LPIC-2 Practice Test 12 — 15 Questions

Question 1

Which two of the following are valid methods to pass kernel parameters during the boot process? (Choose two.)

Accepted Answer

Edit /boot/grub/grub.cfg and append parameters to the 'linux' line. Editing /boot/grub/grub.cfg to append parameters to the 'linux' line directly modifies the kernel command line that GRUB 2 passes to the Linux kernel at boot. This is a standard method for permanently adding kernel parameters like 'quiet' or 'nomodeset'.

Answer

Use the 'initrd' command in GRUB

Answer

Write the parameter directly to /proc/cmdline

Answer

Set the parameter in /etc/sysctl.conf

Question 2

A company runs a DNS server using BIND9 on a Linux server. The server is configured with two network interfaces: one internal (192.168.1.10) and one external (203.0.113.10). The server is configured to be authoritative for example.com. Internal clients can resolve example.com, but external clients receive "SERVFAIL" responses. The host command from an external client returns "Host not found". The administrator checks the named configuration and finds the following in /etc/bind/named.conf.options:

options {
  directory "/var/cache/bind";
  listen-on { 127.0.0.1; 192.168.1.10; 203.0.113.10; };
  allow-query { 192.168.1.0/24; };
  recursion no;
  dnssec-validation auto;
};

The zone configuration for example.com has proper allow-transfer and allow-update settings. What change should be made to resolve external queries?

Accepted Answer

Change 'allow-query' to '{ any; };'. The 'allow-query' directive restricts which clients can send queries to the server. With 'allow-query { 192.168.1.0/24; };', only internal clients on that subnet are permitted to query, causing external clients to receive SERVFAIL. Changing it to '{ any; };' allows all clients to query the server, resolving the issue while still keeping recursion disabled for security.

Answer

Add 'recursion yes;' to the options block.

Answer

Add 'listen-on port 53 { 203.0.113.10; };' to the options block.

Answer

Change 'listen-on' to '{ any; };'

Question 3

A Linux client is configured to use PAM for authentication against an LDAP server. The /etc/pam.d/system-auth includes 'auth required pam_ldap.so'. Users can authenticate successfully. However, when a user runs 'id username', it shows 'uid=1000(username) gid=100(users) groups=100(users)' but the LDAP group membership is not shown. Which configuration file is most likely misconfigured?

Accepted Answer

The /etc/nsswitch.conf 'group' line does not include 'ldap'.. The 'id' command queries the Name Service Switch (NSS) to resolve user and group information. Even though PAM (via pam_ldap.so) successfully authenticates the user against LDAP, the group membership lookup fails because NSS is not configured to consult LDAP for group data. The /etc/nsswitch.conf file must include 'ldap' in the 'group' line (e.g., 'group: files ldap') to enable the system to retrieve LDAP group memberships.

Answer

The PAM configuration uses 'required' instead of 'sufficient' for pam_ldap.

Answer

The /etc/ldap.conf file is missing the 'nss_base_group' line.

Answer

The autofs service is not running.

Question 4

A company runs a mixed environment with Linux and Windows clients. The Samba server is configured as a domain member for authentication. Users authenticate via Active Directory using winbind. Recently, the IT department implemented a new password policy that requires all users to change passwords every 90 days. After the policy took effect, several users report that they cannot access Samba shares from their Linux clients (using smbclient) even though they can log into their Windows desktops with the same credentials. The error message on Linux is 'session setup failed: NT_STATUS_LOGON_FAILURE'. The administrator runs 'wbinfo -a username%password' and it succeeds. What is the most likely cause?

Accepted Answer

The Samba server's cached credentials for these users have expired and not been refreshed.. When a Samba server is a domain member using winbind, it caches user credentials to reduce authentication traffic to the domain controller. After the new 90-day password policy, users changed their passwords on Windows, but the cached credentials on the Samba server were not refreshed. The `wbinfo -a` command succeeds because it contacts the domain controller directly, bypassing the cache, while `smbclient` fails because it uses the stale cached credentials, resulting in NT_STATUS_LOGON_FAILURE.

Answer

The Samba server's krb5.conf is misconfigured for the new password policy.

Answer

The users' passwords contain characters that are not being encoded correctly by smbclient.

Answer

The Linux clients are using an older version of Samba that does not support the new password policy.

Question 5

You are the administrator for a small office network with 20 Linux workstations and 5 Windows 10 clients. The company uses a Samba server (version 4.15) running on Ubuntu 22.04 to share a central directory /data with user-level security. Each user has a home directory on the server, and all users are in the 'staff' group. Recently, users have complained that they can access the /data share from Windows but cannot modify any files, even though they could before. The Samba configuration for the share is:

[data]
   path = /data
   browseable = yes
   read only = no
   valid users = @staff
   create mask = 0660
   directory mask = 0770
   force group = staff

You check the filesystem permissions on /data and find it is owned by root:staff with permissions 775. Files inside are owned by individual users and group staff with permissions 664. You also check smbstatus and see that users are connected as 'guest' rather than their actual username. What is the most likely cause of the problem?

Accepted Answer

The global 'map to guest = Bad User' setting is causing users who mistype their password to be mapped to the guest account, losing write permissions.. The 'map to guest = Bad User' global setting in Samba causes any user who fails authentication (e.g., due to a typo or incorrect password) to be mapped to the guest account. Since the share does not define a 'guest ok' or 'guest only' setting, and the guest account typically has no write permissions on the /data directory, users connected as guest cannot modify files. The smbstatus output confirming users are connected as 'guest' directly points to this misconfiguration.

Answer

The 'valid users = @staff' directive excludes root, so users cannot write because the share is owned by root.

Answer

The 'force group = staff' parameter overrides file ownership and prevents writes because the files are owned by root.

Answer

The 'create mask = 0660' is too restrictive and prevents users from writing to existing files.

Question 6

An organization uses a Samba server as a standalone file server. The share 'Projects' is configured with browseable = yes and guest ok = no. Users authenticate with local Samba accounts. A new employee needs access but cannot authenticate. The administrator added the user with 'smbpasswd -a newuser' and set a password. When the user tries to connect, they get 'NT_STATUS_LOGON_FAILURE'. The administrator verifies the username and password are correct. smb.conf includes: security = user, passdb backend = tdbsam. What is the most likely cause?

Accepted Answer

The user account is not in the system's /etc/passwd.. Samba with `passdb backend = tdbsam` stores user credentials in its own TDB database, but it still requires the user to exist as a local system account in `/etc/passwd` (or equivalent) for authentication to succeed. The `smbpasswd -a` command only adds the user to the Samba password database; if the user is not present in `/etc/passwd`, the authentication attempt fails with `NT_STATUS_LOGON_FAILURE` because Samba cannot map the session to a valid Unix UID.

Answer

The 'null passwords' parameter is set to 'yes'.

Answer

The 'map to guest' parameter is set to 'Bad User'.

Answer

The 'encrypt passwords' parameter is set to 'no'.

Question 7

You are a system administrator at a small company. The network uses DHCP to assign IP addresses to clients. Recently, some users reported intermittent network connectivity issues. Upon investigation, you notice that the DHCP server is running on a Linux server with the ISC DHCP daemon. The server log shows many 'DHCPREQUEST' messages from a particular MAC address with frequent changes in requested IP addresses. Users with that MAC address are experiencing IP address conflicts and connectivity drops. What is the most likely cause and the best corrective action?

Accepted Answer

Identify the device with that MAC address and replace its network interface card.. The frequent DHCPREQUEST messages from the same MAC address requesting different IP addresses indicate a faulty network interface card (NIC) that is generating random or corrupted DHCP requests, likely due to hardware malfunction. Replacing the NIC eliminates the root cause by stopping the spurious traffic, whereas other options only mask symptoms or fail to address the hardware fault.

Answer

Increase the DHCP lease time to reduce the frequency of renewals.

Answer

Add a static DHCP mapping for the problematic MAC address to a reserved IP.

Answer

Restart the DHCP daemon to clear the lease database.

Question 8

A system administrator notices that external clients cannot resolve the company's primary website (www.example.com) but internal clients can. What is the most likely cause?

Accepted Answer

The external DNS server has a missing A record for www.example.com.. If the external DNS server is missing an A record for www.example.com, external clients querying that server will receive a negative response (NXDOMAIN or NODATA), while internal clients can still resolve the name if the internal DNS server has the correct record (e.g., via zone transfer or manual configuration). This scenario directly explains the symptom: internal resolution works, external fails.

Answer

The internal DNS server is not authoritative for the zone.

Answer

The firewall is blocking port 53 UDP to the internal DNS server.

Answer

The internal DNS server is not configured for recursion.

Question 9

An administrator runs the command shown. However, when a user tries to execute a binary from /mnt/tmp, it fails with 'Permission denied'. What is the most likely cause?

Accepted Answer

The noexec mount option prevents execution.. The `noexec` mount option explicitly prevents execution of any binaries on the filesystem, regardless of their permission bits. When a filesystem is mounted with `noexec`, the kernel will refuse to execute any file on that mount point, returning 'Permission denied' even if the file has execute permissions set. This is the most likely cause because the administrator's command likely mounted `/mnt/tmp` with `noexec` (e.g., via `mount -o noexec` or a default mount option).

Answer

The binary is not executable.

Answer

The tmpfs filesystem does not support execution.

Answer

The nosuid option prevents setuid binaries.

Question 10

A client reports that the [public] share is visible but all files appear read-only. What is the cause?

Accepted Answer

The read only = yes parameter forces read-only access.. The `read only = yes` parameter in a Samba share definition explicitly forces all files to appear read-only to clients, regardless of underlying filesystem permissions. This overrides any other permission settings and is the direct cause of the reported behavior where the share is visible but all files are read-only.

Answer

The create mask = 0755 denies write permissions.

Answer

The guest account nobody has no write permission on the file system.

Answer

The map to guest = Bad User is causing all users to be treated as guest.

Question 11

Which TWO statements about the /etc/hosts file are true?

Accepted Answer

It can contain a line like '127.0.0.1 localhost'.. The /etc/hosts file maps hostnames to IP addresses, and the line '127.0.0.1 localhost' is the standard entry for the IPv4 loopback interface. This file is consulted by the system's resolver library before DNS queries are made, allowing local overrides for hostname resolution.

Answer

It configures the DNS servers to use.

Answer

It is consulted after DNS by default.

Answer

It can define aliases for network interfaces.

Question 12

Which THREE conditions must be met for a Linux system to act as a router between two networks?

Accepted Answer

IP forwarding must be enabled in the kernel (net.ipv4.ip_forward = 1).. The Linux kernel must have IP forwarding enabled to forward packets between network interfaces. This is controlled by the sysctl parameter net.ipv4.ip_forward = 1, which allows the kernel to act as a router by forwarding IP packets from one interface to another based on the routing table.

Answer

The system must have a default gateway configured.

Answer

The firewall must allow forwarding (FORWARD chain policy ACCEPT).

Question 13

Which TWO statements are true regarding BIND DNS server security? (Choose two.)

Accepted Answer

The 'allow-recursion' ACL can be used to restrict which clients can use the server's recursive lookup feature.. The 'allow-recursion' ACL in BIND explicitly controls which clients are permitted to use the server's recursive query feature. By restricting recursion to trusted clients, the server avoids being used in amplification attacks and reduces exposure to cache poisoning. This ACL is defined in the options block or per-zone and can reference address match lists or named ACLs.

Answer

The 'allow-transfer' ACL is used to restrict which clients can perform recursive queries.

Answer

The 'blackhole' ACL can be used to prevent cache poisoning attacks.

Answer

The 'forwarders' option can be used to disable recursion entirely.

Question 14

A government agency runs a classified application on a Linux server with strict auditing requirements. The application writes sensitive data to a MySQL database. The auditor requires that all SQL queries executed by the application be logged with timestamps, user, and the full query text. Additionally, the audit logs must be immutable (cannot be altered by the application or any user except a designated auditor account). The database runs on the same server. Which combination of tools and configurations should the administrator deploy?

Accepted Answer

Enable MySQL's general query log, direct it to a file on a separate filesystem mounted with the 'noexec' and 'append' options, and set the file immutable with chattr +a.. It combines MySQL's general query log (which captures full query text, timestamps, and user) with filesystem-level immutability via `chattr +a` (append-only) on a separate filesystem mounted with `noexec` and `append` options. This ensures logs cannot be modified or deleted by the application or any non-auditor user, meeting the strict auditing requirement for immutable logs.

Answer

Enable auditd to monitor the MySQL process and log all system calls.

Answer

Enable the MySQL audit log plugin and configure rsyslog to forward logs to a remote log server.

Answer

Use tcpdump to capture all network traffic to port 3306 and save to a file with packet captures.

Question 15

A mail administrator is configuring Postfix to use SASL authentication for incoming connections. Which THREE parameters must be set in main.cf?

Accepted Answer

smtpd_sasl_security_options. B is correct because `smtpd_sasl_security_options` controls which SASL security mechanisms are allowed for the Postfix SMTP server (e.g., `noanonymous` to reject anonymous logins). This parameter is essential for enforcing authentication policy when SASL is enabled.

Answer

smtpd_tls_auth_only

Answer

smtp_sasl_auth_enable