LPIC-2 Practice Test 16 — 15 Questions

Question 1

An administrator wants to encrypt a file so that only a specific recipient can decrypt it. Which GPG command should be used?

Accepted Answer

gpg --encrypt --recipient key-id file. The `--encrypt` flag with `--recipient key-id` uses the recipient's public key to encrypt the file, ensuring that only the holder of the corresponding private key can decrypt it. This is the standard asymmetric encryption workflow in GPG for targeted confidentiality.

Answer

gpg --symmetric file

Answer

gpg --clearsign file

Answer

gpg --sign file

Question 2

Which THREE of the following are valid Linux bonding modes? (Choose three.)

Accepted Answer

balance-rr. balance-rr (B) is a valid Linux bonding mode (mode 0) that provides round-robin transmission across slave interfaces for load balancing and fault tolerance. 802.3ad (C) is a valid mode (mode 4) implementing IEEE 802.3ad Dynamic Link Aggregation with LACP, requiring switch support for aggregation. active-backup (D) is a valid mode (mode 1) where only one slave is active and another takes over if the active one fails, providing fault tolerance without switch configuration. link-aggregation (A) is not a valid bonding mode name; the correct aggregation mode is 802.3ad (or balance-xor/balance-tlb for other aggregation types). 802.1ad (E) is not a bonding mode; it is an IEEE standard for provider bridging (QinQ VLAN stacking), unrelated to Linux bonding.

Answer

link-aggregation

Answer

802.1ad

Question 3

A DNS administrator wants to implement DNSSEC on an authoritative zone. Which TWO resource records are essential for DNSSEC?

Accepted Answer

DNSKEY. DNSKEY (B) is essential because it holds the zone's public signing keys (the Zone Signing Key and Key Signing Key) that validators use to verify DNSSEC signatures. RRSIG (C) is essential because it contains the actual cryptographic signature covering each RRset in the signed zone, allowing resolvers to authenticate the data. Together, DNSKEY and RRSIG form the core of DNSSEC validation for an authoritative zone. NSEC (A) is used for authenticated denial of existence but is not required for every signed zone (NSEC3 is an alternative), so it is not universally essential. A (D) is just a host address record and SOA (E) is the zone's start-of-authority record; neither provides the cryptographic material DNSSEC requires.

Answer

NSEC

Answer

A

Answer

SOA

Question 4

Which THREE files are commonly involved in configuring a Linux client for LDAP authentication?

Accepted Answer

/etc/pam.d/system-auth. Option C, /etc/pam.d/system-auth, is correct because PAM (Pluggable Authentication Modules) must be configured to route authentication requests to the LDAP server via modules such as pam_ldap.so or pam_sss.so, and on RHEL/CentOS systems this is the primary PAM stack file for system authentication. Option D, /etc/ldap.conf, is correct because it holds the LDAP client parameters — the server URI (e.g., ldap://ldap.example.com), base DN, and TLS settings — that the pam_ldap and nss_ldap libraries read to contact the directory. Option E, /etc/nsswitch.conf, is correct because its passwd, shadow, and group lines must include ldap (e.g., 'passwd: files ldap') so the Name Service Switch actually queries LDAP for user and group lookups. Option A, /etc/hosts, is not required for LDAP authentication since it only provides static hostname-to-IP mappings and is unrelated to directory service configuration. Option B, /etc/resolv.conf, is not required either, as it merely configures DNS resolution and is not a file that configures LDAP authentication itself.

Answer

/etc/hosts

Answer

/etc/resolv.conf

Question 5

Which TWO commands can be used to connect to a Samba share from a Linux command line?

Accepted Answer

smbclient. smbclient (B) is correct because it is the Samba client utility designed to connect to SMB/CIFS shares from the Linux command line, e.g. 'smbclient //server/share -U user', allowing browsing and file transfer over the SMB protocol. mount.cifs (D) is correct because it mounts a remote SMB/CIFS share into the local filesystem, typically via 'mount -t cifs //server/share /mnt/point -o username=user', which is the standard way to access a Samba share as a mounted directory. sshfs (A) is wrong because it mounts shares over SFTP/SSH, not the SMB/CIFS protocol used by Samba. nfsmount (C) is wrong because it is not a real command and NFS is a different protocol from SMB/CIFS. ftp (E) is wrong because it uses the FTP protocol, which is unrelated to Samba's SMB/CIFS sharing.

Answer

sshfs

Answer

nfsmount

Answer

ftp

Question 6

Which two commands can be used to create a swap space on a partition /dev/sdb2? (Choose two.)

Accepted Answer

mkswap /dev/sdb2. Option A, mkswap /dev/sdb2, is correct because mkswap is the standard util-linux command that initializes a partition as swap space by writing the swap signature and header to the device, which is exactly what is needed to create swap on /dev/sdb2. Option D, mkswap -L swap /dev/sdb2, is also correct because it performs the same swap-space initialization while additionally assigning the label "swap" to the device, and the -L option is a valid mkswap flag that does not prevent the swap area from being created. Option B, swapon /dev/sdb2, is incorrect because swapon only activates an already-initialized swap area; it does not create the swap signature. Option C, dd if=/dev/zero of=/dev/sdb2 bs=1M count=1024, is incorrect because dd merely writes zeros to the partition and does not format it as swap. Option E, mkfs.swap /dev/sdb2, is incorrect because there is no standard mkfs.swap helper; swap is initialized with mkswap, not a mkfs variant.

Answer

swapon /dev/sdb2

Answer

dd if=/dev/zero of=/dev/sdb2 bs=1M count=1024

Answer

mkfs.swap /dev/sdb2

Question 7

A user reports that an external USB hard drive is not detected when plugged in. The system uses a standard kernel with USB support. What is the most likely reason?

Accepted Answer

The usb_storage module is blacklisted.. The most likely reason is that the `usb_storage` module is blacklisted, which prevents the kernel from loading the driver needed to detect USB mass storage devices. Even though the kernel has USB support compiled in or as a module, a blacklist entry in `/etc/modprobe.d/` or `/etc/modprobe.conf` explicitly blocks the module from loading, causing the drive to appear undetected. This is a common troubleshooting scenario where all other USB functionality works, but storage devices fail.

Answer

The USB driver is not installed.

Answer

The external drive is incompatible.

Answer

The kernel lacks USB support.

Question 8

A Linux router running multiple routing tables is misconfigured. The administrator wants to add a policy routing rule that sends all traffic from subnet 10.10.0.0/16 to routing table 200. Which command should be used?

Accepted Answer

ip rule add from 10.10.0.0/16 table 200. The `ip rule` command is used to add policy routing rules in Linux, which direct packets to specific routing tables based on criteria like source address. The `from` parameter specifies the source subnet (10.10.0.0/16), and `table 200` directs matching traffic to routing table 200, enabling policy-based routing beyond the default table.

Answer

route add -net 10.10.0.0/16 table 200

Answer

iptables -A FORWARD -s 10.10.0.0/16 -j table 200

Answer

ip route add 10.10.0.0/16 dev eth0 table 200

Question 9

A system has multiple kernels installed. Which command shows the version of the currently booted kernel?

Accepted Answer

uname -r. The `uname -r` command specifically displays the kernel release (version) of the currently running operating system. It reads this information directly from the `/proc/sys/kernel/osrelease` virtual file, which is populated by the kernel at boot time. This makes it the most direct and reliable method to identify the active kernel version.

Answer

rpm -qa | grep kernel

Answer

cat /proc/version

Answer

ls /boot

Question 10

A company has two BIND DNS servers, a primary and a secondary. The secondary fails to receive zone updates. Which command can be used to check if the primary allows zone transfers to the secondary?

Accepted Answer

dig axfr example.com @primary. The `dig axfr example.com @primary` command performs an AXFR (full zone transfer) request against the primary DNS server. If the primary allows zone transfers to the secondary, the command will return the entire zone file; if it is denied, it will return a 'Transfer failed' or 'refused' message. This directly tests the allow-transfer ACL configuration on the primary, which is the most common cause of secondary servers failing to receive zone updates.

Answer

host -l example.com primary

Answer

dig -x 192.0.2.1 @primary

Answer

nslookup -type=any example.com primary

Question 11

Which TWO of the following are recommended best practices for securing a Linux server that is publicly accessible?

Accepted Answer

Use a firewall to restrict access to only necessary ports.. Option C is correct because a host-based firewall such as iptables, nftables, or ufw should enforce a default-deny policy that permits only the specific TCP/UDP ports required by exposed services (for example 22/tcp for SSH and 443/tcp for HTTPS), minimizing the attack surface on a publicly reachable server. Option E is correct because disabling direct root login via SSH, typically by setting PermitRootLogin no in /etc/ssh/sshd_config, forces administrators to authenticate as an unprivileged user and then escalate through sudo, which removes a well-known, high-value target and enables per-user accountability and auditing. Option A is wrong because running services as root violates least privilege and lets any service compromise yield full system control. Option B is wrong because simple, memorable passwords are trivially guessable or brute-forced, whereas strong passphrases, key-based SSH authentication, and tools like fail2ban are recommended. Option D is wrong because enabling NFS exports on a public server unnecessarily exposes file-sharing services and weakens the security posture.

Answer

Run all services with root privileges.

Answer

Set all user passwords to simple, memorable ones.

Answer

Enable NFS exports for file sharing.

Question 12

Which sysctl parameter controls the system's behavior when a kernel oops occurs (e.g., automatically reboot)?

Accepted Answer

kernel.panic_on_oops. The `kernel.panic_on_oops` sysctl parameter controls the system's behavior when a kernel oops occurs. Setting it to 1 causes the kernel to panic on an oops, and if `kernel.panic` is also set to a positive value (e.g., seconds before reboot), the system will automatically reboot after the panic. This is the correct parameter for triggering a reboot on an oops.

Answer

vm.panic_on_oom

Answer

kernel.unknown_nmi_panic

Answer

kernel.oops

Question 13

During boot, a server's video driver causes a freeze. At the GRUB2 menu, the administrator needs to interactively add the kernel parameter 'nomodeset' to the boot entry. Which key should be pressed to access the kernel command line editor?

Accepted Answer

e. Pressing 'e' at the GRUB2 menu enters the edit mode for the selected boot entry, allowing the administrator to modify kernel parameters interactively. This is the standard GRUB2 keybinding to access the kernel command line editor, where 'nomodeset' can be added to the 'linux' line to disable kernel mode-setting and prevent the video driver from freezing during boot.

Answer

a

Answer

Tab

Answer

c

Question 14

A Samba server experiences slow file transfers for large files. The administrator suspects oplock issues. Which set of parameters should be adjusted to disable opportunistic locking?

Accepted Answer

oplocks = no and level2 oplocks = no. Disabling opportunistic locking (oplocks) in Samba requires setting both 'oplocks = no' and 'level2 oplocks = no'. The 'oplocks = no' directive disables exclusive oplocks, but Samba's default behavior still allows level2 oplocks (read-only caching). To fully disable all forms of oplock caching, both parameters must be set to 'no', preventing client-side caching that can cause conflicts and slow transfers for large files.

Answer

oplocks = false alone is sufficient

Answer

strict locking = yes

Answer

kernel oplocks = no

Question 15

A system administrator recently configured two NICs in a bonding interface (bond0) using mode 1 (active-backup). Although both links appear up, traffic never fails over when the primary link goes down. Which command should the administrator use to diagnose the bonding status and determine the root cause?

Accepted Answer

cat /proc/net/bonding/bond0. /proc/net/bonding/bond0 is the kernel-level interface that exposes the current bonding driver state, including active slave, link status, and failover counters. In mode 1 (active-backup), this file shows whether the primary interface is actually marked as 'up' by the bonding driver and whether the backup interface is ready to take over. The administrator can check for issues such as the primary link being stuck in a 'down' state due to misconfigured MII monitoring or missing 'miimon' parameter.

Answer

netstat -i

Answer

ifconfig bond0

Answer

ethtool bond0