303-200
303-200: LPIC-3 Exam 303: Security, version 2.0
303-200: LPIC-3 Exam 303 Security Version 2.0 Guide
303-200 validated enterprise-wide Linux administration with an emphasis on security for experienced Linux professionals. Its version-2.0 blueprint covered cryptography, host security, access control, and network security, including certificates, encrypted filesystems, authentication, intrusion detection, packet filtering, and VPNs. This guide helps you make the most important planning decision first: whether you are researching a retired exam for historical preparation or should instead prepare for the current 303-300 objectives. It then maps the archived blueprint to practical lab work, study sequencing, and scheduling checks.
Is 303-200 still the exam you can schedule?
303-200 is a retired exam version, not the current LPIC-3 Security examination. LPI identifies version 2.0 as exam code 303-200 and states that it was available until April 4, 2022; the current version is 3.0 under exam code 303-300. Candidates should therefore confirm the code and objective version with LPI before purchasing a voucher or booking an appointment.
This distinction matters because the version-3.0 blueprint changes both the structure and emphasis of the security content. The archived 303-200 objectives organize the exam under Topics 325 through 328, while the current objectives use Topics 331 through 335 and add Threats and Vulnerability Assessment. A study plan built from the old blueprint should not be treated as preparation for 303-300.
LPI’s update explains that old exam versions remain available for six months after release of the newer version. The version-3.0 update records April 4, 2022 as the retirement date for LPIC-3 Security version 2.0. That historical information is useful when identifying an old certification record or reviewing legacy training material, but it does not establish current availability.
What decision should a candidate make now?
If your employer, training record, or certification documentation specifically refers to 303-200, use the archived objectives to understand the older assessment. If your goal is a new LPIC-3 Security certification, start with the official 303-300 objectives instead. Do not assume that a practice test labelled 303-200 reflects the current exam.
Before committing study time, check the exam code, objective version, prerequisite status, delivery language, and appointment options on LPI’s current certification page. This is an official verification step, not merely a study preference.
What did 303-200 validate?
303-200 was designed for the enterprise-level Linux professional rather than a beginner learning command-line administration. LPI describes LPIC-3 Security as administration of Linux systems enterprise-wide with an emphasis on security. The version-2.0 objectives translate that broad purpose into four technical domains: cryptography, host security, access control, and network security.
The exam measured whether a candidate could reason about secure configurations and use the associated tools, files, services, and protocols. It was not limited to definitions. The objectives included operating a certification authority, configuring Apache HTTPS, using LUKS and eCryptfs, managing authentication, applying mandatory access control, configuring intrusion detection, filtering traffic, and using OpenVPN and IPsec.
The appropriate audience was therefore an administrator who already understands Linux systems and can connect a security control to its operational consequences. Someone who has only memorized command names would still need practical work with configuration files, trust relationships, permissions, policy enforcement, and fault diagnosis.
Who should use the archived blueprint?
The archived blueprint is most useful to candidates studying a historical 303-200 attempt, instructors maintaining older course material, and administrators comparing changes between LPIC-3 Security versions. It can also help explain the security capabilities expected by older Linux enterprise environments.
It is not a safe substitute for the current blueprint. The official current objectives page labels the active exam as version 3.0 and exam code 303-300, while the archived wiki identifies the version-2.0 document as 303-200. Keep those documents separate in your notes and lab checklist.
How was the 303-200 blueprint organized?
The version-2.0 blueprint contained four domains. Topic 325 covered Cryptography; Topic 326 covered Host Security; Topic 327 covered Access Control; and Topic 328 covered Network Security. Each objective received a weight from 3 to 5 in the published outline, so the weight should guide study priority rather than be ignored as a simple topic label.
The weights indicate the relative emphasis assigned to each objective in the official objectives. They do not justify inventing an exact question allocation for this archived exam. Build coverage across every objective, then spend additional lab and review time on the weight-5 areas.
The objective list below preserves the official topic numbers and labels so that a candidate can cross-reference study notes accurately.
Which cryptography objectives mattered most?
Topic 325: Cryptography included four objectives. 325.1 X.509 Certificates and Public Key Infrastructures had weight 5 and required understanding certificates, trust chains, public and private keys, certificate authorities, signing, revocation, CRLs, OCSP, and OpenSSL-related formats and utilities.
325.2 X.509 Certificates for Encryption, Signing and Authentication had weight 4 and focused on server and client authentication, Apache HTTPD 2.4 or higher, mod_ssl, HTTPS, SNI, HSTS, OCSP stapling, and OpenSSL testing. 325.3 Encrypted File Systems had weight 3 and covered block-device and filesystem encryption, dm-crypt with LUKS, eCryptfs, home-directory encryption, and PAM integration.
325.4 DNS and Cryptography had weight 5. Its scope included DNSSEC concepts and implementation with BIND, including signing and re-signing zones, key handling, relevant DNSSEC records, and DANE-related certificate information. The archived objectives specify BIND 9.7 or higher.
Which host-security objectives were measured?
Topic 326: Host Security combined system hardening, detection, identity, and centralised security administration. 326.1 Host Hardening had weight 3 and included BIOS and GRUB 2 security, kernel and system controls, limits, and defensive configuration against common threats.
326.2 Host Intrusion Detection had weight 4. Candidates were expected to understand common host intrusion-detection software and the associated operational tasks. The objective’s utility list included auditd, auditctl, ausearch, aureport, PAM terminal auditing, chkrootkit, rkhunter, maldet, and AIDE.
326.3 User Management and Authentication had weight 5. It covered user-account management, authentication controls, PAM-related files and modules, password and login policy, faillog or tally mechanisms, SSSD, and Kerberos-related commands and configuration. 326.4 FreeIPA Installation and Samba Integration had weight 4 and required familiarity with FreeIPA 4.x and its relationship with Samba.
What did access control include?
Topic 327: Access Control covered both local policy and network file access. 327.1 Discretionary Access Control had weight 3 and required ownership, permissions, SetUID and SetGID, access control lists, extended attributes, and tools such as getfacl, setfacl, getfattr, and setfattr.
327.2 Mandatory Access Control had weight 4 and focused on Linux MAC systems. The objective list included SELinux state and policy tools such as getenforce, setenforce, getsebool, setsebool, restorecon, semanage, sestatus, audit2why, and audit2allow. The practical distinction between DAC permission checks and MAC policy decisions is central to this area.
327.3 Network File Systems had weight 3. It included security issues in NFSv4 clients and servers and CIFS client services, together with ownership, permissions, security modes, winbind, and getcifsacl or setcifsacl. Earlier NFS versions were not required knowledge according to the archived objectives.
What did network security measure?
Topic 328: Network Security included hardening, detection, packet filtering, and VPNs. 328.1 Network Hardening had weight 4 and addressed securing networks against common threats, including relevant network services and security controls.
328.2 Network Intrusion Detection had weight 4. Candidates needed familiarity with network security scanning, monitoring, and intrusion-detection software. The listed tools and files included ntop, Snort, snort-stat, Snort rules, OpenVAS utilities, NASL-related operation, and OpenVAS configuration paths.
328.3 Packet Filtering had weight 5 and required familiarity with the use and configuration of packet filters. The listed technologies included iptables, ip6tables, ipset, nft, and ebtables, along with save and restore utilities. 328.4 Virtual Private Networks had weight 4 and covered OpenVPN and IPsec, including their configuration files and related tools.
How should you turn the objectives into lab work?
Start with a controlled Linux lab and make every high-priority objective produce a visible result. A useful lab does not need to reproduce a production network, but it should let you create a certificate chain, deny and permit traffic, change an access policy, inspect authentication logs, and recover from a deliberately incorrect setting.
Use snapshots or disposable virtual machines before testing encryption, firewall policies, bootloader changes, FreeIPA, or MAC rules. Keep a change log containing the command used, the configuration file changed, the expected effect, the verification command, and the rollback step. This turns passive reading into evidence that you understand cause and effect.
Do not rely on a single distribution-specific tutorial without checking the objective wording. Package names, service units, default paths, and policy tooling can vary. The exam blueprint is vendor-neutral, so learn the concept and the standard utility relationship, then verify syntax in the environment you use for practice.
A certificate and HTTPS lab
Build a small certificate-authority hierarchy with OpenSSL. Generate private keys, create a certificate signing request, sign server and client certificates, inspect certificate fields, verify a trust chain, and revoke a certificate. Record the purpose of PEM, DER, PKCS, CSR, CRL, and OCSP in the workflow rather than as isolated flashcards.
Use Apache HTTPD with mod_ssl to configure an HTTPS virtual host. Practise certificate chains, SNI, client-certificate authentication, HSTS, and OCSP stapling at the level required by the objectives. Use OpenSSL client and server tests to inspect the handshake and distinguish a certificate problem from a protocol or trust problem.
For DNS and cryptography, create a lab zone and map the purpose of DNSSEC keys, signatures, DS records, RRSIG, NSEC or NSEC3, and validation tools. The goal is to explain the signing and validation path, not to copy a configuration without understanding which key or record is involved.
A host, identity, and access-control lab
Create test users and groups, then compare traditional mode bits with ACL entries and extended attributes. Change SetUID and SetGID deliberately in the lab and verify ownership and effective access. When a file access attempt fails, identify whether the decision comes from discretionary permissions, a MAC policy, filesystem context, or an authentication layer.
Practise SELinux state inspection, boolean management, context restoration, policy diagnosis, and controlled troubleshooting. Use audit output to form a hypothesis before applying a policy change. Treat audit2allow as a tool requiring review, not as an automatic answer; a locally generated allowance can conceal a wrongly labelled file or an unsafe service design.
For identity services, trace the relationship among NSS, PAM, SSSD, Kerberos, LDAP, FreeIPA, and Samba. Practise a basic authentication flow and document which component supplies identity lookup, which component authenticates, and which configuration file or command verifies the result.
A packet-filtering and VPN lab
Build a filtering policy with an explicit default posture, permitted management access, service rules, logging decisions, and persistence or restore procedures. Test both IPv4 and IPv6 where your lab supports them. Compare iptables-style concepts with nft and understand the purpose of ipset and ebtables from the objective list.
Create an OpenVPN test connection and inspect the client and server configuration relationship. For IPsec, identify the roles of the relevant configuration files and setkey-related tools listed in the objectives. Practise checking routes, negotiated parameters, authentication failures, and packet-filter interactions rather than memorizing one working sample.
Add a small monitoring and detection exercise. Use packet capture or network-monitoring tools to identify the traffic you expect, then compare it with an intrusion-detection alert or scanner result. Keep the exercise defensive and limited to systems you control; the objectives do not make unauthorised testing acceptable.
What study sequence gives the best coverage?
Study in dependency order rather than simply reading Topics 325 through 328 once. Begin with the controls that other subjects rely on, then move to services and finally integrate them in troubleshooting scenarios. This sequence also exposes weak prerequisites early, before you spend time on advanced certificate, identity, or network exercises.
A practical order is: baseline Linux permissions and authentication; cryptography and certificates; encrypted filesystems; host hardening and detection; MAC and network filesystems; packet filtering and network detection; VPNs; then integrated review. Give the weight-5 objectives extra practice, but do not abandon weight-3 objectives because a narrow study plan can leave important gaps.
Use the archived objective document as the master checklist. Mark each objective as read, explained, performed, and diagnosed. “Read” alone is not a readiness measure for a configuration-heavy security exam.
Phase one: establish the control-plane foundations
Refresh file ownership, mode bits, ACLs, extended attributes, PAM, NSS, service management, logging, DNS, routing, and basic networking. These are preparation foundations for the security objectives, not a replacement for them. Note the commands you use to inspect state and the evidence that confirms a change worked.
Next, map each tool in the objective list to a job. For example, associate getfacl with ACL inspection, ausearch with audit-event searching, openssl with certificate operations, dig and delv with DNS-related testing, and iptables-save or nft with firewall state. This prevents a utility list from becoming disconnected memorization.
Phase two: complete the high-weight security domains
Prioritise 325.1 X.509 Certificates and Public Key Infrastructures with weight 5, 325.4 DNS and Cryptography with weight 5, 326.3 User Management and Authentication with weight 5, and 328.3 Packet Filtering with weight 5. These are official objective weights, not a promise of an exact number of questions.
Follow those with 325.2 X.509 Certificates for Encryption, Signing and Authentication with weight 4, 326.2 Host Intrusion Detection with weight 4, 326.4 FreeIPA Installation and Samba Integration with weight 4, 327.2 Mandatory Access Control with weight 4, 328.1 Network Hardening with weight 4, 328.2 Network Intrusion Detection with weight 4, and 328.4 Virtual Private Networks with weight 4.
Finish the remaining weight-3 objectives through focused labs: 325.3 Encrypted File Systems, 326.1 Host Hardening, 327.1 Discretionary Access Control, and 327.3 Network File Systems. Their lower relative weight does not make them optional.
Phase three: integrate and diagnose
Construct scenarios that cross domains: an Apache client certificate fails because the chain is incomplete; a service cannot read an encrypted filesystem after reboot; an authenticated user reaches a share but is denied by ACL or MAC policy; a VPN connects but its traffic is rejected by the packet filter; or a DNSSEC validation failure is mistaken for a general DNS outage.
For each scenario, write a short diagnostic path. Start with observable symptoms, inspect the relevant state, isolate one layer, apply the smallest safe change, and verify both the intended access and the unintended side effects. This is a stronger final review method than rereading every command in isolation.
How should you use the exam format when practising?
LPI states that the 90-minute exam is 60 multiple-choice and fill-in-the-blank questions. Treat that as an official delivery detail for the exam information provided, while confirming the current appointment information separately because 303-200 itself is retired.
Practise switching between recognition and recall. Multiple-choice work tests whether you can distinguish plausible controls; fill-in-the-blank work requires you to retrieve a command, file, protocol term, or configuration concept without a list of alternatives. Neither format requires leaked questions, and memorising question banks is not a substitute for understanding the objectives.
Use timed review only after you can explain the labs. Begin by answering objective by objective without a clock, then introduce short timed sets. Review every wrong answer by identifying the underlying concept and the evidence you would inspect on a real system.
What should you verify before booking?
The archived 303-200 page lists English and Japanese for VUE test centers and English and Japanese for online OnVUE delivery. Because the version is retired, do not infer that these options remain available for booking. Check LPI’s current certification page and the test-delivery provider before making a scheduling decision.
LPI identifies an active LPIC-2 certification as a prerequisite for receiving LPIC-3 Security certification and lists passing the 303 exam as the requirement. The current page refers to 303-300, so candidates researching 303-200 should confirm how any historical result or record is treated rather than assuming that an old objective version can be newly certified.
The current LPIC-3 Security page lists a validity period of 5 years and provides options for extension beyond 5 years. Apply that information to the certification policy you are pursuing, not as evidence that 303-200 can still be taken.
Which mistakes most often weaken preparation?
The most damaging mistake is studying the wrong version. A title containing “LPIC-3 Security” is not enough: compare the exam code and objective version. A second mistake is treating the weight as a complete study plan. Weight helps allocate time, but every published objective remains part of the blueprint.
Avoid tool-only memorisation. Knowing that cryptsetup, ausearch, setfacl, openssl, or nft appears in an objective is weaker than knowing what state the tool changes, what output confirms success, and what failure it can create. Build a small command-and-evidence table for every tool you study.
Do not collapse all access failures into permissions. Check DAC, ACLs, extended attributes, MAC contexts and policy, filesystem export or share controls, identity lookup, authentication, and the network filter as separate layers. The same discipline applies to certificate failures: inspect identity, trust chain, validity, protocol negotiation, server configuration, and revocation-related behaviour.
Do not spend your final preparation time on unsupported breadth. The version-2.0 objectives explicitly name technologies such as Apache HTTPD 2.4 or higher, BIND 9.7 or higher, LUKS, eCryptfs, FreeIPA 4.x, OpenVPN, IPsec, Snort, OpenVAS, and Linux packet-filter tools. Use the official list to decide what belongs in the lab, and avoid expanding into every security product you encounter.
How can you detect a real knowledge gap?
For each objective, attempt three tasks: explain the security purpose, perform a minimal configuration, and diagnose one failure. If you can only define the term, label the objective as theory-only. If you can configure it but cannot verify or undo it, label it as practice-incomplete. This gives you a more useful readiness picture than a single percentage score from an unofficial quiz.
Pay particular attention to boundaries between related areas: X.509 certificates versus DNSSEC keys, encryption at rest versus authentication, DAC versus MAC, host intrusion detection versus network intrusion detection, and a VPN tunnel versus the packet-filter rules that permit its traffic. These boundaries are where shallow revision commonly breaks down.
What should you do next?
First, confirm whether your target is historical 303-200 documentation or a current 303-300 appointment. Second, download or review the matching official objectives and create a checklist of every topic and objective. Third, inventory your lab capabilities and start with certificates, authentication, access control, and packet filtering.
Then schedule study blocks around outputs rather than chapters: a signed certificate chain, an encrypted test volume, a working and diagnosed MAC policy, an audited authentication event, a verified firewall policy, and a tested VPN path. Save concise notes showing the configuration, verification, failure symptom, and rollback method.
Finally, verify current LPI requirements, languages, delivery choices, pricing, and certification status directly before purchasing anything. The official sources distinguish the retired 303-200 from the current 303-300; your booking decision should do the same.
Official material to keep open while studying
Use the archived LPIC-303 version-2.0 objectives for historical 303-200 coverage, the current exam page for present certification information, and LPI’s version-update notice to understand the retirement context. The learning-materials translation page can help you check whether official learning resources are available in your preferred language, but it does not make the archived exam current.
When two sources appear inconsistent, prefer the source that names the exact exam code and objective version, and verify the live certification page before scheduling. This prevents legacy objective pages, current pages, and third-party practice material from being mixed into one misleading plan.
Conclusion
303-200 is best treated as an archived LPIC-3 Security blueprint: useful for historical study and record interpretation, but not a basis for assuming current exam availability. Its strongest preparation pattern remains practical and evidence-led—map the four official domains, prioritise the weighted objectives, practise the named security tools in a disposable lab, and diagnose failures across configuration layers. If you need a new certification, confirm the current 303-300 requirements and objectives before you invest in the old version.
Related exams
- 305-300 exam — LPIC-3: Virtualization and Containerization
- 300-300 exam — LPIC-3: Mixed Environments - Exam 300 - version 3.0