LPIC-2 Practice Test 10 — 10 Questions

Question 1

A host on 192.168.2.100 tries to SSH to the firewall's IP address (192.168.1.1). The firewall's input chain policy is drop. Will the SSH connection be allowed?

Accepted Answer

No, because the input chain drops all packets that don't match rules.. The stem provides no specific firewall rule. With the input chain policy set to 'drop', all packets not matching any rule are dropped. Since no rule is stated to permit SSH, the connection from 192.168.2.100 to 192.168.1.1 will be blocked. Therefore, the correct answer is 'No' (Option A). Options B and C are incorrect because they either misidentify the traffic type or reference a non‑existent forward rule. Option D is incorrect because the stem does not mention any rule accepting SSH from the 192.168.2.0/24 subnet; such a rule is not provided.

Answer

No, because SSH to firewall is considered forwarded traffic.

Answer

Yes, because the forward chain accepts SSH.

Answer

Yes, because there is a rule accepting SSH from 192.168.2.0/24.

Question 2

An administrator needs to configure a Linux client to automatically obtain an IP address from a DHCP server but also ensure that the client uses a specific static DNS server (8.8.8.8) regardless of the DHCP-provided DNS. Which configuration should be applied?

Accepted Answer

Add 'supersede domain-name-servers 8.8.8.8;' to /etc/dhcp/dhclient.conf. The `supersede` directive in `/etc/dhcp/dhclient.conf` forces the DHCP client to replace any DNS server addresses received from the DHCP server with the specified value (8.8.8.8). This ensures the client uses the static DNS server regardless of what the DHCP server offers, while still obtaining its IP address dynamically.

Answer

Add 'append domain-name-servers 8.8.8.8;' to /etc/dhcp/dhclient.conf

Answer

Edit /etc/sysconfig/network-scripts/ifcfg-eth0 and set PEERDNS=no and DNS1=8.8.8.8

Answer

Add 'prepend domain-name-servers 8.8.8.8;' to /etc/dhcp/dhclient.conf

Question 3

Which THREE statements about PAM configuration are correct? (Select three.)

Accepted Answer

The order of modules in a stack affects the outcome.. Option C is correct because PAM processes each module type's stack in the order listed in the configuration file, and the sequence determines which modules run and how their results combine, so reordering can change the final outcome. Option D is correct because the 'requisite' control flag requires the module to succeed, and on failure it returns immediately without invoking any remaining modules in that stack. Option E is correct because 'sufficient' means that if the module succeeds and no prior required/requisite module has failed, PAM grants success immediately and skips the rest of the stack. Option A is not correct as stated because 'required' failure does not halt processing immediately; PAM continues evaluating the remaining modules and only fails after the stack completes. Option B is not correct because 'auth' performs authentication (verifying identity, e.g., password), whereas account management is handled by the 'account' module type.

Answer

The control flag 'required' means the module must succeed; if it fails, authentication fails immediately.

Answer

The module type 'auth' is used for account management.

Question 4

A server with IP 10.0.0.1 needs to forward packets from network 192.168.1.0/24 to 10.0.0.0/24. The administrator runs: 'iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j MASQUERADE'. However, traffic from 192.168.1.0/24 cannot reach 10.0.0.0/24. What is the most likely missing configuration?

Accepted Answer

The FORWARD chain in the filter table must have a rule to allow traffic.. The MASQUERADE rule in the POSTROUTING chain handles source NAT, but it does not automatically allow forwarding of packets. By default, the FORWARD chain in the filter table has a policy of DROP or lacks an explicit ACCEPT rule. Without a rule like `iptables -A FORWARD -s 192.168.1.0/24 -d 10.0.0.0/24 -j ACCEPT`, the kernel's netfilter will drop the forwarded packets, preventing traffic from reaching the destination.

Answer

A DNAT rule is also needed to translate the destination address.

Answer

A route must be added on the 10.0.0.0/24 network pointing back to 10.0.0.1.

Answer

The IP address 10.0.0.1 is not configured on the external interface.

Question 5

Which THREE of the following are valid bonding modes in Linux?

Accepted Answer

mode 2 (balance-xor). (mode 2, balance-xor) is a valid bonding mode that uses a hash policy (typically based on MAC addresses) to select a slave interface for outgoing traffic, providing both load balancing and fault tolerance. It is one of the seven standard bonding modes defined in the Linux kernel bonding driver (modes 0 through 6).

Answer

mode 8

Answer

mode 7

Question 6

Which THREE of the following are correct statements about LVM thin provisioning? (Select THREE)

Accepted Answer

Snapshots of thin volumes use the same pool.. Option B is correct because thin provisioning lets you create thin volumes whose combined virtual size exceeds the actual free space in the thin pool, i.e., it overcommits physical storage, with space allocated on demand as data is written. Option D is correct because a thin volume's virtual size can exceed the pool's physical size, since blocks are allocated lazily from the pool only when written. Option A is correct because snapshots of thin volumes are themselves thin volumes that draw their changed blocks from the same thin pool as their origin, sharing that pool's free space. Option C is wrong because shrinking a thin pool below the space already consumed by its thin volumes and snapshots risks data loss and is not a safe operation. Option E is wrong because the thin pool must exist first; thin volumes are created within an existing thin pool, not before it.

Answer

A thin pool can be resized smaller without data loss.

Answer

Thin volumes must be created before the thin pool.

Question 7

Which three PAM modules can be used to enforce password complexity? (Select three.)

Accepted Answer

pam_passwdqc.so. pam_passwdqc.so (B) is a PAM module specifically designed to enforce password strength by checking new passwords against configurable complexity rules such as minimum length, character classes, and dictionary words. pam_pwquality.so (D) is the modern replacement for pam_cracklib and enforces password complexity via settings like minlen, dcredit, ucredit, lcredit, ocredit, and difok in /etc/security/pwquality.conf. pam_cracklib.so (E) is the classic PAM module that performs password strength checking, rejecting weak passwords based on length, character variety, and similarity to the old password. The other options do not enforce complexity: pam_securetty.so (A) restricts root logins to secure TTYs, and pam_unix.so (C) handles standard Unix authentication and password changes but does not itself enforce complexity rules.

Answer

pam_securetty.so

Answer

pam_unix.so

Question 8

Which three conditions must be met for a filesystem to be mounted by UUID in /etc/fstab? (Choose three.)

Accepted Answer

The UUID must be present in /dev/disk/by-uuid/. Option C is correct because /etc/fstab entries using UUID= rely on the udev-managed symlinks in /dev/disk/by-uuid/, which map each filesystem's UUID to its actual block device node; without that symlink the mount cannot resolve the device. Option D is correct because a UUID only exists if the filesystem was created by a tool that writes one into the superblock (for example mkfs.ext4, mkfs.xfs, or mkswap); filesystems lacking UUID support cannot be referenced by UUID at all. Option E is correct because the UUID string in the fstab entry must exactly match the UUID stored on the filesystem, otherwise mount fails with an error such as 'can't find UUID='. Option A is not required: blkid merely reads and displays existing UUIDs and does not create them, so running it is irrelevant to mounting. Option B is not required: UUIDs are resolved by udev and mount from the device symlinks, not from kernel boot parameters such as root=UUID=, which only affect the root filesystem.

Answer

The blkid command must have been run at least once

Answer

The UUID must be listed in the kernel's boot parameters

Question 9

A Linux client is configured to use PAM for authentication against an LDAP server. The /etc/pam.d/system-auth includes 'auth required pam_ldap.so'. Users can authenticate successfully. However, when a user runs 'id username', it shows 'uid=1000(username) gid=100(users) groups=100(users)' but the LDAP group membership is not shown. Which configuration file is most likely misconfigured?

Accepted Answer

The /etc/nsswitch.conf 'group' line does not include 'ldap'.. The 'id' command queries the Name Service Switch (NSS) to resolve user and group information. Even though PAM (via pam_ldap.so) successfully authenticates the user against LDAP, the group membership lookup fails because NSS is not configured to consult LDAP for group data. The /etc/nsswitch.conf file must include 'ldap' in the 'group' line (e.g., 'group: files ldap') to enable the system to retrieve LDAP group memberships.

Answer

The PAM configuration uses 'required' instead of 'sufficient' for pam_ldap.

Answer

The /etc/ldap.conf file is missing the 'nss_base_group' line.

Answer

The autofs service is not running.

Question 10

Which THREE of the following are correct about RAID 1 in mdadm? (Select THREE)

Accepted Answer

It can have a hot spare.. Option B is correct because mdadm RAID 1 arrays support hot spares: a spare device can be added with `mdadm --add` and will automatically replace a failed member, and it can be designated as a spare during creation with `--spare-devices`. Option C is correct because RAID 1 is mirroring, which by definition needs at least two block devices to hold identical copies of the data, so `mdadm --create --level=1` requires a minimum of two member disks. Option D is correct because RAID 1's defining characteristic is mirroring, i.e., every write is duplicated to all member disks so each holds a complete copy of the data. Option A is not correct because striping (distributing data across disks without duplication) is RAID 0, not RAID 1. Option E is not correct because the write-intent bitmap is an optional mdadm feature used to speed resynchronization after a crash or disk replacement, not an inherent property of RAID 1.

Answer

It provides striping.

Answer

It uses a bitmap for resync.