LPIC-2 Practice Test 19 — 15 Questions

Question 1

To ensure that OpenVPN clients authenticate the server, which configuration directive should be present on the client side?

Accepted Answer

ca. The `ca` directive on the client side specifies the Certificate Authority (CA) certificate file that the client uses to verify the server's certificate during the TLS handshake. This ensures the client authenticates the server's identity, preventing man-in-the-middle attacks. Without this, the client cannot validate that it is connecting to a trusted OpenVPN server.

Answer

tls-verify

Answer

tls-auth

Answer

cert

Question 2

A system administrator wants to change the default kernel boot parameters temporarily to debug a boot issue. Which step should be taken at the GRUB menu to modify kernel parameters for the next boot only?

Accepted Answer

Select the kernel entry and press 'e' to edit the boot parameters.. Pressing 'e' at the GRUB menu allows you to edit the boot parameters for the selected kernel entry temporarily. This modifies the kernel command line only for the current boot, without persisting changes to disk. After editing, pressing Ctrl+X or F10 boots the system with the modified parameters, making it ideal for debugging boot issues.

Answer

Edit /etc/default/grub and run update-grub to apply changes.

Answer

Press 'c' to enter the command line and modify parameters.

Answer

Press 'Esc' to access the advanced options menu.

Question 3

A systems administrator is troubleshooting a server that fails to boot after a kernel upgrade. The boot process hangs at the stage where the kernel attempts to mount the root filesystem. Which of the following is the most likely cause?

Accepted Answer

The root= parameter in the kernel command line points to a non-existent device.. When the kernel fails to mount the root filesystem during boot, the most common cause is an incorrect or missing `root=` parameter in the kernel command line. This parameter specifies the device (e.g., `/dev/sda1` or `UUID=...`) that the kernel should mount as the root filesystem; if it points to a non-existent device, the kernel cannot proceed past the mount stage, resulting in a hang or kernel panic.

Answer

The root filesystem is formatted with an unsupported filesystem type.

Answer

The initrd image is missing from the /boot partition.

Answer

The GRUB bootloader is not installed on the MBR.

Question 4

Given the exhibit, what is the most likely reason for the GPG error, and what is the correct way to fix it permanently?

Accepted Answer

The public key is missing; obtain and add it with 'apt-key add' or 'wget -O- | apt-key add -'. The GPG error indicates that the repository's Release file is signed but the system lacks the corresponding public key to verify the signature. This is a common issue when adding third-party repositories. The correct permanent fix is to obtain the missing public key and add it to the APT keyring using 'apt-key add' or by piping the key with 'wget -O- | apt-key add -', which allows APT to authenticate the repository's metadata.

Answer

The repository is not signed; use '--allow-unauthenticated' permanently in /etc/apt/apt.conf.d/

Answer

The repository URL is incorrect; change 'http://deb.example.com' to 'https://deb.example.com'

Answer

The InRelease file is corrupted; remove it and run 'apt-get update' again

Question 5

A user reports that they cannot SSH to a remote server using the usual command 'ssh user@remote.example.com'. The administrator tests and gets 'Permission denied (publickey,gssapi-keyex,gssapi-with-mic)'. The user's public key is in ~/.ssh/authorized_keys on the remote server. The local client has the matching private key. Which step should the administrator take to resolve the issue?

Accepted Answer

Check /var/log/auth.log on the remote server to see why the key was rejected.. The error message indicates that the SSH server rejected all offered authentication methods, including publickey. Since the user's public key is in the remote server's authorized_keys file and the client has the matching private key, the most likely cause is a file permission or SELinux/AppArmor issue on the remote server, or a key format mismatch. Checking /var/log/auth.log on the remote server will show the exact reason for the rejection, such as 'bad permissions' or 'key not recognized', allowing targeted troubleshooting.

Answer

Generate a new RSA key pair on the client with ssh-keygen.

Answer

Run 'ssh-add' to add the private key to the SSH agent.

Answer

Restart the sshd service on the client.

Question 6

A company uses Samba to share files from a Linux server to Windows clients. After upgrading Samba from version 4.10 to 4.15, some users report they cannot access shares and receive 'Access denied' errors. The smb.conf has been verified and seems correct. What is the most likely cause?

Accepted Answer

The 'ntlm auth' parameter is set to 'no' in the new version.. Starting with Samba 4.11, the default value of the 'ntlm auth' parameter changed from 'yes' to 'no'. This disables NTLMv1 authentication, which many legacy Windows clients or configurations still rely on. Even though the smb.conf appears correct, the new default silently blocks NTLMv1, causing 'Access denied' errors after the upgrade.

Answer

The firewall is blocking SMB ports.

Answer

The users' passwords are too short.

Answer

The Samba service is not running after upgrade.

Question 7

A system administrator notices that a new iSCSI target is not appearing as a block device after running iscsiadm. The target is known to be online and reachable. What is the most likely cause?

Accepted Answer

The iSCSI service (iscsid) is not running.. The iSCSI initiator requires the `iscsid` daemon to be running in order to process discovery and login requests from `iscsiadm`. Even if the target is online and reachable, without the `iscsid` service, the kernel's iSCSI layer cannot establish a session or create the corresponding block device (e.g., /dev/sdX). This is the most likely cause because the administrator has confirmed network connectivity and target availability, leaving the service state as the primary suspect.

Answer

The iSCSI initiator name is not set.

Answer

The target IQN is not specified correctly.

Answer

The network interface is down.

Question 8

Refer to the exhibit. Which kernel parameter is responsible for reducing the amount of kernel messages displayed on the console?

Accepted Answer

quiet. The `quiet` kernel parameter suppresses most kernel log messages from being printed to the console during boot, reducing console output to only critical or error-level messages. This is controlled by the kernel's console log level, which `quiet` effectively lowers to KERN_WARNING (4) or higher, filtering out informational and debug messages.

Answer

ro

Answer

splash

Answer

BOOT_IMAGE

Question 9

Given the exhibited routing table and rules, what will happen to a packet originating from IP 192.168.10.50 destined to 8.8.8.8?

Accepted Answer

The packet is forwarded via eth1 to 10.0.0.1.. The packet from 192.168.10.50 to 8.8.8.8 is processed using policy routing rules. A rule matches the source and directs the lookup to routing table 100, which contains a route 0.0.0.0/1 via eth1 with next-hop 10.0.0.1. Since 8.8.8.8 falls within the 0.0.0.0/1 prefix (0.0.0.0–127.255.255.255), the kernel selects this route and forwards the packet via eth1 to 10.0.0.1, making option C correct. Option B is incorrect because it omits the next-hop and implies the /1 route is in the main table, which it is not.

Answer

The packet is dropped because no matching route exists.

Answer

The packet is forwarded via eth1 because of the 0.0.0.0/1 route.

Answer

The packet is forwarded via eth0 to the default gateway in the main table.

Question 10

A company's security policy requires that all members of the 'developers' group be able to run the command 'systemctl restart httpd' as root using sudo, without being prompted for a password. Which sudoers entry achieves this?

Accepted Answer

%developers ALL=(root) NOPASSWD: /usr/bin/systemctl restart httpd. It uses the %group syntax to specify the 'developers' group, includes the NOPASSWD: tag to suppress password prompting, and specifies the exact command path and arguments (/usr/bin/systemctl restart httpd) as required by the sudoers policy. This matches the security requirement precisely.

Answer

%developers ALL=(root) /usr/bin/systemctl restart httpd

Answer

developers ALL=(root) NOPASSWD: /usr/bin/systemctl restart httpd

Answer

%developers ALL=(root) NOPASSWD: {/usr/bin/systemctl restart httpd}

Answer

%developers ALL=(0) NOPASSWD: /usr/bin/systemctl restart httpd

Question 11

An administrator wants to compile a new kernel module that is not yet in the tree. What file should be referenced to ensure the module is built with the same configuration as the current kernel?

Accepted Answer

/boot/config-5.10.0-9-amd64. /boot/config-5.10.0-9-amd64 contains the exact kernel configuration used to build the currently running kernel. When compiling a new kernel module, referencing this file (typically via 'make oldconfig' or copying it to the source tree as .config) ensures the module is built with the same set of options, such as enabled features, drivers, and module parameters, preventing incompatibilities.

Answer

/proc/config.gz

Answer

/boot/System.map-5.10.0-9-amd64

Answer

/boot/initrd.img-5.10.0-9-amd64

Question 12

Which of the following is a valid NTP configuration file directive to specify a broadcast client?

Accepted Answer

broadcastclient. The `broadcastclient` directive in an NTP configuration file instructs the NTP daemon to listen for NTP broadcast messages on the local network. This is the standard way to configure a client to synchronize time from a broadcast server without specifying individual server addresses.

Answer

peer

Answer

server

Answer

broadcast

Question 13

A system administrator notices that the default gateway is missing after a reboot. The network configuration uses ifup/ifdown scripts. Which file should be modified to ensure the default gateway is persistent?

Accepted Answer

/etc/network/interfaces. On Debian-based systems using ifup/ifdown scripts, persistent network configuration—including the default gateway—is defined in /etc/network/interfaces. The gateway is set with the 'gateway' directive under the appropriate interface stanza, ensuring it is applied automatically on boot. This file is the central configuration source for the ifupdown suite.

Answer

/etc/resolv.conf

Answer

/etc/network/routes

Answer

/etc/sysconfig/network

Question 14

An administrator wants to restrict access to a Samba share based on client IP addresses. Which parameter in the [share] section of smb.conf should be used?

Accepted Answer

hosts allow. The `hosts allow` parameter in the `[share]` section of `smb.conf` restricts access to the Samba share based on client IP addresses or subnets. It is the correct directive for IP-based access control, allowing the administrator to specify which hosts are permitted to connect. This parameter is evaluated before authentication, blocking unauthorized IPs at the connection level.

Answer

allow hosts

Answer

browseable

Answer

valid users

Question 15

After creating a new partition table on /dev/sda, what command should be run to install GRUB2 to the Master Boot Record?

Accepted Answer

grub-install /dev/sda. After creating a new partition table on /dev/sda, the Master Boot Record (MBR) resides on the disk device itself, not on a partition. The `grub-install /dev/sda` command installs GRUB2's boot code into the MBR (first 440 bytes) and embeds the core image in the post-MBR gap. This makes the disk bootable by the BIOS.

Answer

grub-mkconfig -o /boot/grub/grub.cfg

Answer

update-grub

Answer

grub-install /dev/sda1