LPIC-2 Practice Test 16 — 15 Questions

Question 1

A Samba administrator notices that Windows clients cannot access a shared directory. The share is defined in smb.conf as follows:

[shared]
path = /srv/samba/shared
valid users = @staff
browseable = yes
read only = no

The /srv/samba/shared directory has permissions 755 and is owned by root:staff. Which is the most likely cause of the access issue?

Accepted Answer

The 'staff' group lacks write permission on the directory. The 'staff' group lacks write permission on the directory because the directory has permissions 755, which grants write access only to the owner (root). Even though the share is defined as 'read only = no', Samba enforces filesystem-level permissions. Since the 'valid users = @staff' restricts access to members of the staff group, they need write permission on the directory to create or modify files. The group 'staff' has only read and execute permissions (r-x), so write operations fail.

Answer

The 'valid users' parameter is misspelled

Answer

The share is defined as browseable but not listed

Answer

SELinux is blocking access and must be disabled

Question 2

Which TWO parameters are used to control Samba's printer sharing? (Choose two.)

Accepted Answer

printable. The `printable` parameter in Samba's smb.conf marks a share as a printer, enabling clients to send print jobs to it. The `load printers` parameter, when set to 'yes', automatically loads all printers from the system's printcap file into Samba's browse list, making them available for sharing without manual configuration.

Answer

printer name

Answer

printing

Answer

use client driver

Question 3

An organization requires that all email traffic from their mail server must be encrypted in transit. Which of the following is the most appropriate solution?

Accepted Answer

Enable STARTTLS on the SMTP server to encrypt connections.. STARTTLS is the standard method for upgrading a plaintext SMTP connection to an encrypted one using TLS, as defined in RFC 3207. It allows the mail server to negotiate encryption on the standard SMTP port (25) or submission port (587), ensuring that email traffic is encrypted in transit without requiring a separate port or protocol. This is the most appropriate solution because it is widely supported, interoperable, and aligns with modern email security best practices.

Answer

Implement IPsec to encrypt all traffic between mail servers.

Answer

Use SMTPS (SMTP over SSL) on port 465.

Answer

Configure the mail server to use SSH tunneling for all SMTP connections.

Question 4

A Samba server is configured with 'security = ads' and joined to an Active Directory domain. Users can authenticate but cannot access shares. The smb.conf includes 'winbind use default domain = yes'. What could be the problem?

Accepted Answer

The 'valid users' parameter uses domain prefix while default domain is set. When 'winbind use default domain = yes' is set, Winbind strips the domain prefix from usernames, so users authenticate as 'username' instead of 'DOMAIN\username'. If the 'valid users' parameter in a share definition explicitly uses the domain prefix (e.g., 'valid users = DOMAIN\username'), the stripped username will not match, and access is denied. This mismatch is the most direct cause of authentication succeeding but share access failing.

Answer

The 'winbind use default domain' option should be 'no'

Answer

The 'idmap backend' is not configured

Answer

The Samba server's time is not synchronized with the domain controller

Question 5

Which THREE are valid values for the 'security' parameter in smb.conf? (Choose three.)

Accepted Answer

ads. Option B (ads) is correct because the 'security = ads' setting in smb.conf configures Samba to operate in Active Directory domain member mode, allowing it to join an Active Directory domain using Kerberos authentication and LDAP for identity resolution. This is a valid security mode for integrating Samba with Windows Active Directory environments.

Answer

auto

Answer

share

Question 6

A system administrator notices that the SSH service on a Linux server is failing to start. The log shows: 'sshd: error: Could not load host key: /etc/ssh/ssh_host_rsa_key'. What is the most likely cause and solution?

Accepted Answer

The host key file is missing or corrupt. Run 'ssh-keygen -A' to regenerate all missing host keys.. The error message indicates that the SSH daemon cannot load the RSA host key file. Host keys are generated during package installation or manually via ssh-keygen. Option D is correct because running 'ssh-keygen -A' automatically generates all missing host key types (RSA, ECDSA, Ed25519) that are configured for use, resolving the missing or corrupt key issue without manual intervention.

Answer

The sshd_config file has a syntax error. Run 'sshd -t' to check it.

Answer

The SSH service is managed by xinetd and the configuration is missing. Edit /etc/xinetd.d/ssh.

Answer

The /etc/ssh/sshd_config file has incorrect permissions. Change them to 600.

Question 7

A security policy requires that all users must change their passwords every 90 days. Which command enforces maximum password age for an existing user 'jdoe'?

Accepted Answer

chage -M 90 jdoe. The `chage -M 90 jdoe` command sets the maximum number of days a password is valid for user 'jdoe' to 90 days, enforcing the security policy. The `-M` option directly controls the password aging parameter that defines when the password must be changed, as stored in `/etc/shadow`.

Answer

passwd -f jdoe

Answer

usermod -e 90 jdoe

Answer

chage -E 90 jdoe

Question 8

A security audit reveals that the /var/log directory contains world-readable log files that may contain sensitive information. The administrator wants to ensure new files created in /var/log are not readable by others, without affecting existing file permissions. Which umask value should be set system-wide?

Accepted Answer

umask 026. Option D (umask 026) is correct because it sets the default permissions for new files to 640 (rw-r-----), which removes read access for 'others' while preserving read access for group members. The umask value is subtracted from the base permissions (666 for files), so a umask of 026 results in 666 - 026 = 640, meeting the requirement that new files in /var/log are not world-readable without altering existing file permissions.

Answer

umask 027

Answer

umask 022

Answer

umask 077

Question 9

Based on the iptables output, what is the expected behavior for incoming SSH connections on eth0?

Accepted Answer

SSH connections from any source to port 22 on eth0 are allowed if they are new.. The iptables output shows a rule on the INPUT chain for eth0 that accepts TCP packets destined for port 22 (SSH) with the state NEW. This means that any incoming SSH connection attempt (SYN packet) that is not part of an existing connection is explicitly allowed. The default policy for the INPUT chain is ACCEPT (not shown as DROP), so even without this rule, SSH would be allowed, but the rule ensures it is explicitly permitted for new connections.

Answer

SSH connections are only allowed if they are part of an established connection.

Answer

SSH connections are dropped because the default policy is DROP.

Answer

SSH connections are only allowed from the loopback interface.

Question 10

Based on the ACL output, which user(s) can write to the file /var/www/html/index.html?

Accepted Answer

Only root.. The correct answer is C because the ACL output shows that the mask is set to r--, which limits the effective permissions of named users and groups to read-only, regardless of their ACL entries. However, the root user is not subject to ACL restrictions and always has full access to any file, including write permission, making root the only user who can write to the file.

Answer

Only the user www-data.

Answer

No one, because the mask is r--.

Answer

Any user in the www-data group.

Question 11

Refer to the exhibit. The output shows a DHCP exchange between a client (MAC 00:1a:2b:3c:4d:5e) and a server (192.168.1.1). The client is not obtaining an IP address. What is the most likely reason?

Accepted Answer

The client's /etc/dhcp/dhclient.conf contains a 'reject' statement that rejects offers from this server.. Option A is correct because the DHCP client can be configured with a 'reject' statement in /etc/dhcp/dhclient.conf to ignore offers from specific servers. In this scenario, the client sends a DHCPDISCOVER, receives a DHCPOFFER from 192.168.1.1, but then does not proceed to DHCPREQUEST, indicating the offer was rejected locally. This matches the behavior of a reject rule, which causes the client to discard the offer without further communication.

Answer

The DHCP server did not receive the client's request.

Answer

The DHCP server is not reachable from the client.

Answer

The client's MAC address is not authorized on the DHCP server.

Question 12

Which THREE conditions can cause a Linux DHCP client to fail to obtain an IP address? (Select THREE.)

Accepted Answer

A firewall on the client is blocking UDP port 67 (DHCP server).. Option A is correct because a client-side firewall blocking UDP port 67 prevents the DHCP client from receiving DHCPOFFER and DHCPACK messages from the server. DHCP uses UDP ports 67 (server) and 68 (client); blocking port 67 on the client disrupts inbound server responses, causing the client to fail to obtain an IP address.

Answer

The DHCP server is configured with a different subnet than the client's broadcast domain.

Answer

The client interface is configured with a static IP address.

Question 13

Refer to the exhibit. A user on the client tries to ping 'server1' and gets an unknown host error. What is the most likely cause?

Accepted Answer

The DNS server has no record for 'server1.example.com'.. The error 'unknown host' indicates that the client's DNS resolution failed for the hostname 'server1'. Since the client likely uses a fully qualified domain name (FQDN) lookup or appends a search domain, the most common cause is that the DNS server does not have an A or AAAA record for 'server1.example.com'. Without a matching record, the resolver returns NXDOMAIN, leading to the 'unknown host' error.

Answer

The search domain is missing.

Answer

The DNS server IP is incorrect.

Answer

Only one nameserver is specified, causing a timeout.

Question 14

An administrator needs to configure a Linux client to automatically obtain an IP address from a DHCP server but also ensure that the client uses a specific static DNS server (8.8.8.8) regardless of the DHCP-provided DNS. Which configuration should be applied?

Accepted Answer

Add 'supersede domain-name-servers 8.8.8.8;' to /etc/dhcp/dhclient.conf. Option D is correct because the `supersede` directive in `/etc/dhcp/dhclient.conf` forces the DHCP client to replace any DNS server addresses received from the DHCP server with the specified value (8.8.8.8). This ensures the client uses the static DNS server regardless of what the DHCP server offers, while still obtaining its IP address dynamically.

Answer

Add 'append domain-name-servers 8.8.8.8;' to /etc/dhcp/dhclient.conf

Answer

Edit /etc/sysconfig/network-scripts/ifcfg-eth0 and set PEERDNS=no and DNS1=8.8.8.8

Answer

Add 'prepend domain-name-servers 8.8.8.8;' to /etc/dhcp/dhclient.conf

Question 15

A Linux client is experiencing slow name resolution. The /etc/nsswitch.conf file has the line 'hosts: files dns'. The /etc/hosts file contains many entries. What is the most effective way to improve resolution speed?

Accepted Answer

Change the nsswitch.conf line to 'hosts: dns files'. Option B is correct because the current order 'hosts: files dns' causes the resolver to check the entire /etc/hosts file first for every query, which is slow when the file contains many entries. Reversing the order to 'hosts: dns files' makes the resolver query DNS first, which is typically faster for most lookups, and only falls back to the local file if DNS fails. This directly addresses the bottleneck without requiring additional services or data removal.

Answer

Increase the DNS timeout in /etc/resolv.conf

Answer

Install and configure nscd (Name Service Cache Daemon)

Answer

Remove all entries from /etc/hosts except localhost