LPI 102-500 Bundle

It is less specific than SSH private keys must remain secret to preserve authentication assurance, which directly explains the scenario and supports Protect the private key with restrictive permissions and relocate it to authorized storage.

This alternative addresses the separate case “A workstation user types an SSH private-key passphrase repeatedly for several short sessions”. Here, ssh-agent caches unlocked key operations without requiring raw private-key copying to applications. The deciding requirement here is “SSH private keys must remain secret to preserve authentication assurance”.

The related but distinct situation is “A user must authenticate to an SSH host without typing a password for an approved automation task”. The decisive distinction is SSH public-key authentication uses a private client key and authorized server-side public key. For the stated problem, “SSH private keys must remain secret to preserve authentication assurance” addresses the central condition.

This alternative addresses the separate case “A systemd service fails intermittently and an engineer needs logs only for that unit in the current boot”. The safest fitting response is Use journalctl -b -u service-name to filter the systemd journal. For the stated problem, “Use journalctl with an appropriate priority and since/until time filter” addresses the central condition.

This command or configuration addresses a different case: A service needs the current timestamp as ISO text for an audit record. Here, The systemd journal can filter records by severity and timestamps, so the targeted action is Use journalctl with an appropriate priority and since/until time filter.

It fails to address the actual requirement, A security reviewer wants to investigate only error-priority journal entries for yesterday. The needed change is Use journalctl with an appropriate priority and since/until time filter; verify The report contains matching error entries from the requested interval only.

The stated concern is possible elsewhere, but the facts here specifically imply Searching all logs blindly can hide the relevant startup failure in noise.

This option serves the scenario “A security reviewer wants to investigate only error-priority journal entries for yesterday”. The main exposure is An unfiltered dump increases noise and obscures the incident timeline. The present scenario is distinguished by “Searching all logs blindly can hide the relevant startup failure in noise”.

This alternative addresses the separate case “A Linux server must deliver mail addressed to root to an on-call administrator”. The main exposure is Leaving root mail unattended can hide security and job-failure alerts. The deciding requirement here is “Searching all logs blindly can hide the relevant startup failure in noise”.

This option serves the scenario “An application binds to port 8443 but remote users cannot connect and the team blames DNS”. Here, A service listening only on loopback cannot accept connections sent to an external interface. This question instead requires “A TCP socket test validates a specific port rather than only ICMP reachability”.

This alternative addresses the separate case “A monitoring team expects ping to test whether TCP port 22 is accepting SSH connections”. The relevant Linux mechanism is ICMP echo tests network responsiveness but does not establish TCP service reachability. For the stated problem, “A TCP socket test validates a specific port rather than only ICMP reachability” addresses the central condition.

The option would apply to “A Linux host can ping its gateway but cannot reach the Internet because no default route exists”. The governing principle is Traffic for destinations outside connected prefixes requires a selected route. The present scenario is distinguished by “A TCP socket test validates a specific port rather than only ICMP reachability”.

That option does not correct the stated dependency. In this case, Shadow files contain sensitive authentication data and require restricted permissions; implement Check file ownership and mode without displaying or copying password hashes and check An unprivileged read fails and the authorized account database still operates.

This alternative addresses the separate case “A host still exposes Telnet but policy allows only encrypted remote administration”. The appropriate operation is Disable the legacy Telnet service or socket and enforce approved SSH access. The deciding requirement here is “Check file ownership and mode without displaying or copying password hashes”.

The related but distinct situation is “A hardening scan finds an unfamiliar TCP listener on a production Linux host”. The safest fitting response is Correlate ss or netstat listener data with process ownership and approved service inventory. For the stated problem, “Check file ownership and mode without displaying or copying password hashes” addresses the central condition.

A passing result on that unrelated check cannot certify the present correction; require The user signs in using the supported virtual keyboard with their pointing device.

This would test another scenario: A blind operator needs to navigate desktop controls and receive spoken feedback. Here the acceptance evidence is The user signs in using the supported virtual keyboard with their pointing device.

This would test another scenario: A user with tremor repeatedly triggers accidental double keystrokes in a Linux desktop. Here the acceptance evidence is The user signs in using the supported virtual keyboard with their pointing device.

The related but distinct situation is “A user edits /etc/hostname to rename the system but name resolution fails for the new hostname”. The relevant Linux mechanism is Setting the host identity is separate from resolving that name into an address. For the stated problem, “Editing a profile is separate from applying changes to a currently active interface” addresses the central condition.

This option serves the scenario “A new static IPv4 connection created with nmcli disappears after reboot because it was not saved correctly”. The decisive distinction is Runtime interface changes do not automatically define a persistent connection configuration. The present scenario is distinguished by “Editing a profile is separate from applying changes to a currently active interface”.

This alternative addresses the separate case “A user can reach a web service by IP but not by hostname and suspects DNS”. The relevant Linux mechanism is Name resolution is a separate prerequisite from IP reachability. The deciding requirement here is “Editing a profile is separate from applying changes to a currently active interface”.

The related but distinct situation is “A command-line mail client reports queued messages and an administrator needs to inspect them”. Acceptance requires The queue listing identifies the affected message and its delivery state. The deciding requirement here is “The job appears in the intended named queue and not the default printer”.

This option serves the scenario “An administrator needs to see current CUPS printer status, destinations and pending jobs”. Verify that The status output identifies the stopped printer and affected jobs. This question instead requires “The job appears in the intended named queue and not the default printer”.

This alternative addresses the separate case “A CUPS printer queue contains a stuck job and the user needs to cancel just that job”. Verify that The stuck job disappears and unrelated queued jobs remain. For the stated problem, “The job appears in the intended named queue and not the default printer” addresses the central condition.

This would test another scenario: A privileged application starts under an account with UID zero even though policy requires a nonroot service identity. Here the acceptance evidence is id username reports the audit group and all previously authorized groups.

A passing result on that unrelated check cannot certify the present correction; require id username reports the audit group and all previously authorized groups.

The related but distinct situation is “An internationalized application should prefer the locale declared by the operator without forcing every regional category”. Expect locale reports the expected defaults and targeted time or numeric category choices. For the stated problem, “id username reports the audit group and all previously authorized groups” addresses the central condition.

Although that change may be valid elsewhere, it responds to A workstation prints to a central server but the technician assumes local device drivers alone determine the destination, not to this system state. The relevant fix is Reenable the approved printer destination and verify it accepts jobs.

This command or configuration addresses a different case: A service account should not receive diagnostic mail at an unmonitored local mailbox. Here, CUPS queue state controls whether new jobs can be accepted and processed, so the targeted action is Reenable the approved printer destination and verify it accepts jobs.

The related but distinct situation is “A legacy application uses lpr and lpq but the host now uses CUPS”. The appropriate operation is Use CUPS-provided LPD compatibility tools and validate the selected queue. The deciding requirement here is “Reenable the approved printer destination and verify it accepts jobs”.

The required verification is timedatectl and date show the intended offset and a consistent instant, not a result meant for A deployment parser depends on English month names while a server's locale uses translated names.

This option serves the scenario “An hourly job is moved from a user crontab into /etc/crontab and fails to execute”. The best evidence is The entry runs under the intended identity in a controlled test. The present scenario is distinguished by “timedatectl and date show the intended offset and a consistent instant”.

That observation may validate A server's locale must support accented names and a Unicode-based application, but it does not establish that timedatectl and date show the intended offset and a consistent instant for the current case.