LPI 020-100: Security Essentials

Last checked November 10, 2026 against the official LPI exam page.

1. Question 1024 Network and Service Security

   Which two measures reduce the exposure of an internal web application to the internet? (Choose two.)

   1. AExposing the database server directly on a public IP address
   2. BPlacing the application behind a reverse proxy in a DMZ
   3. CTurning off the firewall so that legitimate visitors are never blocked
   4. DRestricting inbound firewall rules to only the required TCP ports
   Show answer and explanationHide answer

   Correct answer: B, D

   A reverse proxy in a DMZ limits direct contact between the internet and internal systems, and restrictive inbound rules allow only the ports the service needs. Publishing the database directly and disabling the firewall both increase exposure.

2. Question 2022 Encryption

   A developer must encrypt a 2 GB backup archive on a server. The same small operations team will restore it using one shared secret key. Which cryptographic approach is most suitable?

   1. AAsymmetric encryption using each member's public key
   2. BOne-way hashing with a salted SHA-256 digest
   3. CDigital signatures created with an RSA private key
   4. DSymmetric encryption with one shared secret key
   Show answer and explanationHide answer

   Correct answer: D

   Symmetric encryption is fast enough for bulk data and suits a single shared key used for both encryption and decryption. Asymmetric encryption is far slower for large files and is usually reserved for key exchange, hashing cannot be reversed to restore the archive, and signatures provide integrity and authenticity rather than confidentiality.

3. Question 3023 Device and Storage Security

   An administrator wants to confirm that a workstation's boot loader and kernel have not been tampered with before the operating system starts. Which firmware feature is designed for this purpose?

   1. ADisk quotas, which limit how much space each user may consume
   2. BNetwork Address Translation, which hides internal IP addresses
   3. CUEFI Secure Boot, which checks signatures on boot components
   4. DLog rotation, which archives older system log files
   Show answer and explanationHide answer

   Correct answer: C

   UEFI Secure Boot verifies that boot loaders and related components carry trusted signatures before they run. Disk quotas, network address translation and log rotation are useful administration or networking features but do nothing to verify the integrity of boot code.

4. Question 4025 Identity and Privacy

   A bank wants customers to sign in with something they know and also a one-time code generated by a phone app. Which approach describes this design?

   1. ASingle sign-on, which reuses one login across several applications
   2. BRole-based access control, which grants rights according to job function
   3. CMulti-factor authentication, combining two or more independent factors
   4. DMandatory access control, which enforces labels set by the system
   Show answer and explanationHide answer

   Correct answer: C

   Using a password plus a possession-based one-time code is multi-factor authentication. Single sign-on concerns reusing one login across services, while role-based and mandatory access control are authorization models that decide what a user may do after authentication.

5. Question 5021 Security Concepts

   A small company's IT manager lists every server, laptop and customer database, notes who owns each one, and estimates the cost of losing each. Which security activity does this work represent most directly?

   1. APenetration testing of external services
   2. BRisk assessment of organizational assets
   3. CIncident response containment planning
   4. DSecurity awareness training for new hires
   Show answer and explanationHide answer

   Correct answer: B

   Listing assets, their owners and the impact of losing them is the asset identification and impact analysis at the core of a risk assessment. Penetration testing probes for exploitable weaknesses, incident response handles events already underway, and awareness training educates people, so none of those builds the asset and impact inventory.