Operating System Security

Question 1 of 6

A help desk technician needs to reset a user’s expired password, unlock their account after too many failed login attempts, and add them to the Finance security group. All three actions are performed from a single Windows console. Which technology is being used?

Group Policy Management Editor — the central console for deploying security and configuration settings Active Directory — the centralized Windows directory service that stores user accounts, security groups, and provides the administrative console for identity management tasks SELinux — the security kernel module that manages Linux user access rights and group memberships Local Security Policy — the per-machine console that manages account settings on individual Windows systems

Question 2 of 6

A security administrator needs to enforce the following on all 800 domain-joined Windows workstations simultaneously: passwords must be at least 14 characters, screens must lock after 5 minutes of inactivity, and USB mass storage must be disabled. What is the MOST efficient way to implement all three requirements?

Configure these settings in Active Directory user attributes, which automatically push security parameters to all workstations at next login Install SELinux on all Windows workstations to enforce kernel-level access control policies including USB and password rules Configure a Group Policy Object with password policy, screen lock timeout, and USB storage restriction settings, and link it to the domain or relevant OU — all 800 machines receive and enforce it automatically Log in to each workstation individually and apply the settings through the Local Security Policy console on each machine

Question 3 of 6

Traditional Linux uses Discretionary Access Control (DAC). A web server process running under a dedicated service account is compromised through a remote code execution vulnerability. Under DAC, what access does the attacker now have?

No access beyond the web root directory — DAC automatically confines web server processes to their designated directories Access to any resource the web server’s service account owns or has been granted permission to — because DAC lets the owner grant permissions freely, and a compromised process runs with those inherited permissions Read-only access to the entire file system — DAC prevents write operations from service accounts by default No access at all — DAC requires explicit owner approval for each access attempt, which the attacker cannot obtain

Question 4 of 6

A web server process on a Linux system is fully compromised through an application vulnerability. The attacker attempts to read /etc/shadow and open an outbound connection to an external IP on port 4444. Both attempts are silently blocked by the operating system. The server’s Linux DAC file permissions would have allowed both actions. Which security feature is responsible?

Group Policy — blocking outbound connections from the web server using Windows firewall rules Active Directory — denying the web server’s service account access to system files through centralized permission management SELinux — the web server process’s MAC security policy does not permit access to the password file label or outbound connections on that port, so the kernel denies both despite DAC permissions allowing them The Linux firewall (iptables) — blocking all outbound connections from web server processes by default

Question 5 of 6

A security architect is designing a high-security Linux environment for a government agency. The requirement states that all access control decisions must be enforced by a central administrator and that no user — including file owners — should be able to grant permissions beyond what the security policy allows. Which access control model and technology satisfy this requirement?

Discretionary Access Control using Linux file permissions — flexible enough for government requirements when combined with strong password policies Mandatory Access Control via SELinux — a central administrator defines MAC policies that are enforced by the kernel; users and processes cannot override them regardless of file ownership Group Policy applied to Linux systems — centrally pushes security configuration settings that users cannot change locally Active Directory on Linux via LDAP — centralizes authentication and enforces access control through group memberships that users cannot modify themselves

Question 6 of 6

An organization uses Active Directory and Group Policy together. Which statement BEST describes the correct role of each technology?

Active Directory deploys security configuration settings to workstations; Group Policy stores user account information and handles authentication Active Directory is the centralized identity and resource database (user accounts, computers, groups); Group Policy uses Active Directory as its infrastructure to distribute and enforce configuration and security settings to domain-joined devices and users Active Directory and Group Policy are independent technologies; Group Policy does not require Active Directory and operates the same way without it Group Policy manages user authentication; Active Directory enforces password complexity and account lockout policies on each workstation

Matching

Match each description to the correct operating system security technology or concept.

1. A centralized Windows directory service that stores user accounts, computer objects, security groups, and network resources; provides unified authentication and access control across the domain; used by the help desk for password resets, account creation, and group membership changes

2. A Windows feature managed from a central console that deploys hundreds of security and configuration settings — password policies, screen lock timeouts, USB restrictions, login scripts — to all domain-joined computers and users automatically

3. Open-source Linux kernel security patches that add mandatory access control, confining each process to only the resources its security policy permits and limiting the impact of compromised applications; included in RHEL, CentOS, and Fedora by default

4. The default Linux access model in which resource owners control who can access their files; flexible but can allow compromised users or processes to expose any resource the owner has permission to access

1. 2. 3. 4.

A. Active Directory

B. Group Policy

C. SELinux

D. Discretionary Access Control (DAC)

Operating System Security — Quiz

Matching