Linux & Privilege Escalation

Answer all 15 questions, then submit. You need 75% to pass. If you don't pass, the reattempt unlocks after 24 hours.

Q1. In a shell script, why quote variables as "$var"?

To make it numeric To make it run faster To export it To stop word splitting and glob expansion of unexpected input

Q2. A sudo rule permitting a wildcard path such as /bin/tar * is risky because:

tar is slow The wildcard breaks quoting It requires a password Extra flags can be supplied that make the command run arbitrary code

Q3. Which file holds local user account entries?

/etc/fstab /etc/shadow /etc/hosts /etc/passwd

Q4. LD_PRELOAD can be abused for escalation when:

sudo is configured to preserve that environment variable The shell is zsh The binary is statically linked The disk is full

Q5. Which command shows what the current user may run via sudo?

id ls -la sudo -l whoami

Q6. Which file defines what happens at each runlevel on a systemd host?

/boot/grub.cfg /etc/inittab /etc/rc.local Unit files under /etc/systemd/system

Q7. The capability cap_setuid on a binary allows it to:

Mount filesystems Bind low ports only Read raw packets Change its user id to root without being SUID

Q8. The sticky bit on /tmp ensures that:

The directory cannot grow Files run as root Files are encrypted Only a file's owner may delete it, even though the directory is world-writable

Q9. A writable directory on the PATH before /usr/bin lets an attacker:

Plant a fake binary that a privileged script then executes Read /etc/shadow directly Disable SELinux Change the kernel version

Q10. A writable systemd unit file that root starts allows:

Arbitrary command execution as root via ExecStart Only log tampering Nothing without a reboot Read access to /root only

Q11. The second field of an /etc/passwd line containing x means:

The user is root The hash lives in /etc/shadow The shell is disabled The account is locked

Q12. In the permission string rwxr-xr--, the group may:

Do nothing Write only Read and execute Read and write

Q13. The main defence against kernel-exploit escalation is:

Longer passwords Disabling swap Prompt patching and minimal local accounts Renaming /bin/sh

Q14. A container running with --privileged is risky because it:

Disables networking Slows the host Prevents logging Removes most isolation between the container and the host

Q15. A SUID binary executes with:

No privileges Guest privileges The file owner's privileges The caller's privileges