Pass Your LPI 102-500 Exam Easy!

This explains another Linux operation, namely Define a narrowly scoped sudoers rule with visudo and use sudo for authorized commands., where sudo can delegate specific commands with auditing rather than requiring shared direct-root credentials. It does not explain why Apply an appropriate ulimit -u or enforced PAM limits policy for process count. satisfies the stated condition.

This explains another Linux operation, namely Run ss -lntp or a suitable privileged lsof -i query to map sockets to processes., where Socket inspection associates a bound listener with its PID/executable; discovering the port alone does not identify its owner. It does not explain why Apply an appropriate ulimit -u or enforced PAM limits policy for process count. satisfies the stated condition.

This explains another Linux operation, namely Use last with suitable time filtering to examine historical login records., where last reads the login history database, unlike who which reports active sessions. It does not explain why Apply an appropriate ulimit -u or enforced PAM limits policy for process count. satisfies the stated condition.

That observation checks An account's password must expire after a defined number of days with advance warning. In this scenario it does not demonstrate Apply an appropriate ulimit -u or enforced PAM limits policy for process count.; the relevant evidence must establish The configured test session is blocked from spawning processes beyond its defined limit.

That observation checks A privileged command should be granted to a named role without distributing the root password. In this scenario it does not demonstrate Apply an appropriate ulimit -u or enforced PAM limits policy for process count.; the relevant evidence must establish The configured test session is blocked from spawning processes beyond its defined limit.

That observation checks A security engineer must see which process currently owns an unexpected listening network port. In this scenario it does not demonstrate Apply an appropriate ulimit -u or enforced PAM limits policy for process count.; the relevant evidence must establish The configured test session is blocked from spawning processes beyond its defined limit.

That symptom concerns A security engineer must see which process currently owns an unexpected listening network port. This concerns a separate requirement, not the one being tested. The relevant failure is The team edits a log-rotation setting but the user can still spawn unlimited processes. The current requirement calls for a different check.

That symptom concerns An administrator must review who logged into a host during the previous weekend, not just who is online now. This concerns a separate requirement, not the one being tested. The relevant failure is The team edits a log-rotation setting but the user can still spawn unlimited processes. The current requirement calls for a different check.

That symptom concerns A Linux admin wants to list currently logged-in users including their remote terminal origins. This concerns a separate requirement, not the one being tested. The relevant failure is The team edits a log-rotation setting but the user can still spawn unlimited processes. The current requirement calls for a different check.

This fix is aimed at who shows no active users so the administrator incorrectly concludes no one accessed the host. and would be relevant if An administrator must review who logged into a host during the previous weekend, not just who is online now. The incident instead states The team edits a log-rotation setting but the user can still spawn unlimited processes. and needs Apply a real process-resource limit in the relevant shell or PAM limit configuration.

This fix is aimed at The user password never expires because only a login banner warning was configured. and would be relevant if An account's password must expire after a defined number of days with advance warning. The incident instead states The team edits a log-rotation setting but the user can still spawn unlimited processes. and needs Apply a real process-resource limit in the relevant shell or PAM limit configuration.

This fix is aimed at All administrators share the root password because no delegated command rule exists. and would be relevant if A privileged command should be granted to a named role without distributing the root password. The incident instead states The team edits a log-rotation setting but the user can still spawn unlimited processes. and needs Apply a real process-resource limit in the relevant shell or PAM limit configuration.

Run a scoped find command such as find /usr -xdev -type f -perm -4000 with appropriate privileges. That operation is designed for the different case: A security auditor must identify files carrying the set-user-ID permission bit on local filesystems. It does not perform the specific action required here: Use last with suitable time filtering to examine historical login records.

Run who or w to inspect current login sessions. That operation is designed for the different case: A Linux admin wants to list currently logged-in users including their remote terminal origins. It does not perform the specific action required here: Use last with suitable time filtering to examine historical login records.

Apply an appropriate ulimit -u or enforced PAM limits policy for process count. That operation is designed for the different case: A team must impose a per-shell process limit on a Linux user to reduce accidental fork storms. It does not perform the specific action required here: Use last with suitable time filtering to examine historical login records.

This explains another Linux operation, namely Run who or w to inspect current login sessions., where who and w read session accounting to show connected users and terminals; last summarizes historical logins instead. It does not explain why Use last with suitable time filtering to examine historical login records. satisfies the stated condition.

This explains another Linux operation, namely Define a narrowly scoped sudoers rule with visudo and use sudo for authorized commands., where sudo can delegate specific commands with auditing rather than requiring shared direct-root credentials. It does not explain why Use last with suitable time filtering to examine historical login records. satisfies the stated condition.

This explains another Linux operation, namely Run ss -lntp or a suitable privileged lsof -i query to map sockets to processes., where Socket inspection associates a bound listener with its PID/executable; discovering the port alone does not identify its owner. It does not explain why Use last with suitable time filtering to examine historical login records. satisfies the stated condition.

That observation checks A privileged command should be granted to a named role without distributing the root password. In this scenario it does not demonstrate Use last with suitable time filtering to examine historical login records.; the relevant evidence must establish The audit lists completed sessions and times from the requested historical period.

That observation checks A Linux admin wants to list currently logged-in users including their remote terminal origins. In this scenario it does not demonstrate Use last with suitable time filtering to examine historical login records.; the relevant evidence must establish The audit lists completed sessions and times from the requested historical period.

That observation checks An account's password must expire after a defined number of days with advance warning. In this scenario it does not demonstrate Use last with suitable time filtering to examine historical login records.; the relevant evidence must establish The audit lists completed sessions and times from the requested historical period.

That symptom concerns A team must impose a per-shell process limit on a Linux user to reduce accidental fork storms. This concerns a separate requirement, not the one being tested. The relevant failure is who shows no active users so the administrator incorrectly concludes no one accessed the host. The current requirement calls for a different check.

That symptom concerns A Linux admin wants to list currently logged-in users including their remote terminal origins. This concerns a separate requirement, not the one being tested. The relevant failure is who shows no active users so the administrator incorrectly concludes no one accessed the host. The current requirement calls for a different check.

That symptom concerns A security auditor must identify files carrying the set-user-ID permission bit on local filesystems. This concerns a separate requirement, not the one being tested. The relevant failure is who shows no active users so the administrator incorrectly concludes no one accessed the host. The current requirement calls for a different check.

This fix is aimed at The operator searches only for world-writable files and overlooks unexpected setuid executables. and would be relevant if A security auditor must identify files carrying the set-user-ID permission bit on local filesystems. The incident instead states who shows no active users so the administrator incorrectly concludes no one accessed the host. and needs Query prior session history with last and correlate with preserved authentication logs.

This fix is aimed at A network port scan detects the port but the responder never identifies the local service. and would be relevant if A security engineer must see which process currently owns an unexpected listening network port. The incident instead states who shows no active users so the administrator incorrectly concludes no one accessed the host. and needs Query prior session history with last and correlate with preserved authentication logs.

This fix is aimed at All administrators share the root password because no delegated command rule exists. and would be relevant if A privileged command should be granted to a named role without distributing the root password. The incident instead states who shows no active users so the administrator incorrectly concludes no one accessed the host. and needs Query prior session history with last and correlate with preserved authentication logs.

Configure host-based allow/deny rules in /etc/hosts.allow and /etc/hosts.deny for an actually wrapper-aware daemon. That operation is designed for the different case: A legacy service uses TCP wrappers and the team must restrict which client subnets may access it. It does not perform the specific action required here: Use the shadow password database with correct restrictive permissions on /etc/shadow.

Inspect the paired .socket unit and disable or stop it if that entry point is not authorized. That operation is designed for the different case: A systemd socket-activated daemon unexpectedly starts even though its service unit is disabled. It does not perform the specific action required here: Use the shadow password database with correct restrictive permissions on /etc/shadow.

Maintain an approved service baseline and compare current ss -lnt output to it. That operation is designed for the different case: An operations team needs to detect unauthorized new listening services after routine package updates. It does not perform the specific action required here: Use the shadow password database with correct restrictive permissions on /etc/shadow.

This explains another Linux operation, namely Inspect the paired .socket unit and disable or stop it if that entry point is not authorized., where Socket units can listen independently and trigger services on demand; disabling only the service may not close the socket. It does not explain why Use the shadow password database with correct restrictive permissions on /etc/shadow. satisfies the stated condition.

This explains another Linux operation, namely Create an appropriate /etc/nologin notice where supported and ensure policy checks it., where login-aware services can refuse ordinary logins while allowing privileged maintenance when the nologin marker is honored. It does not explain why Use the shadow password database with correct restrictive permissions on /etc/shadow. satisfies the stated condition.

This explains another Linux operation, namely Disable that service entry in its /etc/xinetd.d/ configuration and reload xinetd where applicable., where xinetd manages individually configured on-demand network services and can disable one without deleting all service definitions. It does not explain why Use the shadow password database with correct restrictive permissions on /etc/shadow. satisfies the stated condition.