LPIC-2 Practice Test 11 — 15 Questions

Question 1

Refer to the exhibit. Which module is currently in use by another module?

Accepted Answer

kvm. The `lsmod` command shows that `kvm` has a 'Used by' count of 1, indicating another module is currently using it. The 'Used by' column lists the modules that depend on the given module, so `kvm` is in use by another module (likely `kvm_intel` or `kvm_amd`). This is the correct interpretation because the question asks which module is currently in use by another module, and `kvm` is the one with a non-zero 'Used by' value.

Answer

usb_storage

Answer

kvm_intel

Answer

aesni_intel

Question 2

A new network card driver module is not being loaded at boot. The administrator wants to ensure the module is loaded automatically without modifying the kernel command line. Which file should be used?

Accepted Answer

/etc/modules-load.d/.conf. /etc/modules-load.d/.conf is the standard configuration directory used by systemd-modules-load.service to load kernel modules at boot without modifying the kernel command line. Files in this directory list module names (one per line) that are loaded automatically during early boot, making it the proper mechanism for ensuring a network card driver module is loaded.

Answer

/lib/modules/$(uname -r)/modules.builtin

Answer

/etc/modprobe.d/<name>.conf

Answer

/etc/rc.local

Question 3

A web server is running in enforcing mode under SELinux. The administrator wants to allow Apache to connect to a remote database server. Which SELinux boolean needs to be set to allow httpd to make network connections?

Accepted Answer

httpd_can_network_connect_db. The SELinux boolean `httpd_can_network_connect_db` is specifically designed to allow the httpd process to connect to remote database servers. This boolean is more targeted than the generic `httpd_can_network_connect`, which permits all outbound TCP connections. Since the question explicitly mentions a remote database server, the specific boolean is the most appropriate choice.

Answer

httpd_enable_homedirs

Answer

httpd_can_network_connect

Answer

httpd_unified

Question 4

A new user has been added to the LDAP directory, but the user cannot log in. The admin confirms the LDAP server is reachable and the user entry exists. Which of the following is the most likely missing configuration?

Accepted Answer

The PAM configuration does not include pam_ldap.. D is correct because even if the LDAP server is reachable and the user entry exists, the system must be configured to use LDAP for authentication. PAM (Pluggable Authentication Modules) controls how authentication is performed; without pam_ldap (or pam_ldap.so) in the PAM stack, the system will not consult the LDAP server during login, so authentication fails regardless of the LDAP directory contents.

Answer

The LDAP server does not have the correct schema for the user.

Answer

The nscd cache is stale and needs to be cleared.

Answer

The nsswitch.conf file should have 'ldap' before 'files' for passwd.

Question 5

A storage administrator sees the following output from multipath -ll: 'dm-3 (3600605b0038f1f0019f1f7e00000000) size=10G features='0' hwhandler='0' wp=rw' but the paths are all 'failed'. The scsi devices are listed in /proc/scsi/scsi. What is the most likely cause?

Accepted Answer

The SAN fiber cables are disconnected. The output from multipath -ll shows the multipath device dm-3 with its WWID and size, but all paths are 'failed'. Since /proc/scsi/scsi lists the SCSI devices, the host bus adapters (HBAs) and drivers are functioning at the OS level. The most common cause for all paths to fail simultaneously is a physical connectivity issue, such as disconnected SAN fiber cables, which prevents the initiator from reaching the target LUNs.

Answer

The device mapper is not configured

Answer

The multipathd daemon is not running

Answer

The multipath configuration uses user_friendly_names but the bindings file is missing

Question 6

Which THREE of the following are correct about RAID 1 in mdadm? (Select THREE)

Accepted Answer

It can have a hot spare.. RAID 1 in mdadm provides mirroring, where data is written identically to two or more disks. A hot spare is supported: if a disk fails, mdadm automatically rebuilds the mirror onto the spare. This requires at least 2 disks to form the mirror.

Answer

It provides striping.

Answer

It uses a bitmap for resync.

Question 7

After upgrading the kernel on a Red Hat Enterprise Linux system, the system fails to boot because the initramfs is missing. Which command can be used to regenerate the initramfs?

Accepted Answer

dracut -f. On Red Hat Enterprise Linux (RHEL) systems, the `dracut` utility is the standard tool for creating and regenerating initial RAM filesystem images (initramfs). The `-f` (force) option overwrites an existing initramfs file, which is necessary after a kernel upgrade to ensure the new kernel has the correct drivers and modules to mount the root filesystem during boot. Without a valid initramfs, the kernel cannot access the root filesystem, causing a boot failure.

Answer

mkinitrd -f

Answer

grub2-mkconfig -o /boot/grub2/grub.cfg

Answer

mkinitramfs -o /boot/initrd.img

Question 8

A Linux client is experiencing slow name resolution. The /etc/nsswitch.conf file has the line 'hosts: files dns'. The /etc/hosts file contains many entries. What is the most effective way to improve resolution speed?

Accepted Answer

Change the nsswitch.conf line to 'hosts: dns files'. The current order 'hosts: files dns' causes the resolver to check the entire /etc/hosts file first for every query, which is slow when the file contains many entries. Reversing the order to 'hosts: dns files' makes the resolver query DNS first, which is typically faster for most lookups, and only falls back to the local file if DNS fails. This directly addresses the bottleneck without requiring additional services or data removal.

Answer

Increase the DNS timeout in /etc/resolv.conf

Answer

Install and configure nscd (Name Service Cache Daemon)

Answer

Remove all entries from /etc/hosts except localhost

Question 9

An administrator observes that only one path is shown as active for mpathb. What is the most likely cause?

Accepted Answer

The blacklist rule excludes the other path.. When only one path is active for a multipath device (mpathb), the most likely cause is that the other path is being excluded by a blacklist rule in the multipath configuration. The blacklist can filter out devices based on WWID, device name, or vendor/product, preventing them from being aggregated into the multipath map. This results in the path being visible to the system but not used by multipathd.

Answer

The find_multipaths setting is incorrect.

Answer

The SCSI devices are not properly connected.

Answer

The multipathd service is not running.

Question 10

Which TWO options in dhcpd.conf are used to define the subnet and the address range for dynamic allocation? (Select two.)

Accepted Answer

range 192.168.1.10 192.168.1.100;. The `range` directive in `dhcpd.conf` explicitly defines the pool of IP addresses available for dynamic (DHCP) allocation. Option E is correct because the `subnet` declaration specifies the network segment and netmask, creating the context in which the `range` statement must be nested to function. Together, they define both the subnet boundary and the dynamic address pool.

Answer

option subnet-mask 255.255.255.0;

Answer

pool { ... }

Answer

host fixed-address 192.168.1.200;

Question 11

To protect against SSH brute-force attacks, a system administrator installs fail2ban. Which configuration file should be modified to enable the SSH jail with default settings?

Accepted Answer

/etc/fail2ban/jail.local. Fail2ban uses jail.local to override default settings from jail.conf without modifying the package-managed file. The SSH jail is defined in jail.conf but enabling it with default settings requires creating or editing jail.local, which takes precedence over jail.conf. This ensures that customizations survive package updates.

Answer

/etc/fail2ban/fail2ban.conf

Answer

/etc/ssh/sshd_config

Answer

/etc/fail2ban/jail.conf

Question 12

Which legacy SMB protocol version should be disabled for security best practices on a modern Samba server?

Accepted Answer

SMB1. SMB1 (also known as CIFS) is a legacy protocol that lacks modern security features such as pre-authentication integrity, encryption, and secure dialect negotiation. It is notoriously vulnerable to attacks like EternalBlue and SMB relay, and disabling it is a fundamental security best practice on any modern Samba server. Samba allows disabling SMB1 via the 'server min protocol = SMB2' or 'ntlm auth = no' directives in smb.conf.

Answer

SMB2_02

Answer

SMB3

Answer

SMB2

Question 13

In a PAM configuration file, which control flag is used for modules that are not required but can provide additional functionality?

Accepted Answer

optional. In PAM (Pluggable Authentication Modules) configuration files, the 'optional' control flag indicates that the module's success or failure is not critical to the overall authentication result. It is used for modules that provide additional functionality, such as logging or session recording, without affecting whether access is granted or denied. This allows administrators to add supplementary checks without breaking existing authentication flows.

Answer

required

Answer

sufficient

Answer

requisite

Question 14

An organization runs a Samba server in standalone mode. They want to allow anonymous (guest) access to a public share. Which configuration option enables guest access for a share?

Accepted Answer

map to guest = Bad User and guest ok = yes. Samba requires both `map to guest = Bad User` (which tells Samba to treat any connection attempt with an invalid username as a guest connection) and `guest ok = yes` (which explicitly permits guest access to the share). Without both, anonymous access will be denied. The `map to guest` directive can also be set to `Bad Password` or `Never`, but `Bad User` is the typical choice for public shares.

Answer

anonymous = yes

Answer

security = share

Answer

guest account = nobody

Question 15

Which systemd target is equivalent to the traditional SysV runlevel 3 (multi-user text mode)?

Accepted Answer

multi-user.target. In systemd, multi-user.target is the direct equivalent of SysV runlevel 3, which provides a multi-user text-mode environment without a graphical desktop. This target starts all essential system services and network support but does not launch a display manager, making it the standard for headless servers and maintenance.

Answer

rescue.target

Answer

graphical.target

Answer

emergency.target