303-200: LPIC-3 Exam 303 Security, Version 2.0 Study Guide
303-200 was the version 2.0 LPIC-3 Security exam. It validated enterprise-wide Linux administration with an emphasis on cryptography, host protection, access control, and network security. The exam served experienced Linux professionals working with secured infrastructure rather than beginners learning command-line administration. The most important decision for a candidate now is whether they need historical version-2.0 coverage or the current 303-300 objectives. This guide explains that distinction, maps the version-2.0 skills, and turns the blueprint into a practical study plan without treating recalled questions or dumps as preparation.
Is 303-200 still available?
No. LPI states that LPIC-3 Security version 2.0, exam code 303-200, was available until April 4, 2022. The current LPIC-3 Security listing identifies version 3.0, exam code 303-300, as the current version. A candidate planning a new certification attempt should therefore verify the active exam code and objectives with LPI before buying a voucher or scheduling an appointment.
The version-2.0 objectives remain useful when the requirement specifically names 303-200, when an organization is documenting an older certification, or when a learner is comparing changes between exam versions. They should not be used as evidence that a version-2.0 appointment can still be booked.
LPI’s version-3 update records that old exam versions remain available for six months after a newer version is released. That policy explains the transition period; it does not make 303-200 a currently schedulable exam.
What certification did the exam support?
LPIC-3 Security was intended for enterprise-level Linux professionals and focused on administering Linux systems across an organization with an emphasis on security. The certification is vendor-neutral. Four separate LPIC-3 specialty certifications are available, and passing an appropriate specialty exam grants the LPIC-3 certification for that specialty.
LPI states that receiving LPIC-3 certification requires an active LPIC-2 certification and passing the corresponding LPIC-3 exam. For a historical 303-200 record, confirm the applicable certification rules with LPI or the organization requesting the credential, especially if the LPIC-2 status has since expired.
This positioning matters for preparation. The exam was not simply a catalogue of security commands. Its objectives connected certificate infrastructure, authentication, file and process protection, policy enforcement, monitoring, filtering, and encrypted connectivity. A candidate needed to understand how a control worked and how its configuration affected a service.
What did the exam format involve?
The published LPIC-3 Security information describes the exam as 90 minutes with 60 multiple-choice and fill-in-the-blank questions. It lists English and Japanese for VUE test centers and English and Japanese for online delivery through OnVUE. Those details describe the published exam information and should not be interpreted as evidence that 303-200 can now be delivered.
The format rewards precise recall as well as careful reading. A fill-in response may require a command, file, utility, or configuration concept, while a multiple-choice item may test the boundary between two similar controls. Study by writing commands and explaining their effect, not by recognizing an answer from a memorized list.
Do not use an assumed price, booking date, score threshold, or current delivery option for planning. LPI directs candidates to country-specific pricing and scheduling information, and the version-2.0 retirement means current availability must be checked against the active exam listing.
How was version 2.0 organized?
The version-2.0 blueprint grouped the exam into four security domains: Topic 325 Cryptography, Topic 326 Host Security, Topic 327 Access Control, and Topic 328 Network Security. Each objective carried a weight from the official blueprint. Higher weights indicate greater relative importance, so the weights should guide study time rather than be treated as a passing-score formula.
Topic 325 Cryptography covered X.509 and public key infrastructures, certificate use for encryption, signing and authentication, encrypted file systems, and DNS cryptography. Topic 326 Host Security covered host hardening, host intrusion detection, user management and authentication, and FreeIPA installation and Samba integration.
Topic 327 Access Control covered discretionary access control, mandatory access control, and network file systems. Topic 328 Network Security covered network hardening, network intrusion detection, packet filtering, and virtual private networks. These boundaries are useful for building a lab because they separate local controls from network controls while still exposing their dependencies.
Which objectives deserved the earliest attention?
Start with the version-2.0 objectives carrying weight 5, then work through weight 4 and weight 3 objectives. The official blueprint assigns weight 5 to 325.1 X.509 Certificates and Public Key Infrastructures, 325.4 DNS and Cryptography, 326.3 User Management and Authentication, and 328.3 Packet Filtering. It assigns weight 4 to 325.2, 326.2, 326.4, 327.2, 328.1, 328.2, and 328.4.
The weights do not replace coverage of lower-weight objectives. Encrypted file systems, discretionary access control, and network file systems still test distinct knowledge and can expose gaps created by focusing only on certificates or firewalls. Use the weight to decide how deeply to practise, not whether to skip a domain.
Keep each weight attached to its official objective label in your notes. Avoid making a bare percentage table: the source describes objective weights, not a reliable percentage conversion or a guaranteed question allocation for 303-200.
What should you learn in cryptography first?
Build a certificate workflow before memorizing terminology. You should be able to distinguish a private key, public key, certificate signing request, signed certificate, trust chain, certificate revocation list, and OCSP response, then use OpenSSL concepts to create and manage the relevant material. The blueprint expects certificate authorities and certificates for different purposes, not merely HTTPS vocabulary.
For 325.1 X.509 Certificates and Public Key Infrastructures, study certificate fields and X.509v3 extensions, key generation and management, certification-authority operation, certificate requests, signing, revocation, and trust chains. Organize the workflow as: create key material, generate a request, validate identity, sign, deploy, test, and revoke when necessary.
For 325.2 X.509 Certificates for Encryption, Signing and Authentication, connect certificates to Apache HTTPD 2.4 or higher. Practise the roles of mod_ssl, HTTPS, SNI, HSTS, client certificate authentication, OCSP stapling, and OpenSSL client or server tests. The key question is not only which directive exists, but which identity is being authenticated and where the trust decision is made.
For 325.3 Encrypted File Systems, compare block-device encryption with file-system or directory encryption. The objectives name dm-crypt with LUKS, eCryptfs, PAM integration for encrypted home directories, and awareness of plain dm-crypt and EncFS. In your lab notes, record what is encrypted, when the key is needed, and what happens if the supporting authentication or mount configuration is wrong.
For 325.4 DNS and Cryptography, study DNSSEC concepts and BIND configuration from the objective list, including signing material, zone maintenance, validation-related records, and tools such as dig, delv, rndc, dnssec-keygen, dnssec-signzone, dnssec-settime, and dnssec-dsfromkey. The stated BIND coverage is version 9.7 or higher.
How should host security become practical?
Treat host security as a sequence of controls rather than a list of products: reduce attack surface, control identities, detect changes, and integrate trusted authentication services. The version-2.0 blueprint combines operating-system hardening with audit and authentication work, so a useful lab should show both prevention and investigation.
For 326.1 Host Hardening, work through boot and service exposure, system configuration, permissions, limits, and kernel or process settings named by the objectives. The blueprint specifically includes BIOS and GRUB 2 security. Document the reason for each setting and the recovery path if a hardening change prevents normal administration.
For 326.2 Host Intrusion Detection, compare audit collection with file-integrity and rootkit-oriented tools. The objective list includes auditd, auditctl, ausearch, aureport, pam_tty_audit.so, chkrootkit, rkhunter, maldet, and aide. Practise turning an event into an investigation: identify the source, locate the relevant log or database, establish what changed, and decide what evidence is still needed.
For 326.3 User Management and Authentication, study local account policy, PAM, NSS, SSSD, password aging, account lockout, and Kerberos-related utilities. The objective list includes /etc/login.defs, chage, pam_cracklib.so, pam_tally.so, pam_tally2.so, faillog, pam_sss.so, sssd.conf, krb5.conf, kinit, klist, and kdestroy. Make a dependency map showing which component supplies identity, which component authenticates, and which component applies policy.
For 326.4 FreeIPA Installation and Samba Integration, learn the purpose of the identity platform and the relationship among LDAP, Kerberos, DNS, SSSD, certificates, and Samba. The objective names FreeIPA version 4.x and tools including ipa-server-install, ipa-client-install, ipa-replica-install, ipa-replica-prepare, and ipa-replica-manage. Practise integration in an isolated lab rather than changing a production identity service while studying.
How do DAC, MAC, and network file security differ?
Discretionary access control, mandatory access control, and network file-system security solve different problems. DAC follows ownership, mode bits, ACLs, and extended attributes; MAC applies a separate policy model; network file systems add trust, identity, transport, and export or share concerns. Study them side by side so that a permission failure is not automatically diagnosed as a single mechanism.
For 327.1 Discretionary Access Control, practise ownership and permissions, SetUID and SetGID, ACL inspection and modification, and extended attributes. The objective list includes getfacl, setfacl, getfattr, and setfattr. For every test, record both the effective permission and the rule that produced it, including the interaction between a mode mask and an ACL entry.
For 327.2 Mandatory Access Control, learn the operational vocabulary and troubleshooting path of Linux MAC systems. The version-2.0 objective names tools such as getenforce, setenforce, sestatus, getsebool, setsebool, semanage, restorecon, audit2why, audit2allow, seinfo, and the /etc/selinux tree. Practise reading an audit denial, checking context and policy state, and correcting labels or policy deliberately rather than disabling enforcement.
For 327.3 Network File Systems, focus on security implications in NFSv4 clients and servers and CIFS client services. Earlier NFS versions are not required knowledge according to the objective notes. Study exports, identity mapping, ownership, permissions, security modes, and utilities such as /etc/exports, /etc/idmapd.conf, mount.cifs, getcifsacl, and setcifsacl.
A common mistake is to memorize a successful mount without understanding identity. Repeat the same access test with different users, verify which identity reaches the server, and check whether local permissions, server policy, ACLs, or transport settings are responsible for the result.
What belongs in the network-security lab?
Use a small segmented lab with a client, a service host, and a monitoring or testing host. Network Security in version 2.0 included hardening, intrusion detection, packet filtering, and VPNs. Practising traffic flows lets you connect a rule to an observable result, which is more durable than memorizing isolated syntax.
For 328.1 Network Hardening, examine exposure, service selection, secure administration, routing, and monitoring. For 328.2 Network Intrusion Detection, learn the difference between scanning, monitoring, and intrusion detection, then work with the objective-listed tools and terms: ntop, Cacti, Snort, snort-stat, OpenVAS utilities, and NASL-related material. Keep scanning confined to systems you own or are authorized to test.
For 328.3 Packet Filtering, practise netfilter concepts with iptables, ip6tables, iptables-save, iptables-restore, ip6tables-save, ip6tables-restore, ipset, nft, and ebtables. Build rules from a policy: default stance, allowed service, source and destination, state, logging, and persistence. Test IPv4 and IPv6 separately where the objective names both families.
For 328.4 Virtual Private Networks, compare the use and configuration of OpenVPN and IPsec. The objective list includes /etc/openvpn/*, openvpn, setkey, /etc/ipsec-tools.conf, and /etc/racoon/racoon.conf. Draw the tunnel endpoints, authentication material, protected networks, and routes before writing configuration. A tunnel that establishes but does not carry the intended traffic is not a completed exercise.
Do not confuse a vulnerability scanner with an intrusion-detection system or a packet filter with a VPN. Ask what each tool observes, what it enforces, and where it operates. That three-part comparison is a strong way to resolve similarly worded choices.
What lab setup is worth the effort?
A disposable, documented Linux lab is more useful than a large collection of reading notes. Build only the services needed for the next objective, take snapshots before risky changes, and keep a written record of commands, configuration paths, test identities, expected results, and rollback steps. The lab should support explanation and troubleshooting, not imitate a live enterprise.
Create separate exercises for a local security baseline, a certificate authority and Apache HTTPS service, an encrypted test volume, an identity or authentication integration, an ACL and MAC denial, a filtered network, a detection workflow, and a VPN. Use synthetic names and non-sensitive keys. Never expose a study certificate authority or test scanner to networks you do not control.
For each exercise, start with a requirement and finish with evidence. For example: “Only the intended client reaches the service,” “the client certificate is rejected when the trust chain is wrong,” or “the access denial is explained by the policy audit.” This structure trains the reasoning the objectives demand without relying on live exam questions.
Keep version assumptions visible. The version-2.0 objectives specify Apache HTTPD 2.4 or higher and BIND 9.7 or higher, while individual distributions may package different defaults and tools. Learn the objective concept first, then note the distribution-specific location or command variation separately.
How can you turn the blueprint into a study schedule?
Use a staged plan that moves from foundations to integrated troubleshooting. First inventory the objectives and mark each as unfamiliar, partially understood, or demonstrable. Then allocate the largest practice blocks to the weight-5 objectives, reserve time for every lower-weight objective, and finish with mixed scenarios that cross certificate, identity, policy, and network boundaries.
Stage one is prerequisite review. Refresh Linux permissions, service management, networking, DNS, authentication, logging, and shell use before opening advanced security material. This is not a reason to study all of LPIC-2 again; it is a way to remove basic gaps that would obscure the LPIC-3 objective.
Stage two is cryptography and identity. Build the certificate workflow, HTTPS authentication, encrypted-storage exercises, DNSSEC concepts, PAM and NSS maps, and FreeIPA or Samba integration notes. These subjects have dependencies, so study them before attempting broad troubleshooting drills.
Stage three is enforcement and detection. Work through DAC, MAC, NFS and CIFS security, host hardening, audit interpretation, intrusion detection, packet filtering, and VPNs. After each topic, deliberately break one setting and restore service using evidence rather than guesswork.
Stage four is consolidation. Revisit every objective with a short demonstration or written explanation. For each missed practice item, classify the cause as terminology, command syntax, configuration relationship, security model, or troubleshooting sequence. Review the category, not just the answer.
Stage five is exam-style rehearsal for the historical format. Use timed sets of multiple-choice and fill-in-the-blank questions created from the official objectives or reputable study material. Do not use leaked questions or dumps. They cannot establish understanding, and memorizing them does not guarantee a pass.
Which preparation mistakes cost the most?
The most damaging mistakes are studying the wrong version, treating weights as a complete syllabus, and memorizing commands without understanding the security decision behind them. Confirm the exam code first, map every objective, and make each command part of a repeatable configuration or diagnostic workflow.
Mistake one is preparing for 303-300 while claiming readiness for 303-200, or doing the reverse. The version-3.0 blueprint changes numbering and adds Topic 335, Threats and Vulnerability Assessment. Keep separate notes and label every resource with its objective version.
Mistake two is assuming a high-weight objective is worth skipping lower-weight material. Version 2.0 includes four domains, and a narrow focus on certificates or packet filtering leaves important host and access-control gaps.
Mistake three is confusing awareness with implementation. When an objective names a tool, practise enough to explain its purpose, principal inputs, output, and failure modes. Do not spend all your time building a production-grade platform when the objective asks for conceptual understanding; do not settle for definitions when it asks for configuration.
Mistake four is disabling security controls to make a lab work. A successful lab should explain why a control allowed or denied access. Capture logs, contexts, routes, certificate details, and rule matches before changing the configuration.
Mistake five is relying on exam dumps, recalled questions, or answer memorization. Such material is not an authorized substitute for the blueprint and gives no dependable evidence that you can secure or troubleshoot a Linux system.
What should you do before choosing an exam path?
Begin by writing down the credential requirement, the exam code named by the requester, and the version they accept. Because 303-200 retired on April 4, 2022, most new candidates should compare their goal with the current 303-300 route rather than plan around the historical code.
Next, open the official objectives and create a version-labelled checklist. For a historical 303-200 checklist, include Topics 325 through 328 and every listed objective. For a current attempt, use the version-3.0 objectives instead; do not infer current coverage from this guide.
Then verify certification status requirements. LPI’s LPIC-3 Security information states that an active LPIC-2 certification is required to receive the LPIC-3 certification. If your LPIC-2 certification is inactive, resolve that issue before investing in a voucher or appointment.
Finally, choose a study route: self-directed lab work, formal training, or a combination. LPI’s learning-materials site provides translation and availability information, while the official certification page provides the current exam path. Schedule only after the code, version, prerequisite status, language, and delivery information have been confirmed from LPI.
How should readiness be measured?
You are ready for the technical demands of this blueprint when you can explain and demonstrate each objective without following a memorized answer key. Use evidence from a lab, a troubleshooting record, and a blank-sheet explanation. A score on an unofficial practice set can reveal weak areas, but it cannot replace objective-by-objective demonstrations.
For cryptography, generate or inspect a certificate chain, test an Apache TLS configuration, explain revocation or OCSP, and compare LUKS with eCryptfs. For host security, apply a baseline, investigate an audit or integrity event, and trace authentication through PAM, NSS, SSSD, or Kerberos-related components.
For access control, predict the result of an ACL or MAC rule before testing it, then explain a denial from the available evidence. For network security, write a filtering policy, verify traffic and logging, distinguish detection from enforcement, and diagnose a VPN that authenticates but does not route the intended network.
Use a final gap log with three columns: objective, demonstration still missing, and next action. When the same gap appears in more than one domain, study the underlying concept—identity, trust, policy, state, or observability—rather than memorizing another command.
Conclusion
303-200 is a retired version-2.0 exam, so the first preparation decision is historical documentation versus a current LPIC-3 Security attempt. If the older blueprint is genuinely required, study Topics 325 through 328 through controlled labs, weighted prioritization, and troubleshooting records. If the goal is a new certification, verify the active 303-300 objectives, LPIC-2 status, language, delivery route, and scheduling details with LPI before proceeding. In either case, use the official blueprint as the boundary of study and demonstrate security decisions instead of memorizing purported exam content.
Related exams
- 305-300 exam — LPIC-3: Virtualization and Containerization
- 300-300 exam — LPIC-3: Mixed Environments - Exam 300 - version 3.0
