LPIC-2 Practice Test 13 — 15 Questions

Question 1

A filesystem check on an XFS filesystem reports corruption. What is the recommended way to repair it?

Accepted Answer

Run xfs_repair -n first, then unmount and repair.. The recommended procedure for repairing a corrupted XFS filesystem is to first run `xfs_repair -n` in dry-run mode to assess the damage without making changes, then unmount the filesystem and run `xfs_repair` to perform the actual repair. XFS does not support online repair; the filesystem must be unmounted for write operations to avoid further corruption.

Answer

Run xfs_check on the mounted filesystem.

Answer

Run xfs_repair on the unmounted filesystem.

Answer

Run fsck -t xfs on the mounted filesystem.

Question 2

Order the steps to configure a Linux system to use LDAP for authentication.

Accepted Answer

1. Install LDAP authentication packages; 2. Configure LDAP client settings; 3. Modify nsswitch.conf to use ldap; 4. Modify PAM configuration to include pam_ldap; 5. Restart services and test authentication.. Install packages, configure LDAP client, modify nsswitch, modify PAM, then restart and test.

Answer

1. Install LDAP authentication packages; 2. Modify nsswitch.conf to use ldap; 3. Configure LDAP client settings; 4. Modify PAM configuration to include pam_ldap; 5. Restart services and test authentication.

Answer

1. Modify PAM configuration to include pam_ldap; 2. Install LDAP authentication packages; 3. Configure LDAP client settings; 4. Modify nsswitch.conf to use ldap; 5. Restart services and test authentication.

Answer

1. Install LDAP authentication packages; 2. Configure LDAP client settings; 3. Modify PAM configuration to include pam_ldap; 4. Modify nsswitch.conf to use ldap; 5. Restart services and test authentication.

Question 3

A small office uses a Samba server for file sharing. The server is running Samba 4.9 on Ubuntu 18.04. Recently, the administrator added a new user 'john' to the system and added him to the 'staff' group. However, when John tries to access the share 'docs' from his Windows laptop, he gets an 'Access Denied' error. The share configuration is:
[docs]
    path = /srv/docs
    valid users = @staff
    read only = No
    create mask = 0644
    directory mask = 0755

The administrator verifies that John is a member of the staff group by running 'groups john' which shows staff. Other users in staff can access the share. What is the most likely cause?

Accepted Answer

John's Windows credentials are cached from a previous failed attempt.. Samba caches user credentials and group memberships at the time of the initial connection. When John first attempted to access the share, Samba cached his credentials (including group membership) before he was added to the staff group. Even though the system now shows John as a member of staff, Samba continues to use the cached credentials, resulting in 'Access Denied'. Clearing the cached credentials on the Windows client (e.g., via 'net use * /delete' or Credential Manager) forces a fresh authentication and group lookup.

Answer

The create mask is too restrictive for John's files.

Answer

The valid users parameter requires the group to be listed with a plus sign for domain groups.

Answer

The Samba service needs to be restarted to reload the group membership.

Question 4

Arrange the steps to configure a Linux server as an NFS client that mounts a remote export.

Accepted Answer

1. Install the nfs-common package
2. Create a mount point directory
3. Add an entry to /etc/fstab
4. Mount the remote export
5. Verify the mount. The NFS client needs the nfs-common package, a mount point, an fstab entry, then mounting and verification.

Answer

1. Install the nfs-common package
2. Add an entry to /etc/fstab
3. Create a mount point directory
4. Mount the remote export
5. Verify the mount

Answer

1. Create a mount point directory
2. Mount the remote export
3. Add an entry to /etc/fstab
4. Install the nfs-common package
5. Verify the mount

Answer

1. Add an entry to /etc/fstab
2. Create a mount point directory
3. Install the nfs-common package
4. Mount the remote export
5. Verify the mount

Question 5

Order the steps to configure a Linux system as a DHCP client using dhclient.

Accepted Answer

Configure the interface for DHCP, then run dhclient, then check the IP address, then verify the default route, then test connectivity.. First configure the interface for DHCP, then run dhclient, check address, verify route, and test.

Answer

Run dhclient first, then configure the interface for DHCP, then check the IP address, then verify the default route, then test connectivity.

Answer

Check the IP address first, then configure the interface for DHCP, then run dhclient, then verify the default route, then test connectivity.

Answer

Configure the interface for DHCP, then check the IP address, then run dhclient, then verify the default route, then test connectivity.

Question 6

An organization is using Samba as a PDC with an LDAP backend for user accounts. Which idmap backend configuration is appropriate for RFC 2307?

Accepted Answer

idmap config * : backend = ldap. When Samba is configured as a PDC with an LDAP backend for user accounts and RFC 2307 is used, the idmap backend must be set to `ldap` to store and retrieve Unix UID/GID mappings directly from the LDAP directory. This ensures that the POSIX attributes (uidNumber, gidNumber) defined in LDAP are used consistently across all Samba clients, which is the core requirement of RFC 2307.

Answer

idmap config * : backend = tdb

Answer

idmap config * : backend = ad

Answer

idmap config * : backend = rid

Question 7

A company runs Samba on a Linux server to provide file shares to Windows clients. The server is also a BIND DNS server. After a recent OS upgrade, the Samba service fails to start with the error: 'Failed to create a listening socket for port 445: Permission denied'. The administrator checks that no other service is using port 445. smbd is configured to start as root. What is the most likely cause?

Accepted Answer

SELinux is blocking the Samba port.. SELinux, when enforcing, can block Samba from binding to privileged ports like 445 even when the service runs as root. The error 'Permission denied' on port 445, despite no other service using it and the firewall being open, strongly indicates SELinux is denying the bind. The SELinux boolean 'samba_port_t' or the specific port context must be enabled or relabeled for Samba to bind to port 445.

Answer

The firewall is blocking the port even though it's internal.

Answer

The 'socket address' parameter is set to an invalid IP.

Answer

The Samba netbios name is too long.

Question 8

Order the steps to configure a Linux system to send system logs to a remote syslog server.

Accepted Answer

Edit the syslog configuration file (e.g., /etc/rsyslog.conf), add the destination line for the remote server, restart the syslog service, generate a test log message, then verify it appears on the remote server.. The correct sequence for configuring remote syslog logging is to first edit the configuration file (e.g., /etc/rsyslog.conf) and add the remote server destination, then restart the syslog service to apply changes, next generate a test log message (e.g., using logger), and finally verify that the message appears on the remote server. This order ensures that the configuration is properly applied before testing and verification.

Answer

Add the destination line for the remote server, restart the syslog service, edit the syslog configuration file, generate a test log message, then verify on the remote server.

Answer

Generate a test log message, edit the syslog configuration file, add the destination line, restart the syslog service, then verify on the remote server.

Answer

Edit the syslog configuration file, restart the syslog service, add the destination line, generate a test log message, then verify on the remote server.

Question 9

Hosts connected to eth1 cannot communicate with hosts on eth0. Based on the exhibit, what is the most likely reason?

Accepted Answer

Spanning Tree Protocol has placed eth1 in blocking state.. The exhibit shows a Linux bridge (br0) with eth0 and eth1 as bridge ports. If hosts on eth1 cannot communicate with hosts on eth0, the most likely cause is that Spanning Tree Protocol (STP) has placed eth1 in a blocking state to prevent a Layer 2 loop. STP blocks redundant paths by transitioning ports through listening, learning, and blocking states, and a blocked port does not forward traffic until the topology converges.

Answer

Physical layer issues on eth1.

Answer

Eth1 is not connected to the bridge.

Answer

The bridge interface has no IP address.

Question 10

Refer to the exhibit. A DNS query for 'ftp.example.com' returns NXDOMAIN. What configuration change would best resolve this?

Accepted Answer

Add an A record for ftp pointing to an IP address.. An NXDOMAIN response means the queried domain name does not exist in the zone. To resolve 'ftp.example.com', a DNS record must be created that maps the name to an IP address. Option D adds an A record, which directly provides the IPv4 address for the host, making the query succeed.

Answer

Add a CNAME record for ftp pointing to www.example.com.

Answer

Increase the serial number in the SOA record.

Answer

Ensure recursion is enabled on the server.

Question 11

Which TWO commands can be used to list currently loaded iptables rules in the filter table? (Choose two.)

Accepted Answer

iptables -nL. `iptables -nL` lists all rules in the default filter table without resolving hostnames (the `-n` flag disables DNS lookups). Option C is correct because `iptables -L -t filter` explicitly specifies the filter table and lists its rules. Both commands display the currently loaded rules in the filter table, which is the default table for iptables.

Answer

iptables -L -t nat

Answer

iptables -Z

Answer

iptables -F

Question 12

Refer to the exhibit. What type of attack is indicated by the log entries?

Accepted Answer

Brute-force attack on SSH. The log entries show repeated SSH authentication failures from the same IP address with different usernames and passwords, which is characteristic of a brute-force attack. Attackers systematically try many credential combinations to gain unauthorized access to the SSH service, as indicated by the 'Failed password' messages.

Answer

Privilege escalation attempt

Answer

Man-in-the-middle attack

Answer

Distributed denial-of-service (DDoS) attack

Question 13

Which THREE kernel boot parameters can be added to the GRUB command line to enable verbose debug output during boot? (Choose three.)

Accepted Answer

debug. The `debug` kernel boot parameter enables verbose debug output from the kernel during boot, printing extensive diagnostic messages. It is a valid parameter that can be added to the GRUB command line to increase verbosity for troubleshooting.

Answer

verbose

Answer

quiet

Question 14

An administrator wants to compile a new kernel module that is not yet in the tree. What file should be referenced to ensure the module is built with the same configuration as the current kernel?

Accepted Answer

/boot/config-5.10.0-9-amd64. /boot/config-5.10.0-9-amd64 contains the exact kernel configuration used to build the currently running kernel. When compiling a new kernel module, referencing this file (typically via 'make oldconfig' or copying it to the source tree as .config) ensures the module is built with the same set of options, such as enabled features, drivers, and module parameters, preventing incompatibilities.

Answer

/proc/config.gz

Answer

/boot/System.map-5.10.0-9-amd64

Answer

/boot/initrd.img-5.10.0-9-amd64

Question 15

A system administrator wants to configure a Samba share that grants read-only access to the 'staff' group and full control to the 'managers' group. Which share configuration achieves this?

Accepted Answer

[share]
path = /srv/share
valid users = +staff
write list = @managers. The `valid users = +staff` directive restricts access to members of the 'staff' group (the `+` prefix means a Unix group), while the `write list = @managers` directive grants write access to members of the 'managers' group (the `@` prefix also means a Unix group). This combination ensures that 'staff' members have read-only access by default, and 'managers' members have full control (read/write).

Answer

[share]
path = /srv/share
valid users = @managers
write list = @managers

Answer

[share]
path = /srv/share
valid users = +staff
write list = +managers

Answer

[share]
path = /srv/share
valid users = @staff
write list = @staff