LPIC-2 Practice Test 13 — 15 Questions

Question 1

A Samba server configured as an Active Directory domain member is unable to authenticate users from the domain. The administrator verifies that DNS resolution works, but `wbinfo -u` returns no output. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The winbind service is not running.. The `wbinfo -u` command queries the winbind service to list domain users. If it returns no output, the most likely cause is that the winbind service is not running, as it is responsible for resolving Windows domain users and groups on a Samba member server. Without winbind, Samba cannot authenticate domain users even if DNS and Kerberos are working correctly.

Answer

The smb.conf file is missing the 'idmap config' lines.

Answer

The Kerberos ticket is expired.

Answer

The system clock is not synchronized with the domain controller.

Question 2

A company has a Samba server configured as a domain member in an Active Directory domain. The server runs Samba 4.13. Recently, Windows clients have been unable to access shares, and the domain join seems broken. The administrator runs 'net ads testjoin' and gets 'Join to domain is not valid'. The smb.conf includes: security = ads, realm = EXAMPLE.COM, workgroup = EXAMPLE. The administrator can successfully resolve the domain controller via DNS. What should the administrator do to fix the issue?

Accepted Answer

Re-run 'net ads join -U administrator' to rejoin the domain.. The 'net ads testjoin' command returned 'Join to domain is not valid', which indicates the machine account password stored in the local secrets.tdb file no longer matches the one in Active Directory. Re-running 'net ads join -U administrator' re-establishes the secure channel by resetting the machine account password and updating the Kerberos keytab, restoring the domain membership.

Answer

Restart the winbind service and run 'wbinfo -t'.

Answer

Add 'kerberos method = secrets and keytab' to smb.conf.

Answer

Increase the 'log level' to 3 and restart smbd.

Question 3

An administrator needs to configure Samba to use encrypted passwords via LDAP backend. The LDAP server is already set up with the necessary schema. Which passdb backend should be specified in smb.conf?

Accepted Answer

passdb backend = ldapsam:ldap://ldap.example.com. The `ldapsam` passdb backend is the Samba module specifically designed to store and authenticate user accounts (including encrypted passwords) against an LDAP directory. The syntax `ldapsam:ldap://ldap.example.com` tells Samba to use the LDAP SAM (Security Account Manager) backend, which maps Samba's account attributes to LDAP entries using the standard Samba LDAP schema (e.g., sambaSamAccount).

Answer

passdb backend = ldap:ldap://ldap.example.com

Answer

passdb backend = secret:ldap://ldap.example.com

Answer

passdb backend = sam:ldap://ldap.example.com

Question 4

A company runs Samba on a Linux server to provide file shares to Windows clients. The server is also a BIND DNS server. After a recent OS upgrade, the Samba service fails to start with the error: 'Failed to create a listening socket for port 445: Permission denied'. The administrator checks that no other service is using port 445. smbd is configured to start as root. What is the most likely cause?

Accepted Answer

SELinux is blocking the Samba port.. SELinux, when enforcing, can block Samba from binding to privileged ports like 445 even when the service runs as root. The error 'Permission denied' on port 445, despite no other service using it and the firewall being open, strongly indicates SELinux is denying the bind. The SELinux boolean 'samba_port_t' or the specific port context must be enabled or relabeled for Samba to bind to port 445.

Answer

The firewall is blocking the port even though it's internal.

Answer

The 'socket address' parameter is set to an invalid IP.

Answer

The Samba netbios name is too long.

Question 5

In a Samba domain member server, which file contains the SID to Unix ID mappings?

Accepted Answer

/var/lib/samba/winbindd_idmap.tdb. B is correct because Samba domain member servers use the winbindd service to map Windows SIDs to Unix UIDs/GIDs, and these mappings are stored in the `winbindd_idmap.tdb` file located in `/var/lib/samba/`. This TDB (Trivial Database) file maintains the persistent ID mapping database, which is essential for translating between the two security identifier systems.

Answer

/etc/group

Answer

/var/lib/samba/private/secrets.tdb

Answer

/etc/passwd

Question 6

Arrange the steps to configure a Linux system as a PostgreSQL database server.

Accepted Answer

Install PostgreSQL, then initialize the database cluster, then start the PostgreSQL service, then create a user and database, then test the connection.. The correct order to configure a Linux system as a PostgreSQL database server is: install PostgreSQL, initialize the database cluster using initdb, start the PostgreSQL service, create a database user and database, and then test the connection. Each step depends on the previous one; for example, starting the service requires the cluster to exist, and creating users requires the service to be running.

Answer

Install PostgreSQL, then start the PostgreSQL service, then initialize the database cluster, then create a user and database, then test the connection.

Answer

Install PostgreSQL, then initialize the database cluster, then create a user and database, then start the PostgreSQL service, then test the connection.

Answer

Install PostgreSQL, then start the PostgreSQL service, then create a user and database, then initialize the database cluster, then test the connection.

Question 7

What is the recommended way to configure a Linux host to obtain an IP address automatically via DHCP on the eth0 interface?

Accepted Answer

Set 'BOOTPROTO=dhcp' in /etc/sysconfig/network-scripts/ifcfg-eth0.. On Red Hat-based Linux distributions, the recommended way to configure an interface for DHCP is to set 'BOOTPROTO=dhcp' in the interface configuration file /etc/sysconfig/network-scripts/ifcfg-eth0. This instructs the network service to use the DHCP protocol to obtain an IP address automatically from a DHCP server. The value 'dhcp' is the standard keyword recognized by the ifcfg scripts, not 'dhclient'.

Answer

Set 'BOOTPROTO=dhclient' in /etc/sysconfig/network-scripts/ifcfg-eth0.

Answer

Edit /etc/dhcp/dhcpd.conf to include the host's MAC address.

Answer

Use 'networkctl' to set DHCP=yes on eth0.

Question 8

Which THREE kernel boot parameters can be added to the GRUB command line to enable verbose debug output during boot? (Choose three.)

Accepted Answer

debug. The `debug` kernel boot parameter enables verbose debug output from the kernel during boot, printing extensive diagnostic messages. It is a valid parameter that can be added to the GRUB command line to increase verbosity for troubleshooting.

Answer

verbose

Answer

quiet

Question 9

A company develops a custom PCIe device driver as a kernel module. After installing a new kernel version 5.10.50 via a distribution update, the existing driver module fails to load with the error: 'insmod: ERROR: could not insert module mydriver.ko: Invalid module format'. The administrator checks the kernel version and sees that the module was compiled against a previous kernel version 5.10.45. The driver source code is available in /usr/src/mydriver. The administrator needs to get the driver working with the new kernel. Which of the following is the correct course of action?

Accepted Answer

Recompile the module using 'make -C /lib/modules/$(uname -r)/build M=/usr/src/mydriver modules'. The kernel module was compiled against a different kernel version (5.10.45) and the new kernel (5.10.50) has a different vermagic string, which includes the kernel version and other build parameters. The module must be recompiled against the new kernel's build tree located at /lib/modules/$(uname -r)/build to match the vermagic and ensure symbol compatibility. The command 'make -C /lib/modules/$(uname -r)/build M=/usr/src/mydriver modules' uses the kernel build system to compile the module against the running kernel's configuration and headers.

Answer

Copy the compiled .ko file to /lib/modules/5.10.50/kernel/drivers/misc/ and run 'depmod -a'

Answer

Edit the module's Makefile to change the version string to match the new kernel

Answer

Use 'modprobe --force mydriver' to bypass the version check

Question 10

An administrator needs to encrypt a large file using GPG with a symmetric cipher and then decrypt it on another system. Which command encrypts the file using AES256 and prompts for a passphrase?

Accepted Answer

gpg --symmetric --cipher-algo AES256 file.txt. `--symmetric` tells GPG to encrypt the file using a symmetric cipher (i.e., a single passphrase shared between sender and receiver), and `--cipher-algo AES256` selects the AES-256 encryption algorithm. The command will prompt for a passphrase interactively, which is exactly what the scenario requires.

Answer

gpg --clearsign --cipher-algo AES256 file.txt

Answer

gpg --encrypt --cipher-algo AES256 file.txt

Answer

gpg --sign --cipher-algo AES256 file.txt

Question 11

Which two utilities can be used to load kernel modules? (Choose two.)

Accepted Answer

modprobe. modprobe is correct because it is the primary utility for loading kernel modules, including handling module dependencies automatically by consulting the modules.dep file generated by depmod. insmod is also correct because it directly inserts a single module into the kernel, though it does not resolve dependencies automatically.

Answer

modinfo

Answer

lsmod

Answer

depmod

Question 12

A network administrator wants to improve network performance by bonding two gigabit Ethernet interfaces (eth0 and eth1) on a Linux server. The switch supports IEEE 802.3ad (LACP). Which bonding mode should be used to provide both load balancing and fault tolerance?

Accepted Answer

802.3ad (mode 4). (802.3ad mode 4) is correct because it uses the IEEE 802.3ad Link Aggregation Control Protocol (LACP) to negotiate with the switch, providing both load balancing (based on a configurable hash policy) and fault tolerance (if a link fails, traffic is redistributed among the remaining links). This mode is specifically designed for switches that support LACP, as stated in the question.

Answer

active-backup (mode 1)

Answer

balance-xor (mode 2)

Answer

balance-rr (mode 0)

Answer

balance-tlb (mode 5)

Question 13

Refer to the exhibit. A client with MAC address 08:00:27:ab:cd:ef on the 192.168.1.0/24 network receives IP 192.168.2.10 instead of an IP from the 192.168.1.0 subnet. What is the most likely explanation?

Accepted Answer

The server's host declaration assigns a fixed-address from a different subnet.. The DHCP server's host declaration explicitly assigns a fixed-address to the client's MAC address (08:00:27:ab:cd:ef) from a different subnet (192.168.2.10). In ISC DHCP, the 'host' block with a 'fixed-address' directive overrides any subnet pool selection, forcing the server to offer that specific IP regardless of the relay agent or client's subnet. This is a common misconfiguration when administrators copy host declarations between subnet definitions without updating the address.

Answer

The relay agent is misconfigured and forwards requests to the wrong subnet.

Answer

The client's network interface is set to a static IP address.

Answer

The client sent a DHCP request with an incorrect subnet mask.

Question 14

Which file contains the filesystem table that is read during system boot to mount filesystems?

Accepted Answer

/etc/fstab. /etc/fstab is the filesystem table file that is read by the system during boot (via mount -a or systemd-fstab-generator) to automatically mount filesystems. It contains entries specifying devices, mount points, filesystem types, mount options, dump and pass fields, and is the standard configuration file for static filesystem mounting.

Answer

/etc/mtab

Answer

/proc/mounts

Answer

/etc/mounts

Question 15

A user wants to mount a Samba share on a Linux client using the command line. Which utility is used for that purpose?

Accepted Answer

mount.cifs. The correct utility is mount.cifs, which is part of the cifs-utils package. It mounts Samba (SMB/CIFS) shares on Linux clients by using the Common Internet File System (CIFS) protocol, the modern implementation of SMB. The mount command with -t cifs internally calls mount.cifs, making it the standard tool for this purpose.

Answer

mount.smb

Answer

mount -t smbfs

Answer

smbclient