LPIC-2 Practice Test 11 — 15 Questions

Question 1

An administrator needs to add support for a new hardware device by compiling a kernel module. After compiling the module against the current kernel source, the module fails to load with 'modprobe: ERROR: could not insert 'mymod': Unknown symbol in module'. Which of the following is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The module was compiled against a different kernel version than the running kernel. The error 'Unknown symbol in module' indicates that the module references a kernel symbol (function or variable) that is not present in the currently running kernel. This most commonly occurs when the module was compiled against a different kernel version or configuration than the running kernel, causing symbol version mismatches. The kernel's symbol versioning (CONFIG_MODVERSIONS) checks CRC values of exported symbols, and a mismatch prevents insertion.

Answer

The module has not been signed for Secure Boot

Answer

The module's dependencies are missing

Answer

The module name conflicts with a built-in driver

Question 2

Which TWO conditions must be met for a Linux bridge to forward Ethernet frames between its ports?

Accepted Answer

The bridge must be in the 'up' state. A Linux bridge must be in the 'up' administrative state (set via `ip link set br0 up`) to forward frames. Without the 'up' state, the bridge will not process or forward any Ethernet frames between its ports, regardless of other configurations.

Answer

Traffic must be allowed by iptables FORWARD chain

Answer

The bridge must have an IP address configured

Answer

Spanning tree must be disabled

Question 3

A system administrator wants to allow incoming SSH connections from only the 192.168.1.0/24 network on a Linux server. Which iptables rule accomplishes this?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT. It appends a rule to the INPUT chain that matches TCP traffic destined for port 22 (SSH) from source IP range 192.168.1.0/24 and accepts it. This restricts incoming SSH connections to only the specified network, which is the intended behavior.

Answer

iptables -A INPUT -p tcp --dport 22 -d 192.168.1.0/24 -j ACCEPT

Answer

iptables -A INPUT -p udp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Answer

iptables -A FORWARD -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Question 4

Order the steps to configure a Linux system as an SSH server with key-based authentication.

Accepted Answer

Install SSH server, then configure SSH server, then generate SSH key pair, then copy public key to server, then restart SSH service and test.. Install SSH server, configure it, generate keys, copy public key, restart and test.

Answer

Generate SSH key pair, then install SSH server, then configure SSH server, then copy public key, then restart and test.

Answer

Install SSH server, then generate SSH key pair, then copy public key, then configure SSH server, then restart and test.

Answer

Install SSH server, then configure SSH server, then copy public key, then generate SSH key pair, then restart and test.

Question 5

The DHCP client lease file shows a lease for 192.168.1.100. If the client fails to contact the original DHCP server by the rebind time (12:00), what will occur?

Accepted Answer

The client will attempt to contact any DHCP server to extend the lease.. When a DHCP client reaches the rebind time (T2, default 87.5% of lease duration) without contacting the original server, it enters the REBINDING state. In this state, the client broadcasts a DHCPREQUEST to any available DHCP server to extend the lease. Option D correctly describes this behavior, as defined in RFC 2131.

Answer

The client will continue to use the address until the expire time without any further attempts.

Answer

The client will immediately release the address.

Answer

The client will rebind with a new IP address from any server.

Question 6

An administrator wants to block all incoming traffic from the IP address 203.0.113.55 except for SSH (port 22) using iptables. The current default policy for the INPUT chain is ACCEPT. Which set of commands achieves this?

Accepted Answer

iptables -A INPUT -s 203.0.113.55 -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -s 203.0.113.55 -j DROP. Iptables processes rules in order. The first rule accepts SSH traffic from 203.0.113.55, and the second rule drops all other traffic from that IP. Since the default INPUT policy is ACCEPT, the drop rule must be placed after the SSH allow rule to ensure SSH packets are accepted before being dropped by the subsequent rule.

Answer

iptables -A INPUT -p tcp --dport 22 -s 203.0.113.55 -j ACCEPT -m; iptables -A INPUT -s 203.0.113.55 -j DROP

Answer

iptables -A INPUT -s 203.0.113.55 -j DROP; iptables -A INPUT -s 203.0.113.55 -p tcp -j ACCEPT

Answer

iptables -A INPUT -s 203.0.113.55 -j DROP; iptables -A INPUT -s 203.0.113.55 -p tcp --dport 22 -j ACCEPT

Question 7

Which TWO of the following commands are used to load a kernel module manually at runtime? (Choose two.)

Accepted Answer

modprobe. Both `modprobe` and `insmod` are standard Linux commands for manually loading kernel modules at runtime. `modprobe` is preferred because it automatically resolves and loads module dependencies, while `insmod` inserts a single module file directly without dependency resolution.

Answer

loadmod

Answer

depmod

Answer

modload

Question 8

Which three directories or files are typically associated with the Linux kernel? (Choose three.)

Accepted Answer

/proc. /proc is a virtual filesystem that provides an interface to kernel data structures, exposing process information, system hardware details, and runtime kernel parameters. It is dynamically generated by the kernel and does not occupy disk space, making it a direct representation of kernel state.

Answer

/dev

Answer

/etc

Question 9

A company runs a high-frequency trading application that requires extremely low latency. The system administrator has compiled a custom Linux kernel with various real-time patches and tuned kernel parameters. After deploying the new kernel, the application performance degrades significantly. The administrator suspects that kernel preemption settings are causing context switch overhead. Which of the following actions should the administrator take to diagnose and optimize the kernel preemption model?

Accepted Answer

Check /proc/sched_debug for preemption counters and adjust the kernel's preemption model by recompiling with CONFIG_PREEMPT_NONE instead of CONFIG_PREEMPT. The kernel preemption model is a compile-time configuration, not a runtime parameter. To change from CONFIG_PREEMPT (full preemption) to CONFIG_PREEMPT_NONE (no forced preemption), the administrator must recompile the kernel with the appropriate configuration. Checking /proc/sched_debug can reveal preemption-related counters and context switch statistics, helping confirm that excessive preemption is causing overhead.

Answer

Use sysctl to set 'kernel.preempt_model' to 'none'

Answer

Add 'preempt=none' to the kernel command line

Answer

Change the kernel preemption model at runtime by writing to /sys/kernel/preempt_control

Question 10

Which THREE commands are specifically used to diagnose Samba issues?

Accepted Answer

smbstatus. smbstatus (A) is correct because it is a Samba-specific tool that reports current SMB/CIFS connections, open shares, locked files, and the Samba version, making it ideal for diagnosing active Samba sessions. testparm (B) is correct because it validates the smb.conf configuration file for syntax errors and prints the resulting parameter set, which is essential when troubleshooting Samba startup or share-access problems. smbtree (C) is correct because it is a Samba client utility that enumerates the SMB/CIFS network neighborhood by querying browse masters and workgroups, helping diagnose name resolution and browsing issues. netstat (D) is not Samba-specific; it is a general network tool that lists sockets and routing information for any service. ping (E) is a generic ICMP reachability test and does not inspect Samba configuration, sessions, or SMB shares.

Answer

netstat

Answer

ping

Question 11

Which THREE of the following tools can be used to implement file integrity checking on a Linux system?

Accepted Answer

AIDE. AIDE (Advanced Intrusion Detection Environment) is correct because it builds a database of file hashes, permissions, and metadata and later compares the filesystem against it to detect unauthorized changes, which is exactly file integrity checking. Tripwire is correct because it is a classic host-based file integrity monitoring tool that creates a baseline of cryptographic hashes and reports any deviations. sha256sum is correct because it computes SHA-256 cryptographic hashes of files, allowing an administrator to manually compare a file's current hash against a known-good value to verify integrity. Logwatch is not correct because it only parses and summarizes system log files; it does not hash or monitor file contents. Nmap is not correct because it is a network port scanner and host discovery tool, not a file integrity checker.

Answer

Logwatch

Answer

Nmap

Question 12

A mail server running Postfix is deferring messages for a local user. The mail log shows 'status=deferred (mailbox is locked)'. What is the most likely cause?

Accepted Answer

The user's mailbox is currently being accessed by a POP3 client.. The 'mailbox is locked' message in Postfix logs indicates that the mailbox file is currently locked by another process, typically a POP3 or IMAP client that has the mailbox open for exclusive access. Postfix defers delivery because it cannot acquire the necessary lock to write to the mailbox, ensuring data integrity. This is a standard behavior defined by the mailbox locking mechanism (e.g., fcntl, dotlock) used by the MTA and MDA.

Answer

The filesystem containing the mail spool is out of inodes.

Answer

The disk quota for the user has been exceeded.

Answer

The Postfix process lacks write permission to the mailbox.

Question 13

Which THREE of the following actions are recommended as initial security hardening steps after installing a new Linux server? (Choose three.)

Accepted Answer

Update all packages using the package manager.. Option A is correct because immediately patching all installed packages with the distribution's package manager (e.g., apt upgrade, dnf update, or zypper update) closes known vulnerabilities in the base OS and bundled software, which is a fundamental first hardening step. Option B is correct because disabling direct root login over SSH (setting PermitRootLogin no in /etc/ssh/sshd_config) forces administrators to authenticate as unprivileged users and escalate via sudo, reducing the impact of brute-force or credential-theft attacks against the all-powerful root account. Option D is correct because enabling and configuring a host firewall such as firewalld or iptables enforces a default-deny posture and restricts inbound services to only those explicitly required, shrinking the attack surface. Option C does not belong because installing a graphical desktop environment adds numerous unnecessary packages and services that increase the attack surface and resource usage on a server, contrary to hardening principles. Option E does not belong because setting up a web server to monitor system status exposes an additional network service and potential vulnerabilities rather than securing the host; monitoring should be done via dedicated, secured tools.

Answer

Install a graphical desktop environment for easier administration.

Answer

Set up a web server to monitor system status.

Question 14

An administrator wants to allow user 'john' to execute any command as root without a password. Which sudoers entry is correct?

Accepted Answer

john ALL=(ALL) NOPASSWD:ALL. The sudoers entry 'john ALL=(ALL) NOPASSWD:ALL' grants user 'john' permission to run any command as any user (including root) on any host, and the 'NOPASSWD' tag overrides the default password requirement, allowing execution without a password. The syntax follows the sudoers format: 'user host=(runas) TAG:command', where 'ALL' in each field matches any value.

Answer

john ALL=(ALL) NOPASSWD:/bin/ls

Answer

john ALL=(ALL) ALL

Answer

john ALL=(ALL) PASSWD:ALL

Question 15

Which command can be used to test the entire name resolution order as defined in nsswitch.conf?

Accepted Answer

getent hosts. The `getent hosts` command queries the system's Name Service Switch (NSS) configured sources in the exact order defined in `/etc/nsswitch.conf`. It uses the `gethostbyname()` or `getaddrinfo()` library calls, which respect the `hosts:` line in nsswitch.conf (e.g., `files dns myhostname`), testing resolution through each source sequentially until a result is found or all sources are exhausted.

Answer

host

Answer

nslookup

Answer

dig