LPIC-2 Practice Test 17 — 15 Questions

Question 1

Given the exhibited routing table and rules, what will happen to a packet originating from IP 192.168.10.50 destined to 8.8.8.8?

Accepted Answer

The packet is forwarded via eth1 to 10.0.0.1.. The packet from 192.168.10.50 to 8.8.8.8 is processed using policy routing rules. A rule matches the source and directs the lookup to routing table 100, which contains a route 0.0.0.0/1 via eth1 with next-hop 10.0.0.1. Since 8.8.8.8 falls within the 0.0.0.0/1 prefix (0.0.0.0–127.255.255.255), the kernel selects this route and forwards the packet via eth1 to 10.0.0.1, making option C correct. Option B is incorrect because it omits the next-hop and implies the /1 route is in the main table, which it is not.

Answer

The packet is dropped because no matching route exists.

Answer

The packet is forwarded via eth1 because of the 0.0.0.0/1 route.

Answer

The packet is forwarded via eth0 to the default gateway in the main table.

Question 2

An administrator needs to add a static route to the destination network 192.168.100.0/24 via gateway 10.0.0.1. Which TWO of the following commands accomplish this? (Choose two.)

Accepted Answer

ip route add 192.168.100.0/24 via 10.0.0.1. The `ip route add` command is the modern Linux utility for adding static routes, specifying the destination network and gateway via the `via` keyword. Option E is correct because the legacy `route add -net` command also adds a static route, using the `gw` parameter to define the gateway, and both commands achieve the same result of adding a route to 192.168.100.0/24 via 10.0.0.1.

Answer

nmcli connection modify eth0 +ipv4.routes "192.168.100.0/24 10.0.0.1"

Answer

ifconfig eth0:1 192.168.100.1 netmask 255.255.255.0

Answer

iptables -A FORWARD -s 192.168.100.0/24 -j ACCEPT

Question 3

Refer to the exhibit. A user on the client tries to ping 'server1' and gets an unknown host error. What is the most likely cause?

Accepted Answer

The DNS server has no record for 'server1.example.com'.. The error 'unknown host' indicates that the client's DNS resolution failed for the hostname 'server1'. Since the client likely uses a fully qualified domain name (FQDN) lookup or appends a search domain, the most common cause is that the DNS server does not have an A or AAAA record for 'server1.example.com'. Without a matching record, the resolver returns NXDOMAIN, leading to the 'unknown host' error.

Answer

The search domain is missing.

Answer

The DNS server IP is incorrect.

Answer

Only one nameserver is specified, causing a timeout.

Question 4

An administrator needs to configure an NFS client to mount an export from an NFSv4 server that requires Kerberos authentication. The client should mount the export at boot time. Which of the following must be ensured for the mount to succeed automatically?

Accepted Answer

The client must have a valid keytab for its host principal.. For an NFSv4 client to automatically mount an export requiring Kerberos authentication at boot time, the client must possess a valid keytab file containing its host principal (e.g., nfs/client.example.com@REALM). This keytab allows the system to obtain Kerberos credentials without interactive user input, enabling the kernel's NFS client to authenticate to the server during the mount process. Without a keytab, the mount would fail because no user is present to run kinit, and the system lacks the cryptographic material to prove its identity.

Answer

The NFS server must have the same hostname as the client.

Answer

The user must run kinit before mounting.

Answer

The mount must be performed via an autofs map.

Question 5

Which TWO parameters are used to control Samba's printer sharing? (Choose two.)

Accepted Answer

printable. The `printable` parameter in Samba's smb.conf marks a share as a printer, enabling clients to send print jobs to it. The `load printers` parameter, when set to 'yes', automatically loads all printers from the system's printcap file into Samba's browse list, making them available for sharing without manual configuration.

Answer

printer name

Answer

printing

Answer

use client driver

Question 6

A Samba server is configured as a print server. Clients running Windows 10 report that printer drivers cannot be uploaded. The relevant smb.conf section is:

[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
printable = yes

What is the most likely cause?

Accepted Answer

The 'guest ok = yes' directive is missing. The 'printable = yes' directive is present, so option A is not the issue. The 'path' /var/spool/samba is the standard spool directory for Samba print jobs, so option B is incorrect. The 'browseable = no' only hides the share from browsing, but does not prevent driver uploads; Windows clients can still connect directly. The most likely cause is that 'guest ok = yes' is missing, because by default Samba requires authentication for printer shares, and Windows 10 clients attempting to upload drivers often do so under the guest account (or without valid credentials) unless the share explicitly allows guest access. Without 'guest ok = yes', the upload is denied.

Answer

The 'printable = yes' directive is missing

Answer

The 'path' is incorrectly set to /var/spool/samba

Answer

The 'browseable = no' directive prevents driver discovery

Question 7

An administrator is configuring nftables to log and drop packets from a specific IP. The rule must be added to the input hook. Which command accomplishes this?

Accepted Answer

nft add rule inet filter input ip saddr 10.0.0.5 log drop. Both options B and C are syntactically valid nftables rules that log and drop packets from the specified IP. Option B uses 'log drop' which logs the packet with default settings and then drops it. Option C adds a custom prefix for more descriptive logging. The question does not require a prefix, so both B and C are correct. Option A logs with 'accept', which contradicts the drop requirement. Option D logs without a verdict, which is incomplete.

Answer

nft add rule inet filter input ip saddr 10.0.0.5 log accept

Answer

nft add rule ip filter input ip saddr 10.0.0.5 drop

Question 8

An LDAP client fails to authenticate users against an LDAP server. The /etc/nsswitch.conf includes 'passwd: files ldap' and the /etc/pam.d/system-auth has appropriate pam_ldap.so entries. However, 'getent passwd' shows only local users. Which command should the administrator run first to diagnose the issue?

Accepted Answer

Run 'ldapsearch -x -H ldap://server -b dc=example,dc=com' to test connectivity.. The first step in diagnosing an LDAP authentication failure is to verify basic connectivity to the LDAP server. Running 'ldapsearch -x -H ldap://server -b dc=example,dc=com' tests whether the client can reach the server and perform a simple anonymous search. If this fails, no amount of configuration tweaking will resolve the issue, as the root cause is likely network or server availability.

Answer

View the contents of /etc/nsswitch.conf.

Answer

Restart the nslcd service.

Answer

Check the syntax of /etc/ldap.conf with 'slaptest -f /etc/ldap.conf'.

Question 9

A company uses Samba to share files from a Linux server to Windows clients. After upgrading Samba from version 4.10 to 4.15, some users report they cannot access shares and receive 'Access denied' errors. The smb.conf has been verified and seems correct. What is the most likely cause?

Accepted Answer

The 'ntlm auth' parameter is set to 'no' in the new version.. Starting with Samba 4.11, the default value of the 'ntlm auth' parameter changed from 'yes' to 'no'. This disables NTLMv1 authentication, which many legacy Windows clients or configurations still rely on. Even though the smb.conf appears correct, the new default silently blocks NTLMv1, causing 'Access denied' errors after the upgrade.

Answer

The firewall is blocking SMB ports.

Answer

The users' passwords are too short.

Answer

The Samba service is not running after upgrade.

Question 10

Based on a network capture that shows a TCP connection to port 80 between 10.0.0.1 and 10.0.0.3, which of the following statements is correct?

Accepted Answer

All of the above. Based on the capture (which shows a TCP connection to port 80), the three-way handshake (SYN, SYN-ACK, ACK) is used, the client 10.0.0.1 uses a random high ephemeral port, and the server 10.0.0.3 responds on port 80, indicating an HTTP server. Thus, all three statements (A, C, D) are true, making 'All of the above' correct.

Answer

The three-way handshake is complete for a TCP connection

Answer

The client is using a random high port

Answer

The server 10.0.0.3 is running an HTTP server

Question 11

The following output is displayed when running network configuration commands on a Linux system: ``` $ ip link show ... 2: eth0: mtu 1500 qdisc fq_codel master br0 state UP ... 3: eth0.10@eth0: mtu 1500 qdisc noqueue state UP ... 4: br0: mtu 1500 qdisc noqueue state UP ... $ brctl show bridge name bridge id STP enabled interfaces br0 8000.000000000000 no eth0 ``` Based on this output, what is the configuration of the network interfaces?

Accepted Answer

eth0 is a VLAN trunk port with native VLAN 1; eth0.10 is a VLAN interface for VLAN 10; br0 is a bridge containing eth0.. In the typical Linux network configuration shown in these outputs, the physical interface eth0 is added to the bridge br0 (as seen with brctl show or ip link set master), making it a bridge port. The native VLAN on eth0 is VLAN 1, meaning untagged traffic on eth0 belongs to VLAN 1 and is bridged through br0. The VLAN subinterface eth0.10 is configured for VLAN 10 (e.g., using ip link add link eth0 name eth0.10 type vlan id 10), which handles tagged traffic for VLAN 10. This setup is consistent with a trunk port carrying multiple VLANs, where the native VLAN is untagged and other VLANs use subinterfaces.

Answer

eth0 is directly connected to a bridge; eth0.10 is a separate physical interface; br0 uses VLAN tagging.

Answer

eth0 is a VLAN ID 10 access port; eth0.10 is a separate link.

Answer

eth0 is a member of VLAN 1 only; eth0.10 is a bridge port.

Question 12

An administrator wants to configure Samba to allow only specific users to access a share. Which TWO configuration parameters in smb.conf can be used to restrict access based on usernames?

Accepted Answer

invalid users. (invalid users) is correct because it explicitly lists usernames that are denied access to a share, overriding any other access controls. Option D (valid users) is correct because it restricts access to only the specified usernames, denying all others. Both parameters operate at the Samba share level and directly filter based on usernames.

Answer

hosts allow

Answer

write list

Answer

read list

Question 13

Given the LDAP client configuration shown in the exhibit, which THREE additional components are required for LDAP authentication to work? (Choose three.)

Accepted Answer

Edit /etc/nsswitch.conf to include ldap in passwd, shadow, and group lines.. /etc/nsswitch.conf controls which sources the system uses for user, group, and password lookups. Adding 'ldap' to the passwd, shadow, and group lines directs the Name Service Switch (NSS) to query the LDAP directory for authentication-related information, which is essential for integrating LDAP as an identity source.

Answer

Install and configure autofs.

Answer

Configure /etc/krb5.conf for Kerberos.

Question 14

A system administrator wants to enforce key-based SSH authentication for all users on a server, disabling password authentication. Which two commands must be executed to achieve this? (Choose TWO.)

Accepted Answer

ssh-keygen -t rsa -b 4096. `ssh-keygen -t rsa -b 4096` generates a 4096-bit RSA key pair, which is a prerequisite for key-based authentication. Option E is correct because `ssh-copy-id user@server` securely copies the public key to the server's `~/.ssh/authorized_keys` file, enabling key-based login. Together, these commands allow the administrator to then disable password authentication by editing `/etc/ssh/sshd_config` (setting `PasswordAuthentication no`) and restarting the SSH service.

Answer

sshd -T

Answer

visudo

Answer

chmod 600 ~/.ssh/authorized_keys

Question 15

Refer to the exhibit. The system boots successfully, but the root filesystem is mounted as read-only even after the boot process completes. Which of the following is the most likely cause?

Accepted Answer

The kernel command line contains the 'ro' parameter, which remains in effect.. The most likely cause is that the kernel command line contains the 'ro' parameter. This parameter explicitly requests a read-only root mount, which persists after boot if no remount (e.g., by init or systemd) is performed. Option C is not the most likely because a damaged filesystem usually causes boot failures or drops to emergency mode, not a successful boot with a read-only root.

Answer

The root device /dev/mapper/vg-root does not exist.

Answer

The root filesystem is damaged and forces read-only mount.

Answer

SELinux is enforcing and prevents write access to the root filesystem.