CCNA CyberOps Chapter 3 Exam Online

There are several reasons why Linux is a good choice for the SOC.Linux is open source.
The command line interface is a very powerful environment.
The user has more control over the operating system.
Linux allows for better network communication control.

Network packet capture software is an important tool because it makes it possible to observe and understand the details of a network transaction.

A terminal emulator is an application program a user of Linux can use in order to access the CLI environment.

One of the most important commands in Linux is the pwd command, which stands for print working directory. It shows users the physical path for the directory they are working in.

Servers provide services such as file management, email, web pages, log management, financial transactions, databases, and more.

SSH is a protocol that is used to securely access a remote network device. The well-known port number used by SSH is 22.

Port numbers are used in TCP and UDP communications to differentiate between the various services running on a device. The well-known port number used by DNS is port 53.

The basic best practices for device hardening are as follows:
Ensure physical security.
Minimize installed packages.
Disable unused services.
Use SSH and disable the root account login over SSH.
Keep the system updated.
Disable USB auto-detection.
Enforce strong passwords.
Force periodic password changes.
Keep users from reusing old passwords.
Review logs regularly.

The journalctl command supports mixing options to achieve a desired filter set. The –u option allows filtering on the desired unit, whereas the –f option follows the specific log, thus monitoring the event in real time.

The file permissions are always displayed in the User, Group and Other order. In the example displayed, the file has the following permissions:
The dash (-) means that this is a file. For directories, the first dash would replaced with a “d”.
The first set of characters is for user permission (rwx). The user, sales, who owns the file can read, write and execute the file.
The second set of characters is for group permissions (rw-). The group, staff, who owns the file can read and write to the file.
The third set of characters is for any other user or group permissions (r–). Any other user or group on the computer can only read the file.

A user has as much rights to a file as the file permissions allow. The only user that can override file permission on a Linux computer is the root user. Because the root user has the power to override file permissions, the root user can write to any file.

The ext3 file system is considered a journaled file system that was designed to improve the existing ext2 file system. A journal, the main feature added to ext3, is a technique used to minimize the risk of file system corruption in the event of sudden power loss.

The primary file system used by Apple in its lates Macintosh computers is APFS.

The X Window System provides the basic framework for a GUI, but the GUI itself varies greatly between different distributions.

The Advanced Packaging Tool (apt) package manager is used to update the operating system. The apt-get update command is used to search and obtain the package list from a repository and update the local package database.

The kill command is used to stop, restart, or pause a process. The chrootkit command is used to check the computer for rootkits, a set of software tools that can increase the privilege level of a user or grant access to portions of software normally not allowed. The grep command is used to look for a file or text within a file. The ls command is used to list files, directories, and file information.

The ps or top command might be used before using the kill command to discover the process ID (PID) for the specific process.

A package is a specific program and all of the files needed to run that application. A package manager is used to install a package and place all the associated files in the correct location within the operating system.

Operating system updates, also known as patches, are provided by companies that create the operating system. A user can check for operating system updates at any time. In a Linux GUI environment, the Dash Search Box can be used to search for the Software Updater icon.

The Linux operating design including how the file system is structured, standard file permissions, and user account restrictions make Linux a better protected operating system. However, Linux still has vulnerabilities and can have malware installed that affects the operating system.

A rootkit is used by an attacker to secure a backdoor to a compromised computer, grant access to portions of the operating system normally not permitted, or increase the privileges of a user.

Multitasking operating systems are required to execute several processes at the same time. Forking is a method that the kernel uses to allow a process to create a copy of itself.