Reinforce LPIC-2 concepts with active-recall study cards covering all 7 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For LPIC-2 preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the LPIC-2 question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your LPIC-2 flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real LPIC-2 exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass LPIC-2.
Sample cards from the LPIC-2 flashcard bank. Read the question, think of the answer, then read the explanation below.
A system administrator notices that the default gateway is missing after a reboot. The network configuration uses ifup/ifdown scripts. Which file should be modified to ensure the default gateway is persistent?
/etc/network/interfaces
On Debian-based systems using ifup/ifdown scripts, persistent network configuration—including the default gateway—is defined in /etc/network/interfaces. The gateway is set with the 'gateway' directive under the appropriate interface stanza, ensuring it is applied automatically on boot. This file is the central configuration source for the ifupdown suite.
A server with IP 10.0.0.1 needs to forward packets from network 192.168.1.0/24 to 10.0.0.0/24. The administrator runs: 'iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j MASQUERADE'. However, traffic from 192.168.1.0/24 cannot reach 10.0.0.0/24. What is the most likely missing configuration?
The FORWARD chain in the filter table must have a rule to allow traffic.
The MASQUERADE rule in the POSTROUTING chain handles source NAT, but it does not automatically allow forwarding of packets. By default, the FORWARD chain in the filter table has a policy of DROP or lacks an explicit ACCEPT rule. Without a rule like `iptables -A FORWARD -s 192.168.1.0/24 -d 10.0.0.0/24 -j ACCEPT`, the kernel's netfilter will drop the forwarded packets, preventing traffic from reaching the destination.
A system administrator notices that a new 1TB NVMe drive (/dev/nvme0n1) is not detected by the kernel. The hardware is confirmed working. Which troubleshooting step should be taken first to check if the drive is recognized by the system's PCI subsystem?
Run lspci to verify the NVMe controller is detected.
The NVMe drive is not detected by the kernel, but the hardware is confirmed working. The first step is to verify whether the PCI subsystem sees the NVMe controller, because NVMe devices are connected via the PCI Express bus. Running lspci lists all PCI devices, including the NVMe controller; if it does not appear, the issue is at the PCI or hardware level, not the block layer.
The administrator wants to create a RAID 1 array using /dev/sdb1 and /dev/sdc1, then create a filesystem and mount it at /mnt/raid1. Which command sequence should be used first?
mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1
The first step in creating a RAID 1 array is to assemble the underlying block devices into a RAID device using mdadm. The command `mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1` initializes the RAID metadata and creates the array at /dev/md0. Only after the array is created can a filesystem be built on it and then mounted.
A system administrator needs to ensure that a custom kernel module loads automatically at boot. The module is named 'my_driver' and is built for the current kernel. Which configuration file should be modified to ensure the module loads automatically?
Add a configuration file in /etc/modules-load.d/
Systemd-based Linux distributions use /etc/modules-load.d/ to specify kernel modules that should be loaded automatically at boot. Placing a configuration file (e.g., my_driver.conf) containing the module name 'my_driver' in this directory instructs systemd-modules-load.service to load the module during early boot. This is the modern, distribution-agnostic method for ensuring a custom kernel module loads automatically.
A server with a custom kernel fails to boot after a kernel update. The system displays a kernel panic: 'VFS: Unable to mount root fs on unknown-block(0,0)'. The root filesystem is on an LVM volume. What is the most likely cause?
The initramfs is missing LVM support.
The kernel panic 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate the root filesystem. Since the root filesystem resides on an LVM volume, the initramfs must contain LVM tools and modules to activate the volume group and logical volumes before the kernel can mount the root. If the initramfs was not rebuilt after the kernel update, it will lack LVM support, causing the boot failure.
A company uses BIND9 as the authoritative name server for its public zone example.com. External users report that they cannot resolve the MX record for the domain, but internal users can. What is the most likely cause?
The allow-query ACL restricts queries to the internal network.
The allow-query ACL in BIND9 restricts which source IP addresses are permitted to send queries to the server. If it is set to allow only the internal network (e.g., 192.168.0.0/16), external users' queries are rejected, causing resolution failures for MX records and all other records. Internal users succeed because their IPs match the ACL, while external users receive a REFUSED response or no answer.
A mail server running Postfix is deferring messages for a local user. The mail log shows 'status=deferred (mailbox is locked)'. What is the most likely cause?
The user's mailbox is currently being accessed by a POP3 client.
The 'mailbox is locked' message in Postfix logs indicates that the mailbox file is currently locked by another process, typically a POP3 or IMAP client that has the mailbox open for exclusive access. Postfix defers delivery because it cannot acquire the necessary lock to write to the mailbox, ensuring data integrity. This is a standard behavior defined by the mailbox locking mechanism (e.g., fcntl, dotlock) used by the MTA and MDA.
An administrator needs to configure a Linux client to automatically obtain an IP address from a DHCP server but also ensure that the client uses a specific static DNS server (8.8.8.8) regardless of the DHCP-provided DNS. Which configuration should be applied?
Add 'supersede domain-name-servers 8.8.8.8;' to /etc/dhcp/dhclient.conf
The `supersede` directive in `/etc/dhcp/dhclient.conf` forces the DHCP client to replace any DNS server addresses received from the DHCP server with the specified value (8.8.8.8). This ensures the client uses the static DNS server regardless of what the DHCP server offers, while still obtaining its IP address dynamically.
Which file is used by the NetworkManager daemon to store connection profiles on a Linux system?
/etc/NetworkManager/system-connections/
NetworkManager stores per-connection profiles in the `/etc/NetworkManager/system-connections/` directory. Each profile is a keyfile (`.nmconnection` file) containing connection parameters such as SSID, security settings, and IP configuration. When NetworkManager starts or a connection is modified, it reads and writes these files to persist network configurations across reboots.
A system administrator notices that the SSH service on a Linux server is failing to start. The log shows: 'sshd: error: Could not load host key: /etc/ssh/ssh_host_rsa_key'. What is the most likely cause and solution?
The host key file is missing or corrupt. Run 'ssh-keygen -A' to regenerate all missing host keys.
The error message indicates that the SSH daemon cannot load the RSA host key file. Host keys are generated during package installation or manually via ssh-keygen. Option D is correct because running 'ssh-keygen -A' automatically generates all missing host key types (RSA, ECDSA, Ed25519) that are configured for use, resolving the missing or corrupt key issue without manual intervention.
A security policy requires that all users must change their passwords every 90 days. Which command enforces maximum password age for an existing user 'jdoe'?
chage -M 90 jdoe
The `chage -M 90 jdoe` command sets the maximum number of days a password is valid for user 'jdoe' to 90 days, enforcing the security policy. The `-M` option directly controls the password aging parameter that defines when the password must be changed, as stored in `/etc/shadow`.
A company wants to use Samba to share files with Windows clients. Which service must be enabled in Samba to support Windows Active Directory domain membership?
winbind
Winbind (winbindd) is the Samba service that integrates with Windows Active Directory by resolving user and group information from the domain controller. It uses the Microsoft Active Directory authentication protocol (Kerberos) and LDAP to map Windows domain users to local Unix accounts, enabling domain membership and single sign-on.
A Samba share is configured with 'force user = jane'. A user 'bob' accesses the share. With what effective user ID will file operations be performed?
jane
The 'force user' directive in Samba overrides the authenticated user's identity for all file operations on the share. When 'force user = jane' is set, any user accessing the share, including 'bob', will have their effective user ID changed to 'jane' for all file reads, writes, and ownership checks. This ensures that files created or modified on the share are owned by 'jane', regardless of who actually connects.
The LPIC-2 flashcard bank covers all 7 official blueprint domains published by LPI. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Advanced Networking Configuration
Block Devices, Filesystems and Advanced Storage
Linux Kernel and System Startup
DNS, Web and Mail Services
Network Client Management
System Security
File Sharing and Samba
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that LPIC-2 questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.LPIC-2 questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective LPIC-2 study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free LPIC-2 flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 355+ original LPIC-2 flashcards across all 7 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are checked against the official LPI exam objectives, with editorial oversight from an experienced network and security engineer.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official LPIC-2 exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included