Linux Security Basics: Firewalls, iptables u0026 SELinux Quiz Quiz

Explore fundamental concepts of Linux security with focused questions on firewalls, iptables rules, and SELinux features. This quiz is designed to help reinforce your understanding of key mechanisms for protecting Linux systems against threats through access control and traffic management.

1. iptables Default Policy

   In the context of a Linux firewall using iptables, what happens if the default INPUT chain policy is set to DROP and no explicit rules exist for incoming traffic?

   1. All incoming packets are blocked by default.
   2. All incoming packets are accepted unless specified.
   3. Incoming traffic is routed to the OUTPUT chain.
   4. Only outgoing packets are blocked.

   Explanation: When the default INPUT chain policy is set to DROP, all incoming packets are blocked unless a specific rule allows them. Setting the policy to ACCEPT would permit all traffic except that which is explicitly denied, so option two is incorrect. The OUTPUT chain handles outgoing, not incoming, traffic—making the third and fourth options inaccurate. Understanding default policies is critical for a secure firewall configuration.

2. SELinux Modes

   Which SELinux mode allows all actions but logs any operations that would have been denied if enforcement were enabled?

   1. Disabled
   2. Permissive
   3. Enforcing
   4. Monitoring

   Explanation: SELinux in permissive mode does not enforce security policies but logs violations for review, which helps in troubleshooting and policy development. The enforcing mode actively blocks and logs forbidden actions, making it unsuitable here. Disabled mode turns off SELinux entirely, removing both enforcement and logging. Monitoring is not a recognized SELinux mode.

3. iptables Rule Example

   Given the rule 'iptables -A INPUT -p tcp --dport 22 -j ACCEPT', what is its effect on the firewall policy?

   1. It allows inbound SSH (port 22) traffic.
   2. It blocks inbound SSH traffic.
   3. It denies all inbound traffic except SSH.
   4. It allows all outbound SSH traffic.

   Explanation: The given rule permits incoming traffic on TCP port 22, which is typically used for SSH connections. It does not deny any other traffic, so the second option is incorrect. The rule affects inbound, not outbound, connections—invalidating the third choice. The last option is the exact opposite of the rule's function.

4. SELinux Contexts

   Why is it important to correctly label files with their appropriate SELinux context on a Linux server running sensitive web applications?

   1. It prevents the files from running at all.
   2. It ensures SELinux applies the correct access controls to the files.
   3. It compresses the files to save storage.
   4. It hides the files from user processes.

   Explanation: Proper file labeling enables SELinux to apply the intended security policies and restrict unauthorized access, which is vital for protecting sensitive applications and data. SELinux labeling does not hide or compress files, and it does not inherently prevent execution unless rules specify so. The other options do not reflect how SELinux contexts operate.

5. Stateless vs. Stateful Firewalls

   Compared to stateless firewalls, why are stateful firewalls generally considered more secure for Linux servers?

   1. They track active connections and can allow established sessions.
   2. They only filter based on source IP addresses.
   3. They ignore the state of network connections.
   4. They rely exclusively on destination ports.

   Explanation: Stateful firewalls maintain awareness of active connections, allowing them to distinguish between legitimate returning traffic and new or unsolicited attempts, thereby enhancing security. Stateless firewalls lack this capability and filter solely on packet attributes, so the second and third options are incorrect. While ports are important in rule criteria, stateful firewalls use more information than just destination ports, making the last choice incomplete.