LPIC-2 Practice Test 14 — 15 Questions

Question 1

Which TWO of the following are effective methods to secure SSH access on a Linux server? (Choose two.)

Accepted Answer

Disable password authentication and use only key-based authentication.. Disabling password authentication and enforcing key-based authentication eliminates the risk of brute-force password guessing attacks. SSH keys use asymmetric cryptography (RSA, ECDSA, or Ed25519) and are resistant to credential stuffing and dictionary attacks, provided private keys are kept secure. This is a foundational security hardening step recommended by the CIS Benchmarks for Linux.

Answer

Disable root login over SSH.

Answer

Use FTP over SSH (SFTP) for file transfers.

Answer

Require users to change their passwords every 30 days.

Question 2

Which THREE statements about Samba's 'net' command are true? (Choose three.)

Accepted Answer

net ads join joins the server to an Active Directory domain. 'net ads join' is the Samba command used to join a Linux server to an Active Directory domain, leveraging the Kerberos and LDAP protocols to authenticate and register the server as a domain member. This is a core function for integrating Samba with modern Windows domains.

Answer

net conf drop drops all database connections

Answer

net share lists shares on the local Samba server

Question 3

An administrator wants to create a thin provisioned LVM pool and a thin volume. Which sequence of commands is correct?

Accepted Answer

lvcreate -L 10G --thinpool vg/pool; lvcreate -V 5G --thin vg/pool/thinvol. It uses the correct LVM commands to create a thin provisioned pool and a thin volume. The first command, `lvcreate -L 10G --thinpool vg/pool`, creates a thin pool named 'pool' in volume group 'vg' with a 10G metadata and data area. The second command, `lvcreate -V 5G --thin vg/pool/thinvol`, creates a thin volume named 'thinvol' within that pool, specifying the virtual size with `-V`. The `--thinpool` and `--thin` flags are the proper LVM2 syntax for thin provisioning.

Answer

lvcreate -L 10G -T vg/pool; lvcreate -V 5G -T vg/pool/thinvol

Answer

lvcreate -L 10G -T vg/pool; lvcreate -n thinvol -V 5G vg/pool

Answer

lvcreate -L 10G -T vg/pool; lvcreate -V 5G -n thinvol vg/pool

Question 4

An administrator configured an autofs direct map for a remote NFS share. The master map at /etc/auto.master contains a line: '/data /etc/auto.direct'. The direct map file /etc/auto.direct has: '/projects -rw,soft fileserver:/exports/projects'. When a user tries to cd /data/projects, it hangs. The autofs service is running. What is the most likely cause?

Accepted Answer

The master map should use '/-' instead of '/data' for direct maps.. Direct maps in autofs must use the special mount point '/-' in the master map, not an actual directory path like '/data'. When '/data' is specified, autofs treats it as an indirect map key, causing it to look for a subdirectory matching the key under '/data' rather than triggering the direct mount of '/projects'. This mismatch leads to a hang when the user attempts to access '/data/projects' because autofs never attempts the NFS mount.

Answer

The NFS server fileserver is not exporting /exports/projects.

Answer

The autofs service is not started.

Answer

The 'soft' mount option is missing.

Question 5

A filesystem is reported as 'read-only' after an unexpected power failure. Which command should be used to attempt repair without data loss?

Accepted Answer

fsck -n /dev/sda1. After an unexpected power failure, the filesystem may have been marked as needing a clean replay of its journal, but it is not necessarily corrupted. Running `fsck -n` performs a read-only check of the filesystem without making any changes, allowing you to assess the extent of damage or confirm that the journal replay is all that is needed. This avoids the risk of `fsck` making incorrect automatic repairs that could cause data loss, which is critical when the root cause is an unclean shutdown rather than structural corruption.

Answer

mount -o remount,rw /dev/sda1

Answer

fsck -y /dev/sda1

Answer

e2fsck -p /dev/sda1

Question 6

Given the exhibit, what is the most likely reason for the GPG error, and what is the correct way to fix it permanently?

Accepted Answer

The public key is missing; obtain and add it with 'apt-key add' or 'wget -O- | apt-key add -'. The GPG error indicates that the repository's Release file is signed but the system lacks the corresponding public key to verify the signature. This is a common issue when adding third-party repositories. The correct permanent fix is to obtain the missing public key and add it to the APT keyring using 'apt-key add' or by piping the key with 'wget -O- | apt-key add -', which allows APT to authenticate the repository's metadata.

Answer

The repository is not signed; use '--allow-unauthenticated' permanently in /etc/apt/apt.conf.d/

Answer

The repository URL is incorrect; change 'http://deb.example.com' to 'https://deb.example.com'

Answer

The InRelease file is corrupted; remove it and run 'apt-get update' again

Question 7

A system administrator notices that the SSH service on a Linux server is failing to start. The log shows: 'sshd: error: Could not load host key: /etc/ssh/ssh_host_rsa_key'. What is the most likely cause and solution?

Accepted Answer

The host key file is missing or corrupt. Run 'ssh-keygen -A' to regenerate all missing host keys.. The error message indicates that the SSH daemon cannot load the RSA host key file. Host keys are generated during package installation or manually via ssh-keygen. Option D is correct because running 'ssh-keygen -A' automatically generates all missing host key types (RSA, ECDSA, Ed25519) that are configured for use, resolving the missing or corrupt key issue without manual intervention.

Answer

The sshd_config file has a syntax error. Run 'sshd -t' to check it.

Answer

The SSH service is managed by xinetd and the configuration is missing. Edit /etc/xinetd.d/ssh.

Answer

The /etc/ssh/sshd_config file has incorrect permissions. Change them to 600.

Question 8

Your company has a Linux server acting as a router with three VLAN interfaces: eth0.10 (192.168.10.1/24), eth0.20 (192.168.20.1/24), and eth0.30 (192.168.30.1/24). The server has a default route via eth0 (native VLAN) to the internet gateway at 10.0.0.1. Internal hosts can communicate between VLANs, but cannot reach the internet. You have verified that the default route is present and that the gateway is reachable from the router itself. The iptables FORWARD chain policy is ACCEPT, and no filtering rules are defined. However, you notice that ip_forward is enabled. What is the most likely missing configuration?

Accepted Answer

Add iptables MASQUERADE rule on the outgoing interface (eth0).. The router itself can reach the internet, but internal hosts cannot because traffic from the internal VLANs (192.168.10.0/24, 192.168.20.0/24, 192.168.30.0/24) that is forwarded to the internet via eth0 (10.0.0.0/?) has a source IP from the private RFC 1918 address space. The internet gateway (10.0.0.1) will not route packets back to these private addresses, and even if it did, the return packets would not be delivered to the originating internal host without source NAT. Adding an iptables MASQUERADE rule on the outgoing interface (eth0) performs source NAT (SNAT), rewriting the source IP of forwarded packets to the router's own IP on eth0, so that the internet gateway sees return traffic destined to the router, which then de-masquerades and forwards it back to the correct internal host.

Answer

Enable net.ipv4.ip_forward in sysctl.conf.

Answer

Add a static route on the internal hosts to the internet gateway.

Answer

Disable firewalld to ensure no packet filtering.

Question 9

An administrator uses logwatch to send daily summaries to root. Which configuration file controls the default logwatch behavior?

Accepted Answer

/etc/logwatch/conf/logwatch.conf. Logwatch uses a modular configuration system where the main configuration file is located at /etc/logwatch/conf/logwatch.conf. This file overrides the default settings found in /usr/share/logwatch/default.conf/logwatch.conf, allowing administrators to customize logwatch behavior without modifying the distribution's default files.

Answer

/etc/logwatch.conf

Answer

/usr/share/logwatch/default.conf

Answer

/etc/logwatch/logwatch.conf

Question 10

An administrator configures a bridge br0 with two ports (eth0 and eth1). The network uses STP. After configuration, packets from a host on eth0 to a host on eth1 are not forwarded. The bridge shows blocking state for one of the ports. What is the most likely cause?

Accepted Answer

The bridge has loop detection and blocked one port. The bridge br0 has two ports (eth0 and eth1) and STP is enabled. STP detects a loop in the network — in this case, the bridge itself with two ports on the same broadcast domain creates a loop. To prevent broadcast storms and MAC table instability, STP places one of the ports into the blocking state, which stops forwarding frames between the two ports. This is why packets from a host on eth0 to a host on eth1 are not forwarded.

Answer

Incorrect MTU

Answer

STP is disabled

Answer

MAC address learning is disabled

Answer

The bridge is in promiscuous mode

Question 11

A Samba share is configured with 'force user = jane'. A user 'bob' accesses the share. With what effective user ID will file operations be performed?

Accepted Answer

jane. The 'force user' directive in Samba overrides the authenticated user's identity for all file operations on the share. When 'force user = jane' is set, any user accessing the share, including 'bob', will have their effective user ID changed to 'jane' for all file reads, writes, and ownership checks. This ensures that files created or modified on the share are owned by 'jane', regardless of who actually connects.

Answer

root

Answer

nobody

Answer

bob

Question 12

Which TWO commands display the current kernel routing table? (Choose two.)

Accepted Answer

ip route show. The `ip route show` command (from the iproute2 suite) displays the current kernel routing table in a structured, human-readable format. It is the modern replacement for legacy tools like `route` and `netstat`, and it directly reads routing information from the kernel's FIB (Forwarding Information Base).

Answer

route show

Answer

cat /proc/net/route

Answer

ifconfig -a

Question 13

An enterprise environment uses Samba as an Active Directory domain controller using Samba 4.11. The administrator needs to configure a read-only domain controller (RODC) for a remote branch office. Which of the following steps is correct?

Accepted Answer

On the existing DC, run 'samba-tool domain rodc create rodc-name' and then on the RODC server join with 'samba-tool domain join EXAMPLE.COM RODC'.. Samba 4.11 requires the RODC computer account to be pre-created on the existing DC using 'samba-tool domain rodc create', which sets up the necessary krbtgt account and replication metadata. The RODC server then joins the domain as a read-only domain controller with 'samba-tool domain join EXAMPLE.COM RODC', which authenticates against the pre-created account and configures the local Samba instance as a read-only replica.

Answer

On the RODC server, run 'samba-tool domain join EXAMPLE.COM member' and then promote to RODC.

Answer

Install Samba on the RODC server, then run 'samba-tool domain provision --domain=EXAMPLE --adminpass=Pa$$w0rd' on the RODC.

Answer

Install Samba on the RODC server, then run 'samba-tool domain join EXAMPLE.COM RODC -UAdministrator'.

Question 14

An administrator is troubleshooting IPv6 connectivity on an interface with link-local address fe80::1. Which command correctly pings that address from the local host, ensuring the packet uses the correct interface?

Accepted Answer

ping6 -I eth0 fe80::1. The `ping6 -I eth0 fe80::1` command explicitly binds the ICMPv6 echo request to interface `eth0`, which is required when pinging a link-local address (fe80::/10). Link-local addresses are not globally unique; they are scoped to a specific network segment, so the kernel must know which interface to send the packet out of. Without the `-I` option, the system may fail to route the packet or send it out the wrong interface.

Answer

traceroute6 -i eth0 fe80::1

Answer

ping6 fe80::1

Answer

ping -6 eth0 fe80::1

Question 15

A system administrator notices that the 'pcspkr' kernel module is causing beeps on the server console. The administrator wants to prevent this module from loading permanently. Which of the following is the correct method to blacklist the module?

Accepted Answer

Add 'blacklist pcspkr' to /etc/modprobe.d/blacklist.conf. The standard method to permanently prevent a kernel module from loading is to add a 'blacklist' directive to a file in /etc/modprobe.d/. The 'blacklist pcspkr' line tells modprobe not to load the pcspkr module automatically, even if it is requested by hardware detection or dependencies. This is the recommended approach on modern Linux distributions using modprobe's configuration system.

Answer

Add 'install pcspkr /bin/false' to /etc/modprobe.conf

Answer

Set the kernel parameter 'pcspkr=off' in GRUB

Answer

Remove the module file from /lib/modules/$(uname -r)/kernel/drivers/input/misc/