Pass Your LPI 102-500 Exam Easy!

This explains another Linux operation, namely Use the shadow password database with correct restrictive permissions on /etc/shadow., where Shadow passwords separate sensitive hashes from the account metadata in /etc/passwd, reducing exposure to unprivileged readers. It does not explain why Inspect the paired .socket unit and disable or stop it if that entry point is not authorized. satisfies the stated condition.

This explains another Linux operation, namely Disable that service entry in its /etc/xinetd.d/ configuration and reload xinetd where applicable., where xinetd manages individually configured on-demand network services and can disable one without deleting all service definitions. It does not explain why Inspect the paired .socket unit and disable or stop it if that entry point is not authorized. satisfies the stated condition.

This explains another Linux operation, namely Maintain an approved service baseline and compare current ss -lnt output to it., where A listener inventory reveals unexpected exposed sockets; the service status command alone does not list every bound port. It does not explain why Inspect the paired .socket unit and disable or stop it if that entry point is not authorized. satisfies the stated condition.

That observation checks An administrator wants to stop new non-root logins briefly while completing emergency maintenance. In this scenario it does not demonstrate Inspect the paired .socket unit and disable or stop it if that entry point is not authorized.; the relevant evidence must establish The socket listener disappears and the daemon no longer auto-activates on a test connection.

That observation checks A server must store user password hashes separately from generally readable account information. In this scenario it does not demonstrate Inspect the paired .socket unit and disable or stop it if that entry point is not authorized.; the relevant evidence must establish The socket listener disappears and the daemon no longer auto-activates on a test connection.

That observation checks An unused background service accepts remote connections although the business no longer needs it. In this scenario it does not demonstrate Inspect the paired .socket unit and disable or stop it if that entry point is not authorized.; the relevant evidence must establish The socket listener disappears and the daemon no longer auto-activates on a test connection.

That symptom concerns A server must store user password hashes separately from generally readable account information. This concerns a separate requirement, not the one being tested. The relevant failure is The daemon restarts whenever traffic arrives despite repeated systemctl stop service commands. The current requirement calls for a different check.

That symptom concerns A legacy inetd/xinetd-supervised service must be disabled without stopping unrelated services. This concerns a separate requirement, not the one being tested. The relevant failure is The daemon restarts whenever traffic arrives despite repeated systemctl stop service commands. The current requirement calls for a different check.

That symptom concerns An administrator wants to stop new non-root logins briefly while completing emergency maintenance. This concerns a separate requirement, not the one being tested. The relevant failure is The daemon restarts whenever traffic arrives despite repeated systemctl stop service commands. The current requirement calls for a different check.

This fix is aimed at The service is stopped but a still-active socket unit relaunches it on the next connection. and would be relevant if An unused background service accepts remote connections although the business no longer needs it. The incident instead states The daemon restarts whenever traffic arrives despite repeated systemctl stop service commands. and needs Disable the active socket unit as well as the service where policy requires no activation.

This fix is aimed at The service remains enabled in xinetd even though an unrelated systemd service was stopped. and would be relevant if A legacy inetd/xinetd-supervised service must be disabled without stopping unrelated services. The incident instead states The daemon restarts whenever traffic arrives despite repeated systemctl stop service commands. and needs Disable the active socket unit as well as the service where policy requires no activation.

This fix is aimed at Password hashes are copied into a world-readable inventory file. and would be relevant if A server must store user password hashes separately from generally readable account information. The incident instead states The daemon restarts whenever traffic arrives despite repeated systemctl stop service commands. and needs Disable the active socket unit as well as the service where policy requires no activation.

Create a detached GnuPG signature with gpg --detach-sign document and distribute the signature for verification. That operation is designed for the different case: An operator needs to send a signed file that proves who authored it without encrypting the contents. It does not perform the specific action required here: Create an SSH key pair and install the public key in the target user's ~/.ssh/authorized_keys.

Publish the previously prepared or newly generated GnuPG revocation certificate to relevant key channels. That operation is designed for the different case: A security operator must revoke a GnuPG key that has been compromised so collaborators stop trusting it. It does not perform the specific action required here: Create an SSH key pair and install the public key in the target user's ~/.ssh/authorized_keys.

Run gpg --encrypt --recipient recipient@example report after validating the recipient's public key. That operation is designed for the different case: A team must encrypt a report so only the intended recipient's private key can decrypt it. It does not perform the specific action required here: Create an SSH key pair and install the public key in the target user's ~/.ssh/authorized_keys.

This explains another Linux operation, namely Use ssh -X or -Y only where trust and policy justify the X11 forwarding mode., where SSH X11 forwarding transports X11 display traffic over the SSH channel instead of granting open network X access. It does not explain why Create an SSH key pair and install the public key in the target user's ~/.ssh/authorized_keys. satisfies the stated condition.

This explains another Linux operation, namely Independently verify the new host-key fingerprint before replacing the stored known_hosts entry., where SSH host-key checking detects possible impersonation; a legitimate rebuild still requires out-of-band key confirmation. It does not explain why Create an SSH key pair and install the public key in the target user's ~/.ssh/authorized_keys. satisfies the stated condition.

This explains another Linux operation, namely Start or use ssh-agent and load the key with ssh-add., where ssh-agent holds unlocked private-key operations in a process for authorized session use rather than editing the key to remove its passphrase. It does not explain why Create an SSH key pair and install the public key in the target user's ~/.ssh/authorized_keys. satisfies the stated condition.

That observation checks A user needs to forward X11 application display traffic securely over an authenticated SSH session. In this scenario it does not demonstrate Create an SSH key pair and install the public key in the target user's ~/.ssh/authorized_keys.; the relevant evidence must establish SSH login succeeds using the intended key and does not require password authentication for the test account.

That observation checks A desktop user wants an SSH passphrase-protected private key cached for a session without saving the passphrase in clear text. In this scenario it does not demonstrate Create an SSH key pair and install the public key in the target user's ~/.ssh/authorized_keys.; the relevant evidence must establish SSH login succeeds using the intended key and does not require password authentication for the test account.

That observation checks A team must encrypt a report so only the intended recipient's private key can decrypt it. In this scenario it does not demonstrate Create an SSH key pair and install the public key in the target user's ~/.ssh/authorized_keys.; the relevant evidence must establish SSH login succeeds using the intended key and does not require password authentication for the test account.

This fix is aimed at The user disables StrictHostKeyChecking permanently to bypass all mismatch warnings. and would be relevant if A client sees a changed SSH host-key fingerprint after a server rebuild and must not silently trust it. The incident instead states The private key is copied to the server's authorized_keys file instead of its public half. and needs Store the public key on the server and keep the private key protected on the client.

This fix is aimed at The team encrypts the file but provides no signature or trustworthy signer identity. and would be relevant if An operator needs to send a signed file that proves who authored it without encrypting the contents. The incident instead states The private key is copied to the server's authorized_keys file instead of its public half. and needs Store the public key on the server and keep the private key protected on the client.

This fix is aimed at The operator disables X access control globally with xhost + to permit remote graphics. and would be relevant if A user needs to forward X11 application display traffic securely over an authenticated SSH session. The incident instead states The private key is copied to the server's authorized_keys file instead of its public half. and needs Store the public key on the server and keep the private key protected on the client.

Use ssh -L localport:targethost:targetport user@jump-host with correct endpoint reachability. That operation is designed for the different case: An administrator must securely forward a local TCP service through an SSH connection without exposing the service publicly. It does not perform the specific action required here: Generate or verify the server's SSH host key material and protect the private host key file.

Independently verify the new host-key fingerprint before replacing the stored known_hosts entry. That operation is designed for the different case: A client sees a changed SSH host-key fingerprint after a server rebuild and must not silently trust it. It does not perform the specific action required here: Generate or verify the server's SSH host key material and protect the private host key file.

Publish the previously prepared or newly generated GnuPG revocation certificate to relevant key channels. That operation is designed for the different case: A security operator must revoke a GnuPG key that has been compromised so collaborators stop trusting it. It does not perform the specific action required here: Generate or verify the server's SSH host key material and protect the private host key file.

This explains another Linux operation, namely Create an SSH key pair and install the public key in the target user's ~/.ssh/authorized_keys., where The SSH client proves possession of the private key while the server checks the authorized public key. It does not explain why Generate or verify the server's SSH host key material and protect the private host key file. satisfies the stated condition.

This explains another Linux operation, namely Run gpg --verify signature.sig downloaded-file with the signer public key properly imported., where Verification checks signature integrity and the key identity; a successful cryptographic check alone does not guarantee the public key belongs to the claimed sender. It does not explain why Generate or verify the server's SSH host key material and protect the private host key file. satisfies the stated condition.

This explains another Linux operation, namely Use ssh -X or -Y only where trust and policy justify the X11 forwarding mode., where SSH X11 forwarding transports X11 display traffic over the SSH channel instead of granting open network X access. It does not explain why Generate or verify the server's SSH host key material and protect the private host key file. satisfies the stated condition.

That observation checks An operator needs to send a signed file that proves who authored it without encrypting the contents. In this scenario it does not demonstrate Generate or verify the server's SSH host key material and protect the private host key file.; the relevant evidence must establish A trusted client accepts the known host public-key fingerprint and detects a changed fingerprint.

That observation checks A desktop user wants an SSH passphrase-protected private key cached for a session without saving the passphrase in clear text. In this scenario it does not demonstrate Generate or verify the server's SSH host key material and protect the private host key file.; the relevant evidence must establish A trusted client accepts the known host public-key fingerprint and detects a changed fingerprint.

That observation checks An administrator must use SSH public-key authentication to log into a host without sending a reusable password. In this scenario it does not demonstrate Generate or verify the server's SSH host key material and protect the private host key file.; the relevant evidence must establish A trusted client accepts the known host public-key fingerprint and detects a changed fingerprint.