Discuss LPI 701-100 Exam Topic 12 Question 8

Which security issues exist for most publicly available Vagrant boxes? (Choose three correct answers.)

AThey accept SSH logins from the user vagrant with the password vagrant.

BThey accept SSH logins from the user vagrant with a publicly available SSH key pair.

CThe vagrant user can use sudo to obtain root privileges without additional authentication.

DTheir whole file system, including configuration files, is writable by any user, including vagrant.

EThey export their file system via NFS with full write permissions without any additional restrictions.

Suggested Answer: A, B, C

Reference https://www.vagrantup.com/docs/boxes/base.html

Get Premium 701-100 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Stephen 11 months ago

I disagree, E is actually pretty common in some setups.

Jamal 12 months ago

D is a problem, but E seems less common.

Jacinta 12 months ago

Wait, they really allow SSH logins with just "vagrant"? That's wild!

Kerry 12 months ago

I think B is a big risk too.

Micaela 1 year ago

A and C are definitely issues!

Eden 1 year ago

I vaguely recall that using a publicly available SSH key pair is a common issue, but I can't remember if it's specifically mentioned in this question.

Doretha 1 year ago

I practiced a similar question where we talked about file system permissions. I feel like the writable file system for the vagrant user could be a valid concern.

Vallie 1 year ago

I think there's something about the vagrant user having sudo access without needing a password, but I'm not entirely sure if that's one of the options here.

Beatriz 1 year ago

I remember discussing how the default SSH login for the vagrant user is a big security risk, especially with the password being 'vagrant'.

Nancey 1 year ago

Hmm, I'm a bit unsure about this one. The question mentions that the memorandum is protected by a legal professional privilege, but I'm not sure if that means the privilege belongs to the attorney or the client. I'll need to think this through carefully.

Johnna 1 year ago

Okay, I've got a strategy for this. I'll read through the options and try to identify which one best aligns with the ethical responsibilities of a manager, rather than just their general management duties. That should help me narrow it down.

Vicky 1 year ago

Proactively identifying fraud risks seems like the core objective. I'd probably choose option A, but I'm not 100% certain.

Laura 1 year ago

Based on my understanding of NetFlow and SNMP, the SNMP table option should be added under the flow record. That's where the interface information is captured, so that's the logical place to integrate the SNMP data.

LPI 701-100 Exam - Topic 12 Question 8 Discussion