LPIC-2 Practice Test 11 — 15 Questions

Question 1

A developer has compiled a custom kernel with a new feature. The kernel modules are installed in /lib/modules/$(uname -r)/. However, when the system boots, the kernel fails to load some modules with 'Exec format error'. What is the most likely cause?

Accepted Answer

The modules were compiled against a different kernel version.. The 'Exec format error' indicates that the kernel module binary is incompatible with the running kernel. This most commonly occurs when modules are compiled against a different kernel version (e.g., different kernel source tree or configuration), as the module's vermagic string must exactly match the kernel's vermagic. The kernel's module loader checks this version magic before loading; a mismatch causes the exec format error.

Answer

The kernel configuration has disabled module loading.

Answer

The modules have incorrect file permissions.

Answer

The modules are not properly ordered in the dependency file.

Question 2

An administrator needs to encrypt a large file using GPG with a symmetric cipher and then decrypt it on another system. Which command encrypts the file using AES256 and prompts for a passphrase?

Accepted Answer

gpg --symmetric --cipher-algo AES256 file.txt. Option B is correct because --symmetric with --cipher-algo AES256 performs symmetric encryption. Option A is wrong because --encrypt is for asymmetric. Option C is wrong because --sign is for signing. Option D is wrong because --clearsign is for clearsigning.

Answer

gpg --clearsign --cipher-algo AES256 file.txt

Answer

gpg --encrypt --cipher-algo AES256 file.txt

Answer

gpg --sign --cipher-algo AES256 file.txt

Question 3

A security audit reveals that a server with PAM authentication allows users to log in even when the '/etc/nologin' file exists, contrary to policy. Which PAM module is most likely misconfigured or missing?

Accepted Answer

pam_nologin.so. Option B is correct because pam_nologin.so checks for /etc/nologin and denies login if present. Option A is wrong because pam_securetty.so restricts root login on ttys, unrelated. Option C is wrong because pam_lastlog.so records login time. Option D is wrong because pam_access.so restricts based on access lists, not nologin.

Answer

pam_securetty.so

Answer

pam_access.so

Answer

pam_lastlog.so

Question 4

A system with SELinux in enforcing mode is running a custom application that needs to write to a file in /data. The application's context type is 'myapp_t', and the target file context is 'default_t'. The file's current context is 'var_t'. Which command changes the file's context to allow access?

Accepted Answer

chcon -t default_t /data/file. Option B is correct because chcon changes file context temporarily; semanage fcontext and restorecon are for persistent labeling. Option A is wrong because restorecon would reset to default policy; option C is wrong because fixfiles relabel restores default file contexts; option D is wrong because semanage fcontext changes policy but requires restorecon to apply.

Answer

fixfiles -F relabel /data

Answer

semanage fcontext -a -t default_t /data/file

Answer

restorecon /data/file

Question 5

A web server running Apache is receiving many failed login attempts. Which tool should be used to dynamically block IPs after a configurable number of failures?

Accepted Answer

fail2ban. Option C is correct because fail2ban scans log files and blocks IPs using firewall rules. Option A is wrong because tcpwrappers provides host-based access control but not dynamic. Option B is wrong because iptables alone does not have a dynamic failure counter. Option D is wrong because hosts.deny is static, not dynamic.

Answer

TCP Wrappers

Answer

/etc/hosts.deny

Answer

iptables

Question 6

Which THREE conditions must be met for an SSH key-based login to succeed using the default settings on a OpenSSH server? (Choose three.)

Accepted Answer

The ~/.ssh directory on the remote server has permissions 0700. Options A, B, and E are correct. The private key must be on the client (usually in ~/.ssh/id_rsa). The public key must be in the remote user's ~/.ssh/authorized_keys. The permissions of the remote ~/.ssh directory must be 0700. Option C is wrong because the server's /etc/ssh/ssh_host_rsa_key is the host key, not user key. Option D is wrong because the server's configuration is not directly related to user key path if PasswordAuthentication is yes? Actually the question asks 'default settings', and default OpenSSH server allows public key auth. The client does not need to store the host key manually; it's verified on first connect. So D is not a condition for login success.

Answer

The remote server has the host key /etc/ssh/ssh_host_rsa_key

Answer

The client has the server's public host key stored in ~/.ssh/known_hosts

Question 7

A system administrator wants to enforce key-based SSH authentication for all users on a server, disabling password authentication. Which two commands must be executed to achieve this? (Choose TWO.)

Accepted Answer

ssh-keygen -t rsa -b 4096. The correct options are A and D. ssh-keygen generates the key pair, and ssh-copy-id copies the public key to the remote server. Option B (chmod 600) is for file permissions, C (sshd -T) tests the configuration, and E (visudo) edits sudoers.

Answer

sshd -T

Answer

visudo

Answer

chmod 600 ~/.ssh/authorized_keys

Question 8

Which TWO statements about the /etc/hosts file are true?

Accepted Answer

It can contain a line like '127.0.0.1 localhost'.. Option A is correct because the /etc/hosts file maps hostnames to IP addresses, and the line '127.0.0.1 localhost' is the standard entry for the IPv4 loopback interface. This file is consulted by the system's resolver library before DNS queries are made, allowing local overrides for hostname resolution.

Answer

It configures the DNS servers to use.

Answer

It is consulted after DNS by default.

Answer

It can define aliases for network interfaces.

Question 9

An administrator wants to configure a virtual IP address on interface eth0 with IP 192.168.1.100/24. Which command correctly adds the virtual IP as an alias?

Accepted Answer

ip addr add 192.168.1.100/24 dev eth0:0. Option B is correct because the `ip addr add` command with `dev eth0:0` directly assigns the IP address to the virtual interface `eth0:0`, which is the standard method in the `iproute2` suite for creating an alias. The `ip` command does not use an `alias` keyword; instead, the device name itself (e.g., `eth0:0`) defines the alias. This approach is consistent with modern Linux networking, replacing the deprecated `ifconfig` method.

Answer

ip addr add 192.168.1.100/24 dev eth0 alias eth0:0

Answer

ip addr add 192.168.1.100/24 dev eth0 label eth0:0

Answer

ifconfig eth0:0 192.168.1.100 netmask 255.255.255.0

Question 10

Refer to the exhibit. A packet is sent from 192.168.1.100 to 10.0.0.5. Which interface will the packet exit?

Accepted Answer

eth1. The packet is sent from 192.168.1.100 (a private IP in the 192.168.0.0/16 range) to 10.0.0.5 (a private IP in the 10.0.0.0/8 range). Since these are on different subnets, the packet must be routed through a gateway. The routing table on the source host (or router) will have a route for 10.0.0.0/8 pointing to eth1, so the packet exits via eth1. No ARP is needed on eth0 because the packet never leaves eth0 for this destination.

Answer

eth0, then eth1 after ARP

Answer

eth0

Answer

lo

Question 11

A company has a server with two network interfaces: eth0 (public IP) and eth1 (private IP). The administrator wants to allow SSH from the public network only. Which iptables rule set achieves this?

Accepted Answer

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -i eth1 -p tcp --dport 22 -j DROP. Option A is correct because it explicitly allows SSH (TCP port 22) traffic arriving on the public interface (eth0) and then drops SSH traffic on the private interface (eth1). This ensures SSH is only accessible from the public network while blocking it on the private network. The order of rules matters: the ACCEPT rule for eth0 must come before any default DROP policy or later rules that might affect it.

Answer

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP

Question 12

An administrator wants to restrict SSH access to a server so that only users from the domain 'example.com' can connect. Which file and syntax should be used with TCP Wrappers?

Accepted Answer

Add to /etc/hosts.allow: sshd: .example.com. Option C is correct because TCP Wrappers uses hosts.allow and hosts.deny. The syntax 'sshd: ALLOW .example.com' is incorrect; the correct syntax is 'sshd: .example.com' in hosts.allow. Option A is wrong because hosts.deny is for denying; but the question asks to allow only. Option B is wrong because the syntax is reversed. Option D is wrong because 'sshd: ALLOW .example.com' is not valid syntax.

Answer

Add to /etc/hosts.deny: sshd: ALL

Answer

Add to /etc/hosts.allow: ALL: .example.com

Answer

Add to /etc/hosts.allow: sshd: ALLOW .example.com

Question 13

A new client with IP 10.0.1.15 tries to connect to HTTPS on the server. Based on the exhibit, what happens?

Accepted Answer

The connection is accepted because 10.0.1.15 is in 10.0.0.0/8.. Option C is correct because 10.0.1.15 is in 10.0.0.0/8, so it matches rule 4 (ACCEPT https) and is allowed. Option A is wrong because rule 4 matches. Option B is wrong because rule 4 matches. Option D is wrong because rule 5 is default drop only after all previous rules.

Answer

The connection is dropped by rule 5.

Answer

The connection is rejected with an ICMP error.

Answer

The connection is accepted only if state RELATED.

Question 14

A firewall rule set is implemented using iptables. The administrator wants to allow incoming SSH connections only from the 192.168.1.0/24 subnet, while all other incoming traffic is dropped. Which set of rules achieves this?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -j DROP. Option D is correct. First, allow SSH from the subnet, then drop all other incoming traffic. Option A drops before allowing, B uses wrong syntax (dport with --sport), C allows all SSH before restricting, and E is correct but uses DROP instead of REJECT; however, the question does not specify preference, but D is more standard. Actually, D uses DROP which is fine. Option E allows SSH from anywhere then restricts? No, E uses both ACCEPT and DROP in order; first rule allows all SSH, second drops all input, so SSH from anywhere would be allowed. So D is best.

Answer

iptables -A INPUT -p tcp --sport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -j DROP

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j DROP

Answer

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

Question 15

An administrator needs to configure a wireless interface wlan0 with WPA2-PSK authentication and a static IP address 192.168.2.50/24. Which tool should be used to configure the wireless settings?

Accepted Answer

wpa_supplicant with a configuration file containing the PSK. WPA2-PSK authentication requires the wpa_supplicant daemon, which handles the 4-way handshake and key derivation. A configuration file with the PSK (pre-shared key) is the standard method to define the network SSID and passphrase, allowing wpa_supplicant to manage the wireless association securely.

Answer

NetworkManager with nmcli

Answer

iwconfig with key s:password

Answer

ifconfig wlan0 up and route add default gw 192.168.2.1