6. This is false because the rules only affect the FORWARD chain, which is used to process packets that are routed through the router. The rules do not affect the INPUT or OUTPUT chains, which are used to process packets that are destined for or originated from the router. Therefore, the rules do not interfere with the router's ability to send or receive router advertisements or DHCPv6 messages. References: LPIC-2 202 exam objectives, LPIC-2 202-450 Exam Prep: Network Configuration, IPv6 Firewalling with ip6tables, IPv6 Addressing and Basic Connectivity
Question 44
The content of which local file has to be transmitted to a remote SSH server in order to be able to log into the remote server using SSH keys?
Correct Answer: C
Question 45
Select the Samba option below that should be used if the main intention is to setup a guest printer service?
Correct Answer: D
Explanation The security option in the smb.conf file determines how Samba authenticates users who try to access its shares. The value of security = share means that Samba does not require a valid username and password for each connection, but only for each share. This allows users to access shares anonymously, without providing any credentials. This is useful for setting up a guest printer service, where anyone can print to a shared printer without logging in. However, this option is deprecated and not recommended for security reasons. The other options are either invalid or irrelevant for this question.
