4. Security (18%)
Security is where understanding the why matters most. A firewall rule you copied from Stack Overflow without understanding it might block the wrong traffic. An SELinux context you blindly relabeled might silently re-enable an attack path. The Linux security model is layered by design — permissions, SELinux, firewalls, and audit logs are independent layers, each providing defense even when another fails.
The mental model for this phase: security is a series of checkpoints, each asking a different question. "Who are you?" (authentication). "What are you allowed to do?" (authorization). "Is this path blocked at the network level?" (firewall). "Does the mandatory policy permit this?" (SELinux). "Was this action recorded?" (audit). A process must pass every checkpoint — failing any one denies access.
⚠️ Common Misconception (M7): Using sudo is not the same as being root. sudo enforces the sudoers policy — it can restrict which commands, on which hosts, for which users, with or without passwords. Running directly as root has no restrictions. The exam tests least-privilege design: use sudo with specific command restrictions, not blanket sudo -i.
