ATTENTION: If you belong to the LaaS Cert program, the training does not include an exam
Official LPIC-3 Security Certification Course
What is LPIC-3 Enterprise Professional Security?
This certification is the expert level of the certification program from the Linux Professional Institute (LPI), aimed at professionals who administer Linux systems in enterprise environments with an advanced focus on security.
The LPIC-3 303 exam validates competencies in encryption, host security, access control, network security, firewalls, and VPNs on Linux, making it one of the most recognized international certifications.
This course covers the topics for the preparation of exam 303, necessary to be certified in LPIC-3. The training is delivered virtually and can be purchased with or without a certification exam voucher, and is also 100% eligible for grants. (Consult other training options).
With this course, you will become a Linux security expert and obtain a high-level international professional certification!
What benefits does obtaining the LPIC-3 Security certification offer?
Obtaining LPIC‑3 Security allows you to:
- Accredit expert knowledge in enterprise Linux security
- Specialize in encryption, access control, and network security
- Improve your professional profile in cybersecurity areas
- Access high-level technical roles and greater employability
- Obtain international recognition
What are the prerequisites for LPIC-3?
To take the course and qualify for certification, you need:
- An active LPIC-2 is a prerequisite for obtaining LPIC-3.
- Experience in advanced system administration
- Prior knowledge of networks, users, permissions, and services
Nanfor, a custom IT training center, authorized by the Linux Professional Institute
Nanfor is an official Platinum partner designated center and offers all official Linux LPI courses. It is approved by LPI as a Training Partner and Channel Partner, which reinforces the course's alignment with official standards.
⏱️
Course Duration:
165 hours
🔑
Access to the classroom:
3 months
Who is the LPIC-3 Security course for?
This LPIC-3 course is aimed at professionals who wish to:
- Linux system administrators with advanced experience
- Cybersecurity professionals in Linux environments
- System and network engineers
- IT consultants specializing in infrastructure
- Professionals who already have LPIC-2 and wish to reach the expert level
It is especially recommended for those working in enterprise security, access management, data protection, and critical environments.
LPIC-3 Security Course Content
Here you will find the complete structure of the training program, with the key points and practical approach of the training.
Topic 331: Cryptography
331.1 X.509 Certificates and Public Key Infrastructures
Candidates should understand X.509 certificates and public key infrastructures. They should know how to configure and use OpenSSL to implement certificate authorities and issue SSL certificates for various purposes.
Key knowledge areas:
- Understand X.509 certificates, X.509 certificate lifecycle, X.509 certificate fields, and X.509v3 certificate extensions.
- Understand chains of trust and public key infrastructures, including certificate transparency.
- Generate and manage public and private keys
- Create, operate, and secure a Certificate Authority
- Request, sign, and manage server and client certificates
- Revoke certificates and Certificate Authorities
- Knowledge of basic features of Let's Encrypt, ACME, and certbot
- Knowledge of basic features of CFSSL
331.2 X.509 Certificates for Encryption, Signing, and Authentication
Candidates should be able to use X.509 certificates for both server and client authentication. This includes implementing user and server authentication for Apache HTTPD. The version of Apache HTTPD covered is 2.4 or higher.
Key knowledge areas:
- Understand SSL, TLS, including protocol versions and ciphers.
- Configure Apache HTTPD with mod_ssl to provide HTTPS service, including SNI and HSTS
- Configure Apache HTTPD with mod_ssl to serve certificate chains and adjust cipher configuration (without specific cipher knowledge)
- Configure Apache HTTPD with mod_ssl to authenticate users using certificates
- Configure Apache HTTPD with mod_ssl to provide OCSP stapling
- Use OpenSSL for SSL/TLS client and server testing
331.3 File Encryption Systems
Candidates should be able to install and configure file encryption systems.
Key knowledge areas:
- Understand block device and file system encryption
- Use dm-crypt with LUKS1 to encrypt block devices
- Use eCryptfs to encrypt file systems, including home directories and PAM integration
- Awareness of simple dm-crypt
- Knowledge of LUKS2 features
- Conceptual understanding of forking for LUKS devices and forking PINs for TMP2 and Network-Bound Disk Encryption (NBDE)/Tang
331.4 DNS and Cryptography
Candidates should have experience and knowledge of cryptography in the context of DNS and its implementation using BIND. The version of BIND covered is 9.7 or higher.
Key knowledge areas:
- Understand DNS concepts, zones, and resource records.
-
Understand DNSSEC, including key signing keys, zone signing keys, and relevant DNS records such as DS, DNSKEY, RRSIG, NSEC, NSEC3
and NSEC3PARAM.
- Configure and troubleshoot BIND as an authoritative name server serving DNSSEC-protected zones
- Manage DNSSEC-signed zones, including key generation, key rollover, and zone signing rollover
- Configure BIND as a recursive name server performing DNSSEC validation on behalf of its clients
- Understand CAA and DANE, including relevant DNS records such as CAA and TLSA
- Use CAA and DANE to publish X.509 and Certificate Authority certificate information in DNS
- Use TSIG for secure communication with BIND.
- Knowledge of DNS over TLS and DNS over HTTPS.
- Knowledge of multicast DNS
Topic 332: Host Security
332.1 Host Hardening
Candidates should be able to protect Linux computers from common threats.
Key knowledge areas:
- Configure BIOS and boot loader (GRUB 2) security
- Disable unused software and services
- Understand and remove unnecessary capabilities for specific systemd units and for the entire system.
- Understand and configure Address Space Layout Randomization (ASLR), Data Execution Prevention (DEP), and Exec-Shield
- Whitelist and blacklist USB devices connected to a computer using USBGuard
- Create an SSH CA, create SSH certificates for host and user keys using the CA, and configure OpenSSH to use SSH certificates
- Working with chroot environments
- Use systemd units to limit system calls and capabilities available to a process
- Use systemd units to start processes with limited or no access to specific files and devices
- Use systemd units to start processes with dedicated temporary directories and /dev and no network access
- Understand the implications of Linux Meltdown and Spectre mitigations and enable/disable mitigations
- polkit awareness
- Awareness of the security benefits of virtualization and containerization
332.2 Host Intrusion Detection
Candidates should be familiar with using and configuring common host intrusion detection software. This includes managing the audit system and verifying system integrity.
Key knowledge areas:
- Use and configure the audit system
- Use chrootkit
- Use and configure rkhunter, including updates
- Use Linux Malware Detect
- Automate host scans using cron
- Use RPM and DPKG package management tools to verify the integrity of installed files, especially in enterprise security v3.0 environments.
- Configure and use AIDE, including rule management
- OpenSCAP awareness
332.3 Resource Control
Candidates should be able to restrict the resources that services and programs can consume.
Key knowledge areas:
- Understand and configure ulimits
- Understand cgroups, including classes, limits, and accounting.
- Manage cgroups and process cgroup association
- Understand systemd slices, scopes, and services
- Use systemd units to limit the system resources that processes can consume
- Knowledge of cgmanager and libcgroup utilities
Topic 333: Access Control
333.1 Discretionary Access Control
Candidates should understand Discretionary Access Control (DAC) and know how to implement it using Access Control Lists (ACLs). In addition, they should understand and know how to use extended attributes.
Key knowledge areas:
- Understand and manage file ownership and permissions, including SetUID and SetGID bits
- Understand and manage access control lists.
- Understand and manage extended attributes and attribute classes
333.2 Mandatory Access Control
Candidates should be familiar with Mandatory Access Control (MAC) systems for Linux. Specifically, they should have a deep understanding of SELinux. They should also be aware of other mandatory access control systems for Linux. This includes the main features of these systems, but not their configuration or use.
Key knowledge areas:
- Understand the concepts of type enforcement, role-based access control, mandatory access control, and discretionary access control.
- Configure, administer, and use SELinux
- Knowledge of AppArmor and Smack
Topic 334: Network Security
334.1 Network Hardening
Candidates should be able to secure networks against common threats. This includes analyzing network traffic from specific nodes and protocols, which is vital for Linux professionals.
Key knowledge areas:
- Understand wireless network security mechanisms.
- Configure FreeRADIUS to authenticate network nodes
- Use Wireshark and tcpdump to analyze network traffic, including filters and statistics
- Use Kismet to analyze wireless networks and capture wireless network traffic
- Identify and address fake router advertisements and DHCP messages
- Awareness of aircrack-ng and bettercap
334.2 Network Intrusion Detection, an essential component for LPIC-3 certification.
Candidates should be familiar with using and configuring network scanning, monitoring, and intrusion detection software. This includes updating and maintaining security scanners.
Key knowledge areas:
- Implement bandwidth usage monitoring
- Configure and use Snort, including rule management
- Configure and use OpenVAS, including NASL
334.3 Packet Filtering
Candidates should be familiar with the use and configuration of the Linux netfilter packet filter.
Key knowledge areas:
- Understand common firewall architectures, including DMZ
- Understand and use iptables and ip6tables, including standard modules, testing, and targets.
- Implement packet filtering for IPv4 and IPv6
- Implement connection tracking and network address translation.
- Manage IP sets and use them in netfilter rules
- Awareness of nftables and NFT
- Awareness of firewalld
- Awareness of ufw
334.4 Virtual Private Networks
Candidates should be familiar with using OpenVPN, IPsec, and WireGuard to configure remote access and site-to-site VPNs.
Key knowledge areas:
- Understand the principles of routed and bridged VPNs
- Understand the principles and main differences of OpenVPN, IPsec, IKEv2, and WireGuard protocols
- Configure and operate OpenVPN servers and clients
- Configure and operate IPsec servers and clients using strongSwan
- Configure and operate WireGuard servers and clients
- Awareness of L2TP
Topic 335: Threats and Vulnerability Assessment
335.1 Common security vulnerabilities and threats in enterprise environments.
Candidates should understand the principle of the main types of security vulnerabilities and threats.
Key knowledge areas:
- Conceptual understanding of threats against individual nodes
- Conceptual understanding of threats to networks.
- Conceptual understanding of application threats.
- Conceptual understanding of threats against credentials and confidentiality
- Conceptual understanding of honeypots
335.2 Penetration Testing
Candidates understand the concepts of penetration testing, including knowledge of commonly used tools. In addition, they should be able to use nmap to verify the effectiveness of network security measures.
Key knowledge areas:
- Understand the concepts of penetration testing and ethical hacking.
- Understand the legal implications of penetration testing.
- Understand the phases of penetration testing, such as active and passive information gathering, enumeration, gaining access, privilege escalation, maintaining access, and covering tracks.
- Understand the architecture and components of Metasploit, including Metasploit module types and how Metasploit integrates various security tools.
- Use nmap to scan networks and hosts, including different scanning methods, version scans, and operating system recognition
- Understand the concepts of Nmap Scripting Engine and execute existing scripts
- Knowledge of Kali Linux, Armitage, and the Social-Engineer Toolkit (SET)
Course and Exam Language
-
The e-Learning components on which the training is based are in English and Spanish.
-
Languages for the exam available at Pearson Vue test centers: English, Japanese
-
Languages for the exam available online via OnVUE: English, Japanese
Want to take this course? Request information now
If you want to take this course virtually, you can purchase it at the top of the product. If you have any questions, please contact us.
If you want to take this course in face-to-face or remote mode, please contact us:
Frequently asked questions
Check out quick answers about training and recommendations to plan your preparation path.
1) What is LPIC-3 Security?
LPIC-3 303 is LPI's expert-level specialization focused on Linux security and validates advanced competencies in encryption, access control, network security, firewalls, and VPNs, geared towards enterprise environments.
2) Does this course specifically prepare for the LPIC-3 303 exam?
Yes. The course is designed to cover the necessary topics for exam preparation and aims at obtaining the certification.
3) What topics does the LPIC-3 Security exam evaluate?
The exam evaluates advanced areas such as encryption, host security, access control, network security, and firewall and VPN configuration.
4) How long does the course last and how long do I have access to the classroom?
The course description indicates a duration of 165 hours and 3 months of access to the online classroom. It can be taken in other modalities upon request.
5) Does it include an official exam? What happens if I am in LaaS Cert?
The description indicates that, if you belong to the LaaS Cert program, the training is conducted without an included exam.
6) Is Nanfor an official LPI Partner for this training?
Nanfor is an authorized LPI center, being a Platinum partner accredited by LPI as a Training Partner and Channel Partner, which reinforces the course's alignment with official standards.
7) What professional profile benefits most from this accreditation?
It is especially recommended for professionals who administer Linux in organizations and want to specialize in advanced security, strengthening their profile for senior administration and security roles.
8) What security certifications exist?
In the field of Linux, the most specialized security accreditation is LPIC-3 Security, focused on secure administration of Linux systems in enterprise environments.
Additionally, there are complementary accreditations such as LPIC-2, RHCE, CEH or Security+, widely used when Linux is the base operating system.
9) How much do LPI exams cost?
Exam prices are regional and may vary by country. In Spain, Nanfor offers the purchase of official LPI certification vouchers, where you can check the updated price of each type of exam (LPIC-1, LPIC-2, LPIC-3, Essentials, etc.) at the following link: 👉 https://nanfor.com/collections/examen-oficial-linux/products/examen-oficial-linux
