LPIC-2 Practice Test 14 — 15 Questions

Question 1

An administrator needs to configure iSCSI multipathing. After setting up two paths, which command should be used to verify the multipath topology?

Accepted Answer

multipath -l. The `multipath -l` command displays the current multipath topology, showing the aggregated device mapper (dm) devices, their underlying paths, and their status (active/passive or active/active). This is the standard tool for verifying multipath configuration after setting up iSCSI paths, as it reads the multipathd state and presents a human-readable map of the multipath devices.

Answer

lsscsi

Answer

dmsetup ls

Answer

iscsiadm -m session -P 3

Question 2

A company's network has a single switch connecting all devices. The IT manager wants to isolate the development team's traffic from the rest of the network without buying new hardware. Which configuration should the administrator implement on the switch ports connected to the development team's computers?

Accepted Answer

Set the ports to access mode and assign them to VLAN 10.. VLANs (Virtual Local Area Networks) logically segment a network at Layer 2, isolating traffic between groups without requiring additional hardware. Setting the switch ports to access mode and assigning them to VLAN 10 places the development team's computers into a separate broadcast domain, preventing their traffic from being visible to devices in other VLANs. This is the standard method for implementing port-based VLAN membership on a managed switch.

Answer

Enable port security with a maximum MAC address count.

Answer

Configure the switch ports as part of a bridge group.

Answer

Set the ports to trunk mode.

Question 3

A system administrator notices that a new 1TB NVMe drive (/dev/nvme0n1) is not detected by the kernel. The hardware is confirmed working. Which troubleshooting step should be taken first to check if the drive is recognized by the system's PCI subsystem?

Accepted Answer

Run lspci to verify the NVMe controller is detected.. The NVMe drive is not detected by the kernel, but the hardware is confirmed working. The first step is to verify whether the PCI subsystem sees the NVMe controller, because NVMe devices are connected via the PCI Express bus. Running lspci lists all PCI devices, including the NVMe controller; if it does not appear, the issue is at the PCI or hardware level, not the block layer.

Answer

Run lsblk to list all block devices.

Answer

Check dmesg output for errors.

Answer

Run fdisk -l /dev/nvme0n1 to probe the drive.

Question 4

Match each security tool to its function.

Accepted Answer

iptables: A firewall tool used to set up, maintain, and inspect the tables of IP packet filter rules.. Correct matches: iptables is a firewall, nmap is a network scanner, tcpdump is a packet analyzer. Common confusions include misattributing file integrity checking to iptables, IP banning to nmap, and port scanning to tcpdump.

Answer

iptables: A tool for monitoring file system integrity.

Answer

nmap: A tool for banning IPs after failed login attempts.

Answer

tcpdump: A tool for scanning open ports.

Question 5

After modifying smb.conf, which command should be used to verify the configuration syntax before restarting Samba?

Accepted Answer

testparm. The correct command is `testparm`, which is specifically designed to parse and validate the syntax of the Samba configuration file `smb.conf`. It checks for errors such as misspelled parameters, invalid values, or structural issues without requiring the Samba services to be restarted. This ensures that any syntax problems are caught before applying changes to the running Samba daemons (smbd, nmbd, winbindd).

Answer

net conf

Answer

smbpasswd

Answer

smbcontrol

Question 6

Match each Linux filesystem feature to its description.

Accepted Answer

ext4: A journaling filesystem that is the default for many Linux distributions, supporting extents and large files.. The correct matches are ext4 (default journaling filesystem), XFS (high-performance parallel I/O), Btrfs (copy-on-write with snapshots), and F2FS (flash-friendly). Common confusions include swapping ext4 with Btrfs and XFS with F2FS.

Answer

ext4: A copy-on-write filesystem with built-in snapshot and compression capabilities.

Answer

XFS: A flash-friendly filesystem designed for NAND flash storage, minimizing write amplification.

Question 7

To implement 802.1X port-based authentication on a Linux network interface, which combination of software components is typically required when the Linux system acts as the supplicant?

Accepted Answer

wpa_supplicant and hostapd. To implement 802.1X port-based authentication as a Linux supplicant, only wpa_supplicant is required. hostapd is an authenticator (AP/switch side) and is not needed on the client. The other options include unnecessary components (hostapd, freeradius, sssd). Therefore none of the given combinations is correct.

Answer

hostapd and freeradius

Answer

wpa_supplicant and sssd

Answer

freeradius and wpa_supplicant

Question 8

Which TWO commands display the current kernel routing table? (Choose two.)

Accepted Answer

ip route show. The `ip route show` command (from the iproute2 suite) displays the current kernel routing table in a structured, human-readable format. It is the modern replacement for legacy tools like `route` and `netstat`, and it directly reads routing information from the kernel's FIB (Forwarding Information Base).

Answer

route show

Answer

cat /proc/net/route

Answer

ifconfig -a

Question 9

A PAM configuration file for password authentication includes the line 'password requisite pam_cracklib.so retry=3 minlen=8'. A user tries to change their password but is rejected even though the new password meets the stated criteria. The administrator suspects a conflict with another PAM module. Which of the following is the most likely cause?

Accepted Answer

Another PAM module such as pam_pwhistory.so might be configured to prevent reuse of old passwords, causing rejection even though pam_cracklib passes.. Pam_pwhistory.so is commonly used to enforce password history, preventing reuse of recent passwords. Even if pam_cracklib.so accepts the new password as meeting complexity and length requirements, pam_pwhistory.so can reject it if it matches a previously used password, leading to the observed failure.

Answer

The 'retry=3' option limits attempts, but the password is only tried once.

Answer

The 'requisite' control flag causes immediate failure if pam_cracklib fails, but another module might be overriding.

Answer

The 'minlen=8' option requires exactly 8 characters, not at least 8.

Question 10

Which TWO conditions are most likely to cause 'NT_STATUS_ACCESS_DENIED' when accessing a Samba share?

Accepted Answer

Linux filesystem permissions disallow write. Option C is correct because Samba enforces the underlying Linux filesystem permissions (POSIX mode bits and ownership) in addition to its own share-level checks, so if the mapped Unix user lacks write access to the directory or file, the client receives NT_STATUS_ACCESS_DENIED. Option D is correct because a share defined with read-only = yes (or valid users/read list restricting write) causes Samba to reject write operations with NT_STATUS_ACCESS_DENIED even when the Unix permissions would otherwise allow them. Option A is wrong because an lmhosts misconfiguration affects NetBIOS name resolution, typically producing name-not-found or connection timeouts rather than an access-denied status. Option B is wrong because an SMB dialect mismatch usually results in protocol negotiation failures or connection resets, not NT_STATUS_ACCESS_DENIED. Option E is wrong because a firewall blocking TCP 445 prevents the SMB session from being established at all, yielding a connection timeout or refused error instead of an access-denied response.

Answer

Lmhosts file misconfiguration

Answer

SMB protocol version mismatch

Answer

Windows firewall blocking port 445

Question 11

An application running under AppArmor is failing to write to its log directory. The AppArmor profile for the application includes the line '/var/log/myapp/ r,' but not '/var/log/myapp/** rw,'. What is the most likely issue?

Accepted Answer

The 'r' permission only allows read, but write is required.. The AppArmor profile line '/var/log/myapp/ r,' grants only read permission on the directory itself, not write access to files within it. To allow writing to files in the directory, the profile must include a rule like '/var/log/myapp/** rw,' which grants read and write permissions recursively. Without write permission, the application cannot create or modify log files, causing the failure.

Answer

The directory itself is not created, and AppArmor prevents creation.

Answer

The AppArmor service is not running, so the profile is not enforced.

Answer

The profile needs 'ix' instead of 'r' for execute rights.

Question 12

A server with a custom kernel fails to boot after a kernel update. The system displays a kernel panic: 'VFS: Unable to mount root fs on unknown-block(0,0)'. The root filesystem is on an LVM volume. What is the most likely cause?

Accepted Answer

The initramfs is missing LVM support.. The kernel panic 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate the root filesystem. Since the root filesystem resides on an LVM volume, the initramfs must contain LVM tools and modules to activate the volume group and logical volumes before the kernel can mount the root. If the initramfs was not rebuilt after the kernel update, it will lack LVM support, causing the boot failure.

Answer

The GRUB configuration is pointing to the wrong kernel partition.

Answer

The kernel does not have the necessary device drivers compiled in.

Answer

The root filesystem is formatted with an unsupported filesystem.

Question 13

A small business has a single Linux server that serves as both a file server (Samba) and a web server (Apache). The server is directly connected to the internet. Recently, there have been numerous brute-force SSH login attempts. The administrator wants to implement a simple solution to block IP addresses that have more than 5 failed SSH attempts in 10 minutes. The server runs Ubuntu 20.04. Which tool should the administrator use to achieve this with minimal configuration?

Accepted Answer

Install and configure Fail2ban to monitor /var/log/auth.log.. Fail2ban is the correct tool because it is specifically designed to monitor log files (e.g., /var/log/auth.log) for repeated failed authentication attempts and dynamically update firewall rules (via iptables or nftables) to block offending IP addresses. It requires minimal configuration: a default SSH jail is provided out-of-the-box, and the administrator only needs to adjust the `maxretry` and `findtime` parameters to match the requirement of 5 failures in 10 minutes.

Answer

Enable UFW and set default deny incoming, allow SSH from specific IPs.

Answer

Set up TCP wrappers with /etc/hosts.deny for SSH.

Answer

Use port knocking to hide SSH port until a specific sequence is sent.

Question 14

Which command can be used to trace the delegation path of a DNS domain?

Accepted Answer

dig +trace. The `dig +trace` command performs a full iterative DNS resolution from the root nameservers down to the authoritative nameservers for the queried domain, showing each delegation step. The `host -C` command is not a delegation tracing tool; it only queries SOA records from authoritative servers and does not follow the delegation chain. Therefore, only `dig +trace` is correct.

Answer

nslookup -type=any

Answer

host -C

Answer

dig -x

Answer

whois

Question 15

Which file is used to configure which users and groups are allowed to use the 'cron' daemon?

Accepted Answer

/etc/cron.allow. The /etc/cron.allow file explicitly lists users and groups permitted to schedule cron jobs. If this file exists, only those entries can use crontab; all others are denied, regardless of /etc/cron.deny. This provides a whitelist-based access control mechanism for the cron daemon.

Answer

/var/spool/cron/

Answer

/etc/cron.d/

Answer

/etc/crontab