LPIC-2 Practice Test 18 — 15 Questions

Question 1

A Postfix mail server is configured to use Dovecot SASL for authentication. Users report that they can send emails but are prompted for password repeatedly and see "SASL authentication failed" in the logs. The Dovecot SASL socket is configured correctly. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The postfix user does not have permission to access the Dovecot auth socket.. The most common cause of repeated password prompts and 'SASL authentication failed' errors when Postfix is configured to use Dovecot SASL is a permissions issue on the Dovecot auth socket. Even if the socket path is correct in Postfix's `smtpd_sasl_path`, the Postfix process (typically running as the `postfix` user) must have read/write access to that socket file. Without proper permissions, Postfix cannot communicate with Dovecot's authentication service, causing SASL failures despite correct authentication mechanisms and enabled settings.

Answer

The mynetworks parameter in Postfix is set to the wrong subnet.

Answer

The Dovecot auth mechanism is set to 'login' but Postfix expects 'PLAIN'.

Answer

The smtpd_sasl_auth_enable parameter is set to no.

Question 2

A Linux server requires several VLAN interfaces on eth0. The network switch expects 802.1Q tagged frames for VLAN 10. Which command correctly creates the VLAN interface?

Accepted Answer

ip link add link eth0 name eth0.10 type vlan id 10. The `ip link` command with the `type vlan id 10` parameter creates a VLAN subinterface on eth0 that tags outgoing frames with VLAN 10 using the 802.1Q standard. This is the modern, recommended method for VLAN interface creation on Linux, replacing legacy tools like `vconfig`.

Answer

modprobe 8021q; ifconfig eth0 up

Answer

vconfig add eth0 10

Answer

ifconfig eth0:10 192.168.10.1/24 up

Question 3

Which of the following is a mail delivery agent (MDA)?

Accepted Answer

Procmail. Procmail is a classic mail delivery agent (MDA) that receives messages from a mail transfer agent (MTA) and delivers them to a user's local mailbox, often applying filtering rules based on recipes. It operates after the MTA has accepted the message, making it the correct choice for an MDA.

Answer

Postfix

Answer

Dovecot

Answer

Sendmail

Question 4

A Linux router running FRR (Free Range Routing) needs to participate in OSPF with adjacent Cisco routers. Which configuration file should be modified to enable OSPF?

Accepted Answer

/etc/frr/frr.conf. FRR (Free Range Routing) stores its unified routing protocol configuration in /etc/frr/frr.conf. This file is the primary configuration file for all FRR daemons, including OSPF, and is read by the frr service at startup. Modifying this file and then reloading FRR enables OSPF on the Linux router to peer with adjacent Cisco routers.

Answer

/etc/quagga/ospfd.conf

Answer

/etc/network/interfaces

Answer

/etc/ospfd.conf

Question 5

A BIND9 nameserver is configured with 'allow-transfer { none; };' but a secondary nameserver needs to receive zone transfers. What change must be made on the master?

Accepted Answer

Set 'allow-transfer' to the secondary's IP.. The 'allow-transfer' directive on the master nameserver controls which hosts are permitted to request zone transfers (AXFR/IXFR). Setting it to 'none;' blocks all transfers, so to allow a secondary to receive the zone, you must explicitly list the secondary's IP address in the 'allow-transfer' statement on the master. This is the direct and necessary change to enable zone transfers to that specific slave.

Answer

Add a 'masters' statement in the slave's configuration.

Answer

Set 'notify' to yes.

Answer

Set 'also-notify' to the secondary IP.

Question 6

A systems administrator is configuring a Postfix mail server to use Dovecot for SASL authentication. The authentication method is set to PLAIN in Dovecot, and Postfix has smtpd_sasl_auth_enable=yes and smtpd_sasl_type=dovecot. Dovecot's auth socket is at /var/run/dovecot/auth-client. The mail logs show repeated "SASL authentication failed" errors for known good credentials. The administrator checks that the socket exists and that Dovecot is running. What is the most likely cause?

Accepted Answer

The postfix user does not have read permission on the Dovecot auth socket.. The most likely cause is that the Postfix user (typically 'postfix' or the mail queue owner) lacks read permission on the Dovecot auth socket at /var/run/dovecot/auth-client. Dovecot's SASL authentication via a Unix socket requires the connecting process (Postfix) to have read/write access to that socket file. Even though the socket exists and Dovecot is running, if the permissions are too restrictive (e.g., owned by 'dovecot' with mode 0600), Postfix cannot communicate with Dovecot's auth service, resulting in repeated 'SASL authentication failed' errors despite valid credentials.

Answer

The smtpd_recipient_restrictions does not include permit_sasl_authenticated.

Answer

The Dovecot service is not listening on TCP port 143 for IMAP.

Answer

The mynetworks parameter in Postfix is set incorrectly.

Question 7

A web administrator has installed Apache httpd 2.4 on a Linux server. The default configuration serves files from /var/www/html. When accessing http://server/, the browser shows a directory listing of /var/www/html instead of the index.html file that exists in that directory. The administrator confirms that the user has read permissions on the file and that the file is named index.html. Which directive is most likely missing from the Apache configuration?

Accepted Answer

DirectoryIndex index.html. The DirectoryIndex directive specifies which file Apache should serve when a client requests a directory (e.g., /). Without it, or if it does not list index.html, Apache falls back to generating a directory listing (if Options +Indexes is enabled) or returns a 403 Forbidden. Since the default configuration for Apache 2.4 includes Options +Indexes and DirectoryIndex index.html, the most likely cause is that the DirectoryIndex directive was removed or overridden in a context (e.g., a <Directory> block) and no longer includes index.html, causing Apache to ignore the file and show the directory listing instead.

Answer

IndexOptions FancyIndexing

Answer

Options -Indexes

Answer

Require all granted

Question 8

A Samba server uses 'security = domain' with an NT4-style domain. After a domain controller outage, users cannot authenticate. Which configuration change would allow fallback to local authentication?

Accepted Answer

Set 'security = user' and 'passdb backend = tdbsam'. When a Samba server is configured with 'security = domain', it relies on a remote NT4-style domain controller for authentication. If the domain controller is unavailable, users cannot authenticate because Samba has no local fallback. Changing to 'security = user' and setting 'passdb backend = tdbsam' switches Samba to authenticate users against its own local password database (tdbsam), allowing authentication even when the domain controller is down.

Answer

Set 'domain master = no'

Answer

Set 'local master = yes'

Answer

Set 'preferred master = no'

Question 9

A Samba server is configured with 'vfs objects = recycle' to implement a recycle bin. After some time, users notice that deleted files are not appearing in the recycle bin. Which parameter is likely misconfigured?

Accepted Answer

recycle:repository. The `vfs objects = recycle` module requires the `recycle:repository` parameter to specify the directory where deleted files should be moved. If this parameter is missing or misconfigured, the recycle bin will not function, and deleted files will be permanently removed instead of being stored in the recycle repository.

Answer

recycle:maxsize

Answer

recycle:keeptree

Answer

recycle:versions

Question 10

A Samba share requires that users must provide valid credentials, but the share should be accessible to any authenticated user without further restrictions. Which security mode should be used?

Accepted Answer

security = user. The `security = user` mode requires each user to provide valid credentials (username and password) to access the share, but once authenticated, the share is accessible without further per-share restrictions. This matches the requirement exactly: authentication is mandatory, but authorization is not granularly controlled per share beyond the user's identity.

Answer

security = domain

Answer

security = server

Answer

security = share

Question 11

A user 'bob' is unable to save changes to report.doc. Based on the exhibit, what is the most likely reason?

Accepted Answer

Alice has the file open with a deny-write lock.. The exhibit shows that Alice has the file open with a deny-write lock, which prevents any other user (including Bob) from writing to the file. In Samba, this is enforced by the share mode locking mechanism, where a deny-write share access request from Alice blocks subsequent write attempts by Bob until Alice closes the file.

Answer

The oplock is set to NONE causing conflicts.

Answer

Bob does not have permission on the filesystem.

Answer

The share is configured as read-only.

Question 12

Which directive in dhcpd.conf sets the maximum lease time?

Accepted Answer

max-lease-time. The `max-lease-time` directive in `dhcpd.conf` explicitly sets the maximum lease time (in seconds) that the DHCP server will assign to a client, overriding any client request for a longer lease. This ensures the server enforces an upper bound on lease duration, preventing clients from monopolizing IP addresses indefinitely.

Answer

option lease-time

Answer

default-lease-time

Answer

lease-time

Question 13

An administrator configures an NIS client by running 'ypbind' and updating /etc/nsswitch.conf to include 'nis' for passwd, shadow, and group. However, 'getent passwd' still shows only local users. Which step is most likely missing?

Accepted Answer

Edit /etc/yp.conf to specify the NIS server's domain and address.. The NIS client must know which NIS server to contact for domain information. This is configured in /etc/yp.conf, which specifies the NIS domain name and the server's hostname or IP address. Without this file, ypbind cannot locate a server, so getent falls back to local sources despite nsswitch.conf listing 'nis'.

Answer

Restart the ypserv service on the client.

Answer

Execute 'yppasswd' to initialize NIS client.

Answer

Run 'make -C /var/yp' on the client.

Question 14

A DHCP client reports it cannot obtain an IP address. The Ethernet cable is connected and the interface is up. The administrator runs 'dhclient eth0' but gets 'No DHCPOFFERS received'. The network has a DHCP server on the same subnet. Which command should the administrator use next to diagnose the problem?

Accepted Answer

Run 'tcpdump -i eth0 port 67 or port 68' to monitor DHCP packets.. The client is not receiving DHCPOFFERs, indicating a network-level issue with DHCP traffic. Using tcpdump to capture packets on ports 67 (BOOTP server) and 68 (BOOTP client) allows the administrator to see if DHCPDISCOVER packets are leaving the client and whether any DHCPOFFER packets arrive from the server. This directly isolates whether the problem is a lack of server response, packet filtering, or a misconfigured relay agent.

Answer

Run 'route -n' to see if a default route exists.

Answer

Run 'netstat -i eth0' to check packet errors.

Answer

Run 'ifconfig eth0' to check the interface status.

Question 15

An administrator runs the command shown. However, when a user tries to execute a binary from /mnt/tmp, it fails with 'Permission denied'. What is the most likely cause?

Accepted Answer

The noexec mount option prevents execution.. The `noexec` mount option explicitly prevents execution of any binaries on the filesystem, regardless of their permission bits. When a filesystem is mounted with `noexec`, the kernel will refuse to execute any file on that mount point, returning 'Permission denied' even if the file has execute permissions set. This is the most likely cause because the administrator's command likely mounted `/mnt/tmp` with `noexec` (e.g., via `mount -o noexec` or a default mount option).

Answer

The binary is not executable.

Answer

The tmpfs filesystem does not support execution.

Answer

The nosuid option prevents setuid binaries.