Lpi LPIC-3 303-200 Questions & Answers

• Question 21:

  Which command, included in BlND, generates DNSSEC keys? (Specify ONLY the command without any path or parameters.)

  Correct Answer: dnssec-keygen

• Question 22:

  Which of the following practices are important for the security of private keys? (Choose TWO correct answers.)

  A. Private keys should be created on the systems where they will be used and should never leave them.

  B. Private keys should be uploaded to public key servers.

  C. Private keys should be included in X509 certificates.

  D. Private keys should have a sufficient length for the algorithm used for key generation.

  E. Private keys should always be stored as plain text files without any encryption.

  Correct Answer: CD

• Question 23:

  Which of the following information, within a DNSSEC- signed zone, is signed by the key signing key?

  A. The non-DNSSEC records like A, AAAA or MX.

  B. The zone signing key of the zone.

  C. The RRSlG records of the zone.

  D. The NSEC or NSEC3 records of the zone.

  E. The DS records pointing to the zone.

  Correct Answer: B

• Question 24:

  Which of the following configuration options makes Apache HTTPD require a client certificate for authentication?

  A. Limit valid-x509

  B. SSLRequestClientCert always

  C. Require valid-x509

  D. SSLVerifyClient require

  E. SSLPolicy valid-client-cert

  Correct Answer: D

• Question 25:

  Which option in an Apache HTTPD configuration file enables OCSP stapling? (Specify ONLY the option name without any values or parameters.)

  Correct Answer: SSLUseStapling

• Question 26:

  Which of the following statements is true regarding eCryptfs?

  A. For every file in an eCryptfs directory there exists a corresponding file that contains the encrypted content.

  B. The content of all files in an eCryptfs directory is stored in an archive file similar to a tar file with an additional index to improve performance.

  C. After unmounting an eCryptfs directory, the directory hierarchy and the original file names are still visible, although, it is not possible to view the contents of the files.

  D. When a user changes his login password, the contents of his eCryptfs home directory has to be re-encrypted using his new login password.

  E. eCryptfs cannot be used to encrypt only directories that are the home directory of a regular Linux user.

  Correct Answer: E

• Question 27:

  Which of the following lines in an OpenSSL configuration adds an X 5o9v3 Subject Alternative Name extension for the host names example.org and www.example.org to a certificate'?

  A. subjectAltName = DNS: www example.org, DNS:example.org

  B. extension= SAN: www.example.org, SAN:example.org

  C. subjectAltName: www.example.org, subjectAltName: example.org

  D. commonName = subjectAltName= www.example.org, subjectAltName = example.org

  E. subject= CN= www.example.org, CN=example.org

  Correct Answer: A

• Question 28:

  Given that this device has three different keys, which of the following commands deletes only the first key?

  A. cryptsetup luksDelKey/dev/sda 10

  B. cryptsetup luksDelkey /dev/sda 11

  C. cryptsetup luksDelKey/dev /mapper/crypt- vol 1

  D. cryptsetup luksDelKey /dev/mapper/crypt- vol 0

  Correct Answer: A

• Question 29:

  Which of the following statements are true regarding the certificate? (Choose THREE correct answers.)

  A. This certificate belongs to a certification authority.

  B. This certificate may be used to sign certificates of subordinate certification authorities.

  C. This certificate may never be used to sign any other certificates.

  D. This certificate may be used to sign certificates that are not also a certification authority.

  E. This certificate will not be accepted by programs that do not understand the listed extension.

  Correct Answer: ABD

• Question 30:

  Which of the following parameters to openssl s_client specifies the host name to use for TLS Server Name lndication?

  A. -tlsname

  B. -servername

  C. -sniname

  D. -vhost

  E. -host

  Correct Answer: B