LPIC-2 Practice Test 15 — 15 Questions

Question 1

What is the purpose of the 'idmap config * : backend = tdb2' line?

Accepted Answer

It sets the default identity mapping backend to tdb2.. The 'idmap config * : backend = tdb2' line in Samba's smb.conf configures the default identity mapping backend for all domains not explicitly specified. The asterisk (*) acts as a wildcard representing any domain, and 'tdb2' is a high-performance, clustered-aware database backend that stores mappings between Windows SIDs and Unix UIDs/GIDs. This ensures that when a user or group from an unspecified domain is encountered, Samba uses tdb2 to manage the ID mapping, making option A correct.

Answer

It specifies the security mode as user.

Answer

It defines the default domain for Samba.

Answer

It enables the winbind cache.

Question 2

A Linux administrator notices that a newly added disk /dev/sdc is not recognized by the system. Which command should be used to rescan the SCSI bus without rebooting?

Accepted Answer

echo '- - -' > /sys/class/scsi_host/host0/scan. Writing '- - -' to /sys/class/scsi_host/host0/scan triggers a SCSI bus rescan on the specified host adapter (host0) without requiring a reboot. The three dashes represent 'channel, target, LUN' wildcards, instructing the kernel to scan all SCSI IDs on that bus to detect newly added devices like /dev/sdc.

Answer

echo 'scan' > /proc/scsi/scsi

Answer

blockdev --rereadpt /dev/sdc

Answer

service scsi restart

Question 3

Match each systemd unit type to its function.

Accepted Answer

service: Manages a daemon or process. Common systemd unit types include service (daemon management), socket (socket-based activation), timer (scheduled tasks), and target (grouping). Distractors swap definitions between types.

Answer

service: Schedules periodic tasks

Answer

socket: Manages a mount point

Question 4

Which TWO configuration files are commonly used to specify DNS resolver settings on a Linux system? (Select TWO.)

Accepted Answer

/etc/systemd/resolved.conf. Option B, /etc/systemd/resolved.conf, is correct because it is the configuration file for systemd-resolved, the DNS resolver service on modern systemd-based Linux distributions, where settings such as DNS=, FallbackDNS=, and Domains= specify the DNS servers used for name resolution. Option C, /etc/resolv.conf, is correct because it is the traditional and still widely used file that lists DNS resolver settings via the nameserver, search, and options directives, and it is read by the resolver library (glibc) for DNS queries. Option A, /etc/nsswitch.conf, is not a DNS resolver settings file; it controls the order in which name service sources (e.g., files, dns, nis) are consulted via the hosts: line, but it does not specify DNS server addresses. Option D, /etc/dhcp/dhclient.conf, configures the DHCP client, and while it can influence how DNS information is obtained (e.g., via supersede or request options), it is not itself a DNS resolver settings file. Option E, /etc/hosts, is a static local hostname-to-IP mapping file, not a DNS resolver configuration file.

Answer

/etc/nsswitch.conf

Answer

/etc/dhcp/dhclient.conf

Answer

/etc/hosts

Question 5

A kernel module has been recompiled. Which command updates the module dependency information?

Accepted Answer

depmod. The `depmod` command is used to generate a list of module dependencies, stored in the modules.dep file, based on the symbols exported by each kernel module. After recompiling a module, this file becomes outdated, and running `depmod -a` (or simply `depmod`) rebuilds the dependency information so that tools like `modprobe` can correctly load modules and their prerequisites.

Answer

modprobe

Answer

insmod

Answer

modinfo

Question 6

Which TWO of the following commands can be used to load a kernel module into the running kernel?

Accepted Answer

insmod. Option A (insmod) is correct because it directly inserts a single kernel module (.ko file) into the running kernel by specifying the module's file path, invoking the init_module() system call. Option D (modprobe) is correct because it loads a kernel module by name into the running kernel while intelligently resolving and loading any dependent modules first, using the module dependency information maintained in modules.dep. The unmarked options do not load modules: depmod (B) only generates the modules.dep dependency file, rmmod (C) removes an already-loaded module from the kernel, and modinfo (E) merely displays metadata about a module file without loading it.

Answer

depmod

Answer

rmmod

Answer

modinfo

Question 7

An administrator is reviewing the audit rules on a Linux server. The current rules are shown in the exhibit. The administrator needs to ensure that any failed attempts to open files are logged, while also monitoring for successful outbound connections. Which of the following describes the effect of the current rules?

Accepted Answer

The first rule logs only failed openat calls, and the second rule logs all connect calls.. The first rule uses the `-F exit=-EACCES` filter, which matches only failed `openat` calls (those returning the EACCES error). The second rule uses `-S connect` without an exit filter, so it logs all `connect` syscalls regardless of success or failure. Therefore, option A correctly describes the effect: failed openat calls and all connect calls are logged.

Answer

The first rule logs only successful openat calls, and the second rule logs only failed connect calls.

Answer

The first rule logs all openat calls, and the second rule logs all connect calls.

Answer

The first rule logs only failed openat calls, and the second rule logs only failed connect calls.

Question 8

A company runs an Apache web server (port 80) and an SSH server (port 22) for remote administration. The system administrator notices that the server has become sluggish and network traffic has increased significantly. Checking /var/log/auth.log reveals hundreds of failed SSH authentication attempts per minute from diverse IP addresses targeting the 'admin' user. The administrator wants to mitigate this brute-force attack with minimal impact on legitimate users. Which course of action is most effective?

Accepted Answer

Install and configure fail2ban to block IP addresses after 5 failed SSH attempts within 10 minutes.. Fail2ban is specifically designed to mitigate brute-force attacks by monitoring log files (e.g., /var/log/auth.log) for repeated failed authentication attempts and dynamically updating firewall rules (e.g., iptables or nftables) to block offending IP addresses. This approach is automated, reduces manual intervention, and has minimal impact on legitimate users since only IPs exceeding the threshold are blocked.

Answer

Change the SSH port to a non-standard port number.

Answer

Disable password authentication for SSH and use key-based authentication only.

Answer

Add the offending IP addresses to /etc/hosts.deny manually.

Question 9

An administrator is troubleshooting network isolation in a Linux container environment. The container should have its own network stack, but it appears to be using the host's interfaces. Which command correctly runs a command inside a network namespace named 'ns1' to verify its network configuration?

Accepted Answer

ip netns exec ns1 ip addr show. The `ip netns exec` command is specifically designed to execute a command within a given network namespace. In this scenario, `ip netns exec ns1 ip addr show` runs the `ip addr show` command inside the network namespace named 'ns1', allowing the administrator to verify that the container has its own network stack and is not using the host's interfaces.

Answer

nsenter -t 1234 -n ip addr show

Answer

unshare -n ip addr show

Answer

ip netns add ns1

Question 10

Which TWO statements about LVM thin provisioning are correct?

Accepted Answer

The filesystem on a thin volume must support the 'discard' option to free unused space.. Option B is correct because a thin volume's filesystem must be mounted with the 'discard' option (or periodically trimmed with fstrim) so that freed blocks are returned to the thin pool, otherwise the pool keeps reporting them as used. Option C is correct because thin provisioning's core feature is over-provisioning: the sum of thin volume virtual sizes can exceed the physical capacity of the thin pool, with space allocated on demand as data is written. Option A is wrong because thin pools are created with 'lvcreate --type thin-pool' (or 'lvconvert --thinpool'), while 'pvcreate' only initializes a physical volume for LVM use. Option D is wrong because dm-cache is a separate LVM caching target for improving performance, not a requirement for thin provisioning, which relies on the dm-thin target. Option E is wrong because thin volumes do not automatically grow; when the pool is exhausted, writes fail unless the pool is extended or the volume is resized manually.

Answer

Thin pools are created using the 'pvcreate' command.

Answer

Thin provisioning requires a dm-cache device to function.

Answer

Thin volumes automatically grow when they run out of space.

Question 11

A Linux host has a routing table entry that sends all traffic destined for the 10.0.0.0/8 network out interface eth1. A packet is sent from 192.168.1.100 to 10.0.0.5. Which interface will the packet exit?

Accepted Answer

eth1. The routing decision is made by looking up the destination address in the routing table. Since the destination is 10.0.0.5, which matches the route for 10.0.0.0/8 via eth1, the packet is sent out eth1. The source address does not affect the routing decision; the kernel selects the exit interface based solely on the destination IP and the routing table.

Answer

eth0, then eth1 after ARP

Answer

eth0

Answer

lo

Question 12

A system administrator configures a Linux client to authenticate users via an LDAP directory directory for user login. The LDAP server is located on a remote network across a WAN link with moderate latency. Authentication succeeds, but user logins take 10-15 seconds to complete, causing delays. The LDAP server logs show low CPU usage and minimal queries per second. The client has not yet implemented any local caching services. The administrator wants to reduce the login delay without compromising security. What should the administrator do?

Accepted Answer

Enable nscd (Name Service Cache Daemon) to cache passwd, group, and services lookups.. Nscd caches the results of name service lookups (passwd, group, hosts, services) in memory, eliminating repeated LDAP queries for the same user or group information. Since the client has no local caching, each login triggers multiple LDAP lookups (e.g., for user entry, group membership, and service resolution), and the WAN latency multiplies the delay. By caching these lookups, nscd reduces the number of round trips over the slow link, cutting login time from 10–15 seconds to near-instant without affecting LDAP TLS security or server configuration.

Answer

Disable LDAP TLS encryption to reduce cryptographic overhead.

Answer

Change the file ownership of /etc/pam.d/common-auth to root to force direct LDAP reads.

Answer

Increase the number of LDAP server threads to handle concurrent requests faster.

Question 13

A web server running Apache is receiving many failed login attempts. Which tool should be used to dynamically block IPs after a configurable number of failures?

Accepted Answer

fail2ban. fail2ban is the correct tool because it monitors log files (e.g., /var/log/apache2/error.log) for repeated failed login attempts and dynamically updates iptables or nftables rules to block the offending IP address after a configurable threshold (e.g., maxretry = 5). It is purpose-built for this task, offering flexible jails and ban actions, unlike static or system-wide mechanisms.

Answer

TCP Wrappers

Answer

/etc/hosts.deny

Answer

iptables

Question 14

Which file is used to configure the LDAP client for system authentication on a modern Linux system using nss-pam-ldapd?

Accepted Answer

/etc/nslcd.conf. /etc/nslcd.conf is the configuration file for nslcd, the LDAP name service daemon used by nss-pam-ldapd to perform LDAP queries for system authentication and user/group lookups. This daemon communicates with the LDAP server and provides the results to NSS and PAM modules, making it the central configuration point for LDAP client authentication on modern Linux systems.

Answer

/etc/openldap/ldap.conf

Answer

/etc/nsswitch.conf

Answer

/etc/ldap.conf

Question 15

To list all currently loaded kernel modules, which command is used?

Accepted Answer

lsmod. The correct command to list all currently loaded kernel modules is `lsmod`. It reads the `/proc/modules` file and displays the module name, size, used count, and a list of dependent modules. This is the standard and most direct method on Linux systems.

Answer

kmod -l

Answer

modlist

Answer

modules_loaded