LPIC-2 Practice Test 18 — 15 Questions

Question 1

Which TWO commands can be used to rebuild the initramfs on modern Linux systems? (Choose two.)

Accepted Answer

dracut -f. `dracut -f` forces the regeneration of the initramfs on modern Red Hat–based distributions (e.g., RHEL, CentOS, Fedora). Option C is correct because `update-initramfs -u` updates the initramfs on Debian/Ubuntu systems by rebuilding the current kernel's initramfs image. Both commands are the standard tools for rebuilding the initial RAM filesystem on their respective distributions.

Answer

mkinitrd

Answer

grub-mkconfig

Answer

mkinitramfs

Question 2

A Samba server is experiencing slow authentication for domain users. The logs show repeated winbind connections to the domain controllers. The administrator suspects that winbind is not caching credentials properly. Which parameter should be checked or increased to improve caching?

Accepted Answer

winbind cache time. The `winbind cache time` parameter controls how long winbindd caches user and group information retrieved from domain controllers. Increasing this value reduces the frequency of authentication requests to the DCs, improving performance. The default is 300 seconds; a higher value (e.g., 900 or 1800) can significantly reduce repeated connections.

Answer

winbind rpc only

Answer

winbind offline logon

Answer

winbind request timeout

Question 3

Which TWO commands can be used to display the routing table on a Linux system?

Accepted Answer

route -n. The `route -n` command displays the kernel IP routing table with numeric addresses, avoiding DNS lookups for faster output. It is a traditional tool that directly reads the /proc/net/route file to show destination, gateway, netmask, and interface information. This makes it a valid and commonly used command for viewing the routing table on Linux.

Answer

ss -r

Answer

ip link show

Answer

netstat -r

Question 4

A Linux server in a DMZ hosts a custom web application that listens on TCP port 8080. The server is also configured with SSH on port 22 for remote administration. Recently, the security team noticed an increase in brute-force attacks against SSH from various external IPs. The server runs Fedora with firewalld as the firewall service. The current firewalld default zone is 'public', and the SSH service is allowed in the 'public' zone. The administrator wants to mitigate the brute-force attacks without blocking legitimate users. Additionally, the administrator wants to ensure that only specific administrative IP addresses can initiate SSH connections, and that SSH connections are rate-limited to prevent flooding. The administrator also needs to keep the web application accessible from any external IP. Which course of action best meets these requirements?

Accepted Answer

Add a firewalld rich rule to allow SSH only from specific source IPs, and add a rich rule to limit connection rate for SSH. Keep the web application in the same zone with the appropriate service.. Firewalld rich rules allow granular control: you can specify source IPs for SSH access and apply a connection rate limit (e.g., using 'limit' in the rich rule) to mitigate brute-force attacks without blocking legitimate users. The web application on port 8080 remains accessible from any external IP because the 'public' zone still has the appropriate service allowed, and the rich rules only restrict SSH. This approach avoids changing the default zone or using external tools like fail2ban, keeping the solution within firewalld's native capabilities.

Answer

Move SSH to a non-standard port (e.g., 2222) and update the firewalld service definition accordingly.

Answer

Use iptables to create a whitelist for SSH, and install fail2ban to rate-limit after 3 failures.

Answer

Change the default zone to 'drop', then add a rich rule to allow SSH only from the administrative network.

Question 5

Which command can be used to create a swap partition on /dev/sdb1?

Accepted Answer

mkswap /dev/sdb1; swapon /dev/sdb1. B is correct because creating a swap partition requires two steps: first, `mkswap` initializes the partition as a swap area by writing a swap signature (UUID and superblock) to /dev/sdb1; second, `swapon` activates the swap space, making it available to the kernel for paging. Without `mkswap`, the partition lacks the necessary swap metadata and cannot be used.

Answer

swapcreate /dev/sdb1

Answer

swapon /dev/sdb1

Answer

mkfs.swap /dev/sdb1

Question 6

An administrator needs to ensure a kernel module is never loaded, even if requested. Which file should be used?

Accepted Answer

/etc/modprobe.d/blacklist.conf. The standard mechanism to prevent a kernel module from loading is to add a `blacklist` directive in a file under `/etc/modprobe.d/`, typically named `blacklist.conf`. The `modprobe` utility reads all `.conf` files in this directory, and a `blacklist <module_name>` entry ensures the module is never automatically loaded or loaded via `modprobe`, even if explicitly requested.

Answer

/etc/modprobe.d/deny.conf

Answer

/lib/modprobe.d/blacklist.conf

Answer

/etc/modules-load.d/blacklist.conf

Question 7

Refer to the exhibit. The user 'user' reports that they are able to run 'sudo apt-get update' without a password, but 'sudo apt-get upgrade' prompts for a password. What is the most likely cause?

Accepted Answer

The second rule does not include the NOPASSWD tag, so password is required.. The sudoers rule for 'apt-get upgrade' lacks the NOPASSWD tag, so sudo defaults to requiring a password. The first rule for 'apt-get update' includes NOPASSWD, which allows passwordless execution, but each command specification in sudoers is independent unless explicitly grouped. The absence of NOPASSWD on the second rule means sudo will prompt for the user's password as per its default behavior.

Answer

The 'Defaults:user !requiretty' setting affects password prompting.

Answer

The command 'apt-get upgrade' is being run as the user, not as root.

Answer

The rules are in the wrong order, causing the second to be overridden.

Question 8

A Samba server is configured as a classic PDC (Primary Domain Controller) for a legacy network. The administrator needs to add a new machine account for a client joining the domain. Which command accomplishes this?

Accepted Answer

smbpasswd -a -m MACHINENAME. In a classic Samba PDC (Primary Domain Controller) setup, machine accounts are stored in the `smbpasswd` file (or tdbsam) and are added using `smbpasswd -a -m MACHINENAME`. The `-m` flag specifically indicates a machine account, which appends a `$` to the name and sets the appropriate flags for domain membership. This command creates the machine trust account that the client uses to join the domain.

Answer

samba-tool domain add machinename

Answer

net rpc join machinename

Answer

pdbedit -a -m MACHINENAME

Question 9

A Linux workstation must be configured to automatically mount an NFS share from server nfs.example.com:/exports/data at boot time. The share should be mounted with noexec and nosuid options. Which line should be added to /etc/fstab?

Accepted Answer

nfs.example.com:/exports/data /mnt/data nfs noexec,nosuid,_netdev 0 0. It specifies the NFS filesystem type, includes the required mount options (noexec, nosuid, _netdev), and uses the correct fstab format. The _netdev option is critical for network filesystems to ensure the system waits for network availability before attempting the mount at boot time.

Answer

nfs.example.com:/exports/data /mnt/data nfs noexec,nosuid 0 0

Answer

nfs.example.com:/exports/data /mnt/data auto noexec,nosuid,_netdev 0 0

Answer

nfs.example.com:/exports/data /mnt/data nfs4 noexec,nosuid 0 0

Question 10

A laptop user frequently moves between different networks. The administrator wants the DNS configuration to update automatically when the laptop connects to a new network via DHCP. Which service or tool is most appropriate for this task?

Accepted Answer

NetworkManager. NetworkManager is the most appropriate tool because it is designed to manage network connections on modern Linux systems, automatically detecting network changes and reconfiguring DNS settings based on DHCP-provided information. It integrates with various backends (e.g., systemd-resolved, resolvconf) to update the system's DNS configuration dynamically, making it ideal for a laptop that frequently moves between networks.

Answer

systemd-resolved

Answer

dhcpcd

Answer

resolvconf

Question 11

Which TWO files are commonly used to configure PAM authentication for the 'login' service on a Linux system? (Choose two.)

Accepted Answer

/etc/pam.d/login. `/etc/pam.d/login` is the PAM service-specific configuration file for the `login` service on Linux systems that use the modern `pam.d` directory structure. When PAM is invoked for the `login` service, it reads this file to determine which authentication modules to apply, such as `pam_unix.so` for password verification or `pam_securetty.so` for root login restrictions.

Answer

/etc/default/login

Answer

/etc/login.defs

Answer

/etc/pam.conf

Question 12

Your company runs a Samba file server (version 4.15) in a mixed environment with Windows 10 and Linux clients. The server is part of an Active Directory domain. Recently, a new security policy requires that all SMB connections use SMB3 encryption. You have configured 'smb encrypt = required' in the [global] section of smb.conf and restarted smbd. However, Windows clients report that they cannot connect to the server, while Linux clients can connect using mount.cifs with the 'seal' option. You check smb.conf and verify that 'server min protocol = SMB3' is set. What is the most likely cause of the Windows clients' inability to connect?

Accepted Answer

Windows clients do not have SMB encryption enabled by default, so they reject the required encryption. Windows 10 clients do not enable SMB encryption by default; they require the client to request encryption, but when the server sets 'smb encrypt = required', the server demands encryption on all connections. Windows clients without explicit encryption configuration (e.g., via Group Policy or registry) will fail to connect because they do not negotiate SMB3 encryption automatically. Linux clients succeed because mount.cifs with the 'seal' option explicitly requests encryption, matching the server's requirement.

Answer

The 'server min protocol = SMB3' should be 'SMB2' to allow Windows 10 to negotiate SMB3

Answer

The Samba server must be joined to the domain again after changing encryption settings

Answer

The 'smb encrypt' parameter is deprecated and should be replaced by 'server smb encrypt'

Question 13

A system administrator needs to configure an NFS client to automatically mount an exported filesystem from a remote server whenever a user accesses the mount point. Which configuration approach is most appropriate?

Accepted Answer

Configure automount using autofs with an indirect map.. Autofs with an indirect map allows the NFS filesystem to be mounted on-demand when a user accesses the mount point, and automatically unmounted after a period of inactivity. This is the standard Linux approach for dynamic, on-demand NFS mounting without requiring a persistent entry in /etc/fstab or manual intervention.

Answer

Add an entry to /etc/fstab with the 'defaults' option.

Answer

Use the 'mount -t nfs' command each time a user needs access.

Answer

Place a mount command in /etc/rc.local.

Question 14

Refer to the exhibit. The DNS server at 192.0.2.1 is the primary for example.com. What does the 'lame server' message indicate?

Accepted Answer

The server does not consider itself authoritative for example.com.. A 'lame server' message in DNS indicates that a server has received a query for a domain for which it is configured as a nameserver (e.g., via NS records or delegation), but it does not consider itself authoritative for that domain. In this case, the DNS server at 192.0.2.1 is the primary for example.com, so the message means it is not configured with the zone data or does not have the zone loaded, thus it responds as non-authoritative.

Answer

The server received a query for an invalid domain.

Answer

The server is not configured to listen on the querying client's network.

Answer

The server is too busy to answer queries.

Question 15

An administrator needs to add support for a new hardware device by compiling a kernel module. After compiling the module against the current kernel source, the module fails to load with 'modprobe: ERROR: could not insert 'mymod': Unknown symbol in module'. Which of the following is the most likely cause?

Accepted Answer

The module was compiled against a different kernel version than the running kernel. The error 'Unknown symbol in module' indicates that the module references a kernel symbol (function or variable) that is not present in the currently running kernel. This most commonly occurs when the module was compiled against a different kernel version or configuration than the running kernel, causing symbol version mismatches. The kernel's symbol versioning (CONFIG_MODVERSIONS) checks CRC values of exported symbols, and a mismatch prevents insertion.

Answer

The module has not been signed for Secure Boot

Answer

The module's dependencies are missing

Answer

The module name conflicts with a built-in driver