LPIC-2 Practice Test 15 — 15 Questions

Question 1

A user reports that an external USB hard drive is not detected when plugged in. The system uses a standard kernel with USB support. What is the most likely reason?

Accepted Answer

The usb_storage module is blacklisted.. The most likely reason is that the `usb_storage` module is blacklisted, which prevents the kernel from loading the driver needed to detect USB mass storage devices. Even though the kernel has USB support compiled in or as a module, a blacklist entry in `/etc/modprobe.d/` or `/etc/modprobe.conf` explicitly blocks the module from loading, causing the drive to appear undetected. This is a common troubleshooting scenario where all other USB functionality works, but storage devices fail.

Answer

The USB driver is not installed.

Answer

The external drive is incompatible.

Answer

The kernel lacks USB support.

Question 2

A PAM configuration file for password authentication includes the line 'password requisite pam_cracklib.so retry=3 minlen=8'. A user tries to change their password but is rejected even though the new password meets the stated criteria. The administrator suspects a conflict with another PAM module. Which of the following is the most likely cause?

Accepted Answer

Another PAM module such as pam_pwhistory.so might be configured to prevent reuse of old passwords, causing rejection even though pam_cracklib passes.. Pam_pwhistory.so is commonly used to enforce password history, preventing reuse of recent passwords. Even if pam_cracklib.so accepts the new password as meeting complexity and length requirements, pam_pwhistory.so can reject it if it matches a previously used password, leading to the observed failure.

Answer

The 'retry=3' option limits attempts, but the password is only tried once.

Answer

The 'requisite' control flag causes immediate failure if pam_cracklib fails, but another module might be overriding.

Answer

The 'minlen=8' option requires exactly 8 characters, not at least 8.

Question 3

A Linux server running Samba as a domain member is experiencing slow authentication for users. Which two configuration changes are most likely to improve authentication performance?

Accepted Answer

Enable 'winbind offline logon = yes'. Enabling 'winbind offline logon = yes' allows winbind to cache user credentials locally, so authentication can proceed without contacting the domain controller if it is temporarily unreachable, reducing latency for repeated logins. Option C is correct because setting 'idmap config * : backend = tdb' stores ID mappings (UID/GID to SID) in a local tdb database, avoiding repeated queries to the domain controller for mapping resolution, which directly improves authentication performance in a domain member setup.

Answer

Disable SMB signing by setting 'server signing = disabled'

Answer

Change 'security = ADS' to 'security = user'

Answer

Set 'name resolve order = lmhosts host wins bcast'

Question 4

A Linux administrator is managing a database server running on CentOS 7 that uses ext4 filesystems on LVM. The server has three physical volumes: /dev/sda (200GB), /dev/sdb (200GB), and /dev/sdc (200GB) all in volume group 'vg_db'. The logical volume 'lv_data' (400GB) is used for database files. Recently, the DBA reports that database writes are slower than expected. Iostat shows high average wait times (>100ms) on /dev/sdc but normal on /dev/sda and /dev/sdb. The LVM stripes data across all three PVs with a stripe size of 64KB. Which action should the administrator take to improve performance?

Accepted Answer

Replace /dev/sdc with a new disk and restore the mirror or restripe.. The high average wait time on /dev/sdc indicates that this specific physical volume is a performance bottleneck, likely due to hardware failure or degradation. Since the logical volume 'lv_data' stripes data across all three PVs, the overall write performance is limited by the slowest device in the stripe set. Replacing /dev/sdc with a new disk and restoring the stripe (e.g., using pvmove to relocate extents and then replacing the device) eliminates the bottleneck and restores balanced I/O across all PVs.

Answer

Convert lv_data to linear mapping on /dev/sda and /dev/sdb only.

Answer

Increase the stripe size to 256KB to reduce I/O overhead.

Answer

Remove /dev/sdc from the volume group and reduce the stripe count to 2.

Question 5

An administrator needs to create a Samba share that allows all users in the 'staff' group read/write access, but denies access to everyone else. Which configuration achieves this?

Accepted Answer

[share]
   path = /data
   valid users = @staff
   read only = no. It uses `valid users = @staff` to restrict access exclusively to members of the 'staff' group, and `read only = no` grants read/write permissions to those valid users. The `@` prefix in Samba denotes a group, ensuring only group members can connect, while `read only = no` overrides the default read-only behavior to allow writes.

Answer

[share]
   path = /data
   read list = staff
   read only = yes

Answer

[share]
   path = /data
   valid users = staff
   read only = yes

Answer

[share]
   path = /data
   write list = @staff
   browseable = yes

Question 6

Order the steps to configure a Linux system as a router using iptables.

Accepted Answer

Enable IP forwarding, set default iptables policies, add NAT and FORWARD rules, then save the iptables configuration.. When configuring a Linux system as a router using iptables, the proper order is: first enable IP forwarding (via sysctl), then set default iptables policies (e.g., DROP for FORWARD), then add NAT (e.g., MASQUERADE) and FORWARD rules, and finally save the iptables configuration to make it persistent. This sequence ensures the kernel is prepared for routing, policies are in place to control traffic flow, rules are applied correctly, and changes are saved.

Answer

Set default iptables policies, enable IP forwarding, add NAT and FORWARD rules, then save the iptables configuration.

Answer

Save the iptables configuration, enable IP forwarding, set default iptables policies, then add NAT and FORWARD rules.

Answer

Add NAT and FORWARD rules, enable IP forwarding, set default iptables policies, then save the iptables configuration.

Question 7

Refer to the exhibit. A user attempts to access the 'public' share without authentication. What will be the outcome?

Accepted Answer

Access granted as guest because map to guest = Bad User and guest ok = yes. The Samba configuration combines `map to guest = Bad User` with `guest ok = yes`. When a user attempts to access the 'public' share without authentication, Samba treats the connection as a guest due to the 'Bad User' mapping (since no valid credentials were provided). The `guest ok = yes` directive then explicitly grants access to the share, allowing the user to connect as the guest account (typically 'nobody').

Answer

Access denied because security = user

Answer

Access denied because read only = yes

Answer

Access granted with full read/write because guest ok = yes

Question 8

A Linux client is configured to authenticate users against an LDAP server using PAM. Some users are unable to log in, while others succeed. The admin has verified that the LDAP server is reachable and that the user entries exist. Which of the following is the most likely cause?

Accepted Answer

The pam_ldap configuration has a size limit that restricts search results.. The pam_ldap configuration can include a size limit (e.g., 'pam_ldap size_limit 500') that restricts the number of entries returned from an LDAP search. When a user logs in, PAM may perform a search that returns multiple matching entries (e.g., due to ambiguous username or group membership lookups), and if the result set exceeds this limit, the search fails for some users. This explains why some users succeed while others fail, even though the LDAP server is reachable and user entries exist.

Answer

The nsswitch.conf file is missing the 'ldap' entry for 'passwd'.

Answer

The LDAP server is using different encryption settings.

Answer

The nslcd service is not running.

Question 9

Which three conditions must be met for a filesystem to be mounted by UUID in /etc/fstab? (Choose three.)

Accepted Answer

The UUID must be present in /dev/disk/by-uuid/. The Linux kernel and udev create symbolic links in /dev/disk/by-uuid/ for each block device that has a UUID. When /etc/fstab specifies a filesystem by UUID, the mount command resolves the UUID by looking up the corresponding symlink in this directory. If the symlink is missing (e.g., due to a missing udev rule or a corrupted device), the mount will fail.

Answer

The blkid command must have been run at least once

Answer

The UUID must be listed in the kernel's boot parameters

Question 10

A user reports they cannot obtain an IP address via DHCP. The DHCP server logs show no client activity, but the network cable is connected. Which configuration is most likely missing on the DHCP server?

Accepted Answer

subnet declaration. The DHCP server logs show no client activity, meaning the server is not receiving DHCPDISCOVER packets from the client. The most likely missing configuration is a subnet declaration, which defines the network segment the DHCP server should listen on and allocate addresses from. Without a matching subnet declaration in the DHCP configuration (e.g., /etc/dhcp/dhcpd.conf), the server will ignore requests from that subnet, even if the physical cable is connected.

Answer

deny unknown-clients

Answer

default-lease-time

Answer

option domain-name

Question 11

Refer to the exhibit. A security audit reveals that the server is not blocking SSH connections from unauthorized networks. What is the most likely cause?

Accepted Answer

The SSH rule does not restrict source IP, so it allows all incoming SSH connections.. The SSH rule in the exhibit uses `--dport 22` without any `-s` or `--source` parameter to restrict the source IP address. This means the rule matches any incoming TCP packet destined for port 22, regardless of its origin network. Without a source IP restriction, the firewall allows SSH connections from all networks, including unauthorized ones, which is the security issue identified by the audit.

Answer

The FORWARD chain is DROP, blocking all forwarded traffic.

Answer

The SSH rule uses --dport 22 but missing source IP restriction, allowing all sources.

Answer

The default policy for INPUT is DROP, which should block all, but SSH works due to the ESTABLISHED,RELATED rule.

Question 12

A security audit reveals that the /var/log directory contains world-readable log files that may contain sensitive information. The administrator wants to ensure new files created in /var/log are not readable by others, without affecting existing file permissions. Which umask value should be set system-wide?

Accepted Answer

umask 026. (umask 026) is correct because it sets the default permissions for new files to 640 (rw-r-----), which removes read access for 'others' while preserving read access for group members. The umask value is subtracted from the base permissions (666 for files), so a umask of 026 results in 666 - 026 = 640, meeting the requirement that new files in /var/log are not world-readable without altering existing file permissions.

Answer

umask 027

Answer

umask 022

Answer

umask 077

Question 13

An administrator needs to configure iSCSI multipathing. After setting up two paths, which command should be used to verify the multipath topology?

Accepted Answer

multipath -l. The `multipath -l` command displays the current multipath topology, showing the aggregated device mapper (dm) devices, their underlying paths, and their status (active/passive or active/active). This is the standard tool for verifying multipath configuration after setting up iSCSI paths, as it reads the multipathd state and presents a human-readable map of the multipath devices.

Answer

lsscsi

Answer

dmsetup ls

Answer

iscsiadm -m session -P 3

Question 14

Which TWO authentication modules can be used with PAM to integrate LDAP authentication on a Linux client?

Accepted Answer

pam_krb5. Option B (pam_krb5) is correct because it allows PAM to authenticate users via Kerberos, which is frequently used as the authentication backend for LDAP directories. In typical enterprise deployments, LDAP stores user attributes while Kerberos handles the actual authentication; integrating LDAP authentication on a Linux client therefore often requires both pam_ldap (for user information) and pam_krb5 (for authentication). Option E (pam_ldap) is correct because it directly enables PAM to perform LDAP bind operations for user authentication. Both modules together provide a complete LDAP-based authentication solution.

Answer

pam_unix

Answer

pam_radius

Answer

pam_tally2

Question 15

Order the steps to configure a Linux system as an SSH server with key-based authentication.

Accepted Answer

Install SSH server, then configure SSH server, then generate SSH key pair, then copy public key to server, then restart SSH service and test.. Install SSH server, configure it, generate keys, copy public key, restart and test.

Answer

Generate SSH key pair, then install SSH server, then configure SSH server, then copy public key, then restart and test.

Answer

Install SSH server, then generate SSH key pair, then copy public key, then configure SSH server, then restart and test.

Answer

Install SSH server, then configure SSH server, then copy public key, then generate SSH key pair, then restart and test.