LPIC-2 Practice Test 17 — 15 Questions

Question 1

A network administrator is configuring source-based routing. They have created a new routing table and added a default route. They then run: ip rule add to 10.0.0.0/24 lookup 100. Traffic from 10.0.0.0/24 still uses the main table. What is the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The rule uses 'to' instead of 'from' to match the source subnet.. The `ip rule add to 10.0.0.0/24 lookup 100` command uses the `to` keyword, which matches the destination address, not the source address. For source-based routing, you must use the `from` keyword to match the source subnet. Since the rule matches destination 10.0.0.0/24 instead of source, traffic originating from 10.0.0.0/24 is not matched by this rule and continues to use the main routing table.

Answer

The rule is not persistent.

Answer

The rule priority is too high.

Answer

The routing table 100 does not have a default route.

Question 2

Which systemd target is equivalent to the traditional SysV runlevel 3 (multi-user text mode)?

Accepted Answer

multi-user.target. In systemd, multi-user.target is the direct equivalent of SysV runlevel 3, which provides a multi-user text-mode environment without a graphical desktop. This target starts all essential system services and network support but does not launch a display manager, making it the standard for headless servers and maintenance.

Answer

rescue.target

Answer

graphical.target

Answer

emergency.target

Question 3

A Linux router is experiencing packet loss for connections that should be forwarded. The router's IP forwarding is enabled, and the routing table is correct. Which kernel parameter is most likely causing the issue?

Accepted Answer

net.ipv4.conf.all.rp_filter. The `net.ipv4.conf.all.rp_filter` parameter enables Reverse Path Filtering (RPF), which drops packets arriving on an interface if the kernel does not have a route back to the source IP via that same interface. On a router forwarding traffic between networks, strict RPF can cause packet loss when asymmetric routing is present, even though IP forwarding and the routing table are correct.

Answer

net.ipv4.conf.all.log_martians

Answer

net.ipv4.conf.all.accept_redirects

Answer

net.ipv4.ip_forward

Question 4

An administrator is troubleshooting IPv6 connectivity on an interface with link-local address fe80::1. Which command correctly pings that address from the local host, ensuring the packet uses the correct interface?

Accepted Answer

ping6 -I eth0 fe80::1. The `ping6 -I eth0 fe80::1` command explicitly binds the ICMPv6 echo request to interface `eth0`, which is required when pinging a link-local address (fe80::/10). Link-local addresses are not globally unique; they are scoped to a specific network segment, so the kernel must know which interface to send the packet out of. Without the `-I` option, the system may fail to route the packet or send it out the wrong interface.

Answer

traceroute6 -i eth0 fe80::1

Answer

ping6 fe80::1

Answer

ping -6 eth0 fe80::1

Question 5

Which of the following is the correct command to add an IPv6 address 2001:db8::1/64 to interface eth0?

Accepted Answer

ip -6 addr add 2001:db8::1/64 dev eth0. The `ip -6 addr add` command is the proper way to add an IPv6 address to an interface using the `ip` tool from the iproute2 suite. The `-6` option restricts the operation to IPv6, and the address must include the prefix length (`/64`) to define the subnet. The `dev eth0` parameter specifies the target interface.

Answer

ip addr add 2001:db8::1/64 dev eth0

Answer

ip -6 addr add 2001:db8::1 dev eth0

Answer

ip link set eth0 ipv6 2001:db8::1/64

Answer

ifconfig eth0 inet6 add 2001:db8::1/64

Question 6

A developer has compiled a custom kernel with a new feature. The kernel modules are installed in /lib/modules/$(uname -r)/. However, when the system boots, the kernel fails to load some modules with 'Exec format error'. What is the most likely cause?

Accepted Answer

The modules were compiled against a different kernel version.. The 'Exec format error' indicates that the kernel module binary is incompatible with the running kernel. This most commonly occurs when modules are compiled against a different kernel version (e.g., different kernel source tree or configuration), as the module's vermagic string must exactly match the kernel's vermagic. The kernel's module loader checks this version magic before loading; a mismatch causes the exec format error.

Answer

The kernel configuration has disabled module loading.

Answer

The modules have incorrect file permissions.

Answer

The modules are not properly ordered in the dependency file.

Question 7

Which THREE conditions must be met for a Linux system to act as a router between two networks?

Accepted Answer

IP forwarding must be enabled in the kernel (net.ipv4.ip_forward = 1).. Option A is correct because a Linux host only forwards packets between interfaces when the kernel parameter net.ipv4.ip_forward is set to 1 (via sysctl or /proc/sys/net/ipv4/ip_forward); otherwise packets destined for another network are dropped locally. Option C is correct because the router must know where to send traffic for each destination network, which requires routes in its routing table (either directly connected routes or static/dynamic routes) pointing out the appropriate interface. Option D is correct because each interface participating in routing must be assigned an IP address within the subnet it serves, so hosts on those networks can use it as their gateway and so the router can source/forward on that link. Option B is not required: a default gateway is only needed for reaching networks the router does not have explicit routes for, and a router between two directly connected networks can function without one. Option E is not required: while a restrictive FORWARD chain policy or rules can block forwarding, the absence of firewall rules (or a permissive policy) is not a condition for routing itself, and firewalld/iptables need not even be running.

Answer

The system must have a default gateway configured.

Answer

The firewall must allow forwarding (FORWARD chain policy ACCEPT).

Question 8

A system administrator notices that external clients cannot resolve the company's primary website (www.example.com) but internal clients can. What is the most likely cause?

Accepted Answer

The external DNS server has a missing A record for www.example.com.. If the external DNS server is missing an A record for www.example.com, external clients querying that server will receive a negative response (NXDOMAIN or NODATA), while internal clients can still resolve the name if the internal DNS server has the correct record (e.g., via zone transfer or manual configuration). This scenario directly explains the symptom: internal resolution works, external fails.

Answer

The internal DNS server is not authoritative for the zone.

Answer

The firewall is blocking port 53 UDP to the internal DNS server.

Answer

The internal DNS server is not configured for recursion.

Question 9

A system administrator wants to combine two Gigabit Ethernet interfaces of a Linux server into a single logical interface to increase throughput and provide redundancy. Which kernel module should be loaded to support this? (Assume the interfaces are identical and are connected to the same switch.)

Accepted Answer

bonding. The bonding kernel module (bonding) is the correct choice for combining two Gigabit Ethernet interfaces into a single logical interface to increase throughput and provide redundancy. Bonding is a standard Linux kernel module for link aggregation that supports various modes (e.g., active-backup, 802.3ad). On LPIC-2, bonding is the expected technology for interface bonding.

Answer

bridge

Answer

teaming

Answer

802.1q

Question 10

Which TWO statements about the /etc/hosts file are true?

Accepted Answer

It can contain a line like '127.0.0.1 localhost'.. Option A is correct because /etc/hosts maps IP addresses to hostnames, and the loopback entry '127.0.0.1 localhost' is a standard, valid line in that file. Option B is correct because the primary purpose of /etc/hosts is static hostname-to-IP-address resolution, typically consulted by the resolver (via nsswitch.conf) before or alongside DNS. Option C is wrong because DNS server addresses are configured in /etc/resolv.conf (or via systemd-resolved/NetworkManager), not /etc/hosts. Option D is wrong because, by default, the hosts file is consulted before DNS in the standard nsswitch.conf 'hosts: files dns' ordering. Option E is wrong because interface aliases are configured with tools like ip addr add or ifconfig, not by /etc/hosts.

Answer

It configures the DNS servers to use.

Answer

It is consulted after DNS by default.

Answer

It can define aliases for network interfaces.

Question 11

Which iptables command is necessary to allow incoming SSH connections (port 22) from the subnet 192.168.1.0/24 while dropping all other incoming traffic? Assume the INPUT chain has a default policy of DROP.

Accepted Answer

iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT. It explicitly allows SSH traffic from the specified subnet before the default DROP policy drops everything else. Option B is not necessary because the INPUT chain already has a default policy of DROP, which drops all unmatched packets. Adding an explicit DROP rule at the end is redundant and not required by the question, which asks for the 'necessary' command.

Answer

iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j DROP

Answer

iptables -A INPUT -j DROP

Answer

iptables -A INPUT -j ACCEPT

Answer

iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

Question 12

You are the security administrator for a company that runs a web application on a Linux server. The application runs under the user 'www-data' and listens on TCP port 8080. The server also runs an SSH service on port 22. Recently, an external penetration test revealed that an attacker could exploit a vulnerability in the web application to execute commands as the 'www-data' user, and from there, the attacker could escalate privileges to root due to a misconfigured sudo rule. You need to implement a defense-in-depth approach to limit the impact of such an attack. Which single action would be the most effective in preventing privilege escalation from the 'www-data' user to root, while still allowing the application to function normally?

Accepted Answer

Review and remove any sudo privileges granted to the 'www-data' user in /etc/sudoers, and ensure the application does not require sudo.. The core issue is a misconfigured sudo rule that allows the 'www-data' user to execute commands as root. By reviewing and removing any sudo privileges for 'www-data' in /etc/sudoers, you directly eliminate the privilege escalation path without affecting the web application's normal operation, as the application itself does not require sudo to function on its designated port 8080.

Answer

Change the SSH port to a non-standard port to reduce the attack surface.

Answer

Run the web application in a chroot jail to isolate it from the rest of the filesystem.

Answer

Implement mandatory access control with AppArmor profiles for the web application.

Question 13

A web server is running in enforcing mode under SELinux. The administrator wants to allow Apache to connect to a remote database server. Which SELinux boolean needs to be set to allow httpd to make network connections?

Accepted Answer

httpd_can_network_connect_db. The SELinux boolean `httpd_can_network_connect_db` is specifically designed to allow the httpd process to connect to remote database servers. This boolean is more targeted than the generic `httpd_can_network_connect`, which permits all outbound TCP connections. Since the question explicitly mentions a remote database server, the specific boolean is the most appropriate choice.

Answer

httpd_enable_homedirs

Answer

httpd_can_network_connect

Answer

httpd_unified

Question 14

A user reports they cannot obtain an IP address via DHCP. The DHCP server logs show no client activity, but the network cable is connected. Which configuration is most likely missing on the DHCP server?

Accepted Answer

subnet declaration. The DHCP server logs show no client activity, meaning the server is not receiving DHCPDISCOVER packets from the client. The most likely missing configuration is a subnet declaration, which defines the network segment the DHCP server should listen on and allocate addresses from. Without a matching subnet declaration in the DHCP configuration (e.g., /etc/dhcp/dhcpd.conf), the server will ignore requests from that subnet, even if the physical cable is connected.

Answer

deny unknown-clients

Answer

default-lease-time

Answer

option domain-name

Question 15

A Linux router needs to forward DHCP broadcasts from clients on subnet 192.168.1.0/24 (eth0) to a DHCP server at 10.0.0.5. Which command starts a DHCP relay agent?

Accepted Answer

dhcrelay -i eth0 10.0.0.5. The correct command is `dhcrelay -i eth0 10.0.0.5`. This starts the DHCP relay agent (ISC DHCP relay) on interface eth0, listening for DHCP broadcast packets (UDP port 67) from clients on subnet 192.168.1.0/24 and forwarding them as unicast to the DHCP server at 10.0.0.5. The relay agent also relays the server's unicast replies back to the client, enabling DHCP service across subnets without a local DHCP server.

Answer

dhcpd -cf /etc/dhcp/dhcpd.conf

Answer

iptables -A INPUT -i eth0 -p udp --dport 67 -j REDIRECT

Answer

dnsmasq -i eth0