202-450 Exam Dumps - LPIC-2 - Exam 202 (part 2 of 2), version 4.5

DNSSEC adds digital signatures to DNS records, which can be verified by the clients using public keys. This way, DNSSEC ensures that the DNS responses are authentic and have not been tampered with by attackers. DNSSEC does not encrypt DNS queries or answers, nor does it authenticate the user or the nameserver123

What is DNSSEC on DNS Server in Windows Server?1

How DNSSEC Works | Cloudflare

 To log into a remote SSH server using SSH keys, the client needs to generate a public and private key pair using the ssh-keygen utility. The private key (~/.ssh/id_rsa) should be kept secret and protected by a passphrase, while the public key (~/.ssh/id_rsa.pub) should be copied to the remote server’s authorized_keys file (~/.ssh/authorized_keys) using the ssh-copy-id utility or manually. The authorized_keys file contains the public keys of the clients that are allowed to log into the server using SSH keys. The client can then use the ssh command with the -i option to specify the private key file to authenticate to the server without entering a password. References:

• LPIC-2 Exam 202 Objectives, Topic 212: System Security, 212.3 Secure shell (SSH) (weight: 4)
• How To Configure SSH Key-Based Authentication on a Linux Server

How To Configure SSH Key-Based Authentication on a Linux Server

The rndc sub command that can be used in conjunction with the name of a zone in order to make BIND reread the content of the specific zone file without reloading other zones as well is reload. The reload sub command instructs the BIND server to reload the specified zone or all zones if no zone is specified. The reload sub command is useful for applying changes made to the zone files without restarting the BIND service or affecting other zones. The syntax of the reload sub command is as follows:

rndc reload [zone [class [view]]]

For example, to reload the zone example.com in the IN class and the default view, use the following command:

rndc reload example.com IN

References:

• rndc - man pages section 8: System Administration Commands, sub command “reload”
• 17.2.3. Using the rndc Utility - Red Hat Customer Portal, section “Reloading the Configuration and Zones”

The redirect action in a Sieve filter forwards a message to another email address without changing the message. The redirect action takes a single argument, which is the email address to forward the message to. The syntax of the redirect action is as follows:

redirect "email_address";

The redirect action does not affect the delivery of the message to the original recipient, unless the stop or keep actions are used. The redirect action can be combined with other actions or tests to create more complex filters. For example, the following Sieve filter will forward any messages from Alice to Bob, and then stop processing the rest of the script:

require "fileinto"; if address :is "from" "alice@example.com" { redirect "bob@example.com"; stop; }

References:

• LPIC-2 Exam 202 Objectives, Objective 205.4: Managing a dovecot server
• Sieve filter (advanced custom filters) | Proton, Proton Mail Support
• Sieve: An Email Filtering Language, RFC 5228
• Sieve Email Filtering | Tiger Technologies Support, Tiger Technologies Support
• [Sieve: A Mail Filtering Language], Sieve.Info

The relayhost parameter in the Postfix configuration file (/etc/postfix/main.cf) specifies the hostname or IP address of an external SMTP server that will handle the outgoing emails for Postfix. This server is also known as a smarthost or a relayhost. By using a relayhost, Postfix can delegate the responsibility of delivering emails to remote destinations to another server that may have better network connectivity, security, or reputation. A relayhost can also provide authentication, encryption, or filtering services for Postfix. References:

• Postfix Standard Configuration Examples
• How to configure Postfix relayhost (smarthost) to send eMail using an external smptd

The option for BIND that is required in the global options to disable recursive queries on the DNS server by default is recursion no;. This option tells the server not to provide recursive query behavior to any client, unless overridden by a view or a zone statement. Recursive queries are queries that the server will try to resolve by contacting other servers if it does not have the answer in its cache or zones. Disabling recursive queries can improve the security and performance of the server, especially if it is only meant to serve authoritative zones123 References:

• BIND: Stop Recursion DNS Under Linux / UNIX - nixCraft
• How to Disable External DNS Recursion in BIND? | DeviceTests
• bind - How to Disable External DNS recursion? - Ask Ubuntu

 OpenVAS is a network security scanner project that, at the core, is a server with a set of network vulnerability tests (NVTs) to detect security problems in remote systems and applications. It is an open-source tool that was forked from Nessus, a popular commercial scanner. OpenVAS can perform comprehensive scans of networks and hosts, as well as web application scanning and compliance testing. It also provides a graphical user interface (GUI) and a command-line interface (CLI) for managing scans and reports. References:

• Greenbone Vulnerability Management - Gentoo wiki
• The Best Network Vulnerability Scanners Tested in 2023 - Comparitech

 The nmap command is a network exploration and security auditing tool that can scan hosts and networks for open ports, services, operating systems, vulnerabilities, and other information. The nmap parameters that can scan a target for open TCP ports are:

• -sT: This parameter performs a TCP connect scan, which establishes a complete connection to the target host by completing a TCP three-way handshake. This is the default scan type when the user does not have root privileges. The advantage of this scan is that it works on any system that supports TCP, but the disadvantage is that it is easily detectable by firewalls and intrusion detection systems.
• -sS: This parameter performs a TCP SYN scan, which sends a TCP SYN packet to the target port and waits for a response. If the response is a SYN/ACK packet, the port is open. If the response is a RST packet, the port is closed. This scan does not complete the TCP three-way handshake, so it is faster and stealthier than the TCP connect scan. However, this scan requires root privileges and may not work on some systems that do not follow the TCP standard.

The other parameters are not related to TCP port scanning:

• -sO: This parameter performs an IP protocol scan, which sends IP packets with the specified protocol number set in the IP header. It can be used to determine which IP protocols are supported by the target host.
• -sZ: This parameter is not a valid nmap parameter and will cause an error.
• -sU: This parameter performs a UDP scan, which sends a UDP packet to the target port and waits for a response. If the response is an ICMP port unreachable message, the port is closed. If the response is a UDP packet, the port is open. This scan can be used to find open UDP ports, which are often used by DNS, SNMP, DHCP, and other services.

References: LPIC-2 202 exam objectives, LPIC-2 202-450 Exam Prep: Network Configuration, Nmap Tutorial: Common Commands, Nmap Scan Types

Cybersecurity | Nmap | TCP Connect Scan | Codecademy