Exam Vouchers: Linux Professional Institute LPIC-3 Exam 300 - Security (303-300)

The LPIC-3 certification is the culmination of the multi-level professional certification program of the Linux Professional Institute (LPI). LPIC-3 is designed for the enterprise-level Linux professional and represents the highest level of professional, distribution-neutral Linux certification within the industry. Four separate LPIC-3 specialty certifications are available. Passing any one of the four exams will grant the LPIC-3 certification for that specialty.

The LPIC-3 Security certification covers the administration of Linux systems enterprise-wide with an emphasis on security.

Current version: 3.0

Updated June 2026

Requirements: Passing the 303 exam. The 90-minute exam is 60 multiple-choice and fill in the blank questions.

Validity period: 5 years.

Renewal

Option 1 - Membership

When you join as a member, your certifications will remain active without writing additional exams. Your certification expiration date will be updated to the same expiration date as your membership.

Option 2 - Obtain a Higher Level of Certification

If a higher level LPIC certification is available, you can certify at the next level. Certifying at the next level will not only validate more of your skill set, it will also renew any lower-level LPIC certifications. For example, if you achieve an LPIC-2 certification, your LPIC-1 certification will be renewed to the same date as your LPIC-2.

Option 3 - Retake the Exams

Another way you can keep your certification active is to pass the current version of the exam(s) for the certification you currently hold.

This exam validates that the candidate can:

• Understand and implement cryptographic concepts and public key infrastructures (PKI)
• Configure and manage X.509 certificates for encryption, signing, and authentication
• Implement and maintain encrypted file systems and data protection mechanisms
• Apply DNS security and cryptographic protections (DNSSEC)
• Perform host security hardening and system protection
• Configure and manage host intrusion detection systems
• Control and limit system resources securely
• Implement discretionary and mandatory access control systems
• Configure and enforce network security and hardening measures
• Deploy and manage network intrusion detection solutions
• Configure packet filtering and firewall rules
• Implement and manage virtual private networks (VPNs)
• Identify security vulnerabilities and common threats
• Perform basic penetration testing and vulnerability assessments

1 Cryptography

• X.509 Certificates and Public Key Infrastructures (weight: 5):
• Understand X.509 certificates, X.509 certificate lifecycle, X.509 certificate fields and X.509v3 certificate extensions
• Understand trust chains and public key infrastructures, including certificate transparency
• Generate and manage public and private keys
• Create, operate and secure a certification authority
• Request, sign and manage server and client certificates
• Revoke certificates and certification authorities
• Basic feature knowledge of Let's Encrypt, ACME and certbot
• Basic feature knowledge of CFSSL
• X.509 Certificates for Encryption, Signing and Authentication (weight: 4):
• Understand SSL, TLS, including protocol versions and ciphers
• Configure Apache HTTPD with mod_ssl to provide HTTPS service, including SNI and HSTS
• Configure Apache HTTPD with mod_ssl to serve certificate chains and adjust the cipher configuration (no cipher-specific knowledge)
• Configure Apache HTTPD with mod_ssl to authenticate users using certificates
• Configure Apache HTTPD with mod_ssl to provide OCSP stapling
• Use OpenSSL for SSL/TLS client and server tests
• Encrypted File Systems (weight: 3):
• Understand block device encryption
• Use dm-crypt with LUKS to encrypt block devices
• Use eCryptfs to encrypt file systems, including home directories and PAM integration
• Be aware of plain dm-crypt and EncFS
• DNS and Cryptography (weight: 5):
• Understand DNSSEC concepts
• Configure DNSSEC zones and keys
• Understand the use of cryptography in DNS with BIND

2- Host Security

• Host Hardening (weight: 5):
• Configure secure system settings
• Disable unnecessary services
• Secure boot process
• Host Intrusion Detection (weight: 5):
• Configure and use host intrusion detection systems
• Monitor and analyze system activity
• Resource Control (weight: 3):
• Manage system resource limits
• Configure quotas and restrictions

3- Access Control

• Discretionary Access Control (weight: 3):
• Understand Linux file permissions
• Manage ownership and access rights
• Mandatory Access Control (weight: 5):
• Understand mandatory access control systems
• Configure SELinux or AppArmor policies

4- Network Security

• Network Hardening (weight: 4):
• Disable unused network services
• Secure network configurations
• Network Intrusion Detection (weight: 4):
• Configure network intrusion detection systems
• Analyze network traffic
• Packet Filtering (weight: 5):
• Configure packet filtering using firewall tools
• Manage firewall rules and policies
• Virtual Private Networks (weight: 4):
• Configure VPN solutions
• Understand secure tunneling protocols

5- Threats and Vulnerability Assessment

• Common Security Vulnerabilities and Threats (weight: 2):
• Understand common vulnerabilities
• Identify security threats
• Penetration Testing (weight: 3):
• Perform penetration testing techniques
• Use tools to identify vulnerabilities

Passing the 303 exam. The 90-minute exam is 60 multiple-choice and fill in the blank questions.