LPIC-2 Practice Test 19 — 15 Questions

Question 1

Which THREE of the following tools can be used to implement file integrity checking on a Linux system?

Accepted Answer

AIDE. AIDE (Advanced Intrusion Detection Environment) is a file integrity checking tool that creates a database of file hashes and attributes (e.g., permissions, timestamps) from a baseline scan. It then periodically compares the current state of the filesystem against this database to detect unauthorized modifications, making it a correct choice for implementing file integrity checking on a Linux system.

Answer

Logwatch

Answer

Nmap

Question 2

A company has a Linux client running Ubuntu 20.04 that is used by multiple developers. The client has two network interfaces: eth0 (connected to the corporate network with DHCP) and eth1 (connected to a test lab with static IP 192.168.100.10/24). The client needs to access both the internet (via eth0) and the lab network (192.168.100.0/24). The default gateway is 10.0.0.1 on eth0. The lab network has a server at 192.168.100.50 that provides DHCP for the lab devices, but the client's eth1 is statically configured. Recently, the client cannot reach the lab server at 192.168.100.50. The administrator checks the routing table and sees:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.0.1        0.0.0.0         UG    100    0        0 eth0
10.0.0.0        0.0.0.0         255.255.255.0   U     100    0        0 eth0
192.168.100.0   0.0.0.0         255.255.255.0   U     100    0        0 eth1

The administrator can ping 192.168.100.50 from the client. However, the lab server cannot ping the client. What is the most likely cause?

Accepted Answer

The client's firewall is blocking incoming ICMP echo requests.. The client can ping the lab server (192.168.100.50), proving that outbound traffic from the client to the lab network works correctly. However, the lab server cannot ping the client, which indicates that either the return traffic is blocked or the client does not have a route back to the server. Since the client's routing table shows a direct route to 192.168.100.0/24 via eth1, the issue is not a missing route; instead, the most likely cause is that the client's firewall (e.g., iptables or ufw) is blocking incoming ICMP Echo Requests (ping) on eth1, while allowing outbound traffic.

Answer

The lab server's default gateway is misconfigured.

Answer

The client has no route to the lab subnet.

Answer

The client's default gateway is misconfigured.

Question 3

Which TWO of the following are recommended best practices for securing a Linux server that is publicly accessible?

Accepted Answer

Use a firewall to restrict access to only necessary ports.. A firewall (e.g., iptables, nftables, or ufw) restricts inbound traffic to only necessary ports (e.g., 22/TCP for SSH, 80/TCP for HTTP, 443/TCP for HTTPS), reducing the attack surface by blocking unused services. This is a fundamental defense-in-depth practice for publicly accessible servers. Option E is correct because disabling direct root login via SSH (by setting PermitRootLogin no in /etc/ssh/sshd_config) forces users to authenticate with a regular account and then escalate privileges (e.g., via su or sudo), which adds an additional layer of security by preventing brute-force attacks directly against the root account. Options A, B, and D are incorrect: running services with root privileges (A) increases the risk of privilege escalation if a service is compromised; setting simple passwords (B) weakens authentication; and enabling NFS exports (D) on a public server exposes filesystems without adequate encryption or access control, which is a severe security risk.

Answer

Run all services with root privileges.

Answer

Set all user passwords to simple, memorable ones.

Answer

Enable NFS exports for file sharing.

Question 4

A system administrator needs to ensure that all users must change their passwords every 90 days and that passwords must be at least 12 characters long. The administrator modifies /etc/login.defs and /etc/pam.d/common-password. Which additional step is required to enforce these settings for existing users?

Accepted Answer

Run 'chage -M 90' for each existing user. Modifying /etc/login.defs sets default password aging parameters for new users, and /etc/pam.d/common-password enforces password length via pam_pwquality. However, these changes do not retroactively apply to existing users. The 'chage -M 90' command modifies the /etc/shadow file directly for each user, setting their maximum password age to 90 days. Option B ('passwd -x 90') is incorrect because it is an incomplete command—'passwd -x' requires a username argument (e.g., 'passwd -x 90 username') and is not the standard tool for bulk policy enforcement. The 'pwconv' command (Option C) synchronizes passwords between /etc/passwd and /etc/shadow, not password aging. Option D ('pwunconv' then 'pwconv') reverts to non-shadow then back to shadow, which would remove existing password ages. Therefore, the correct additional step is to run 'chage -M 90' for each existing user.

Answer

Run 'passwd -x 90' for each existing user

Answer

Run 'pwconv' to synchronize password aging

Answer

Run 'pwunconv' then 'pwconv' to update shadow file

Question 5

Which TWO of the following commands are used to load a kernel module manually at runtime? (Choose two.)

Accepted Answer

modprobe. Both `modprobe` and `insmod` are standard Linux commands for manually loading kernel modules at runtime. `modprobe` is preferred because it automatically resolves and loads module dependencies, while `insmod` inserts a single module file directly without dependency resolution.

Answer

loadmod

Answer

depmod

Answer

modload

Question 6

An administrator wants to allow SSH access from the internal network (192.168.1.0/24) only, using nftables. Which rule should be added to the filter table input chain?

Accepted Answer

iif lo accept; tcp dport 22 ip saddr 192.168.1.0/24 accept. It consists of two separate nftables rules separated by a semicolon. The first rule accepts all loopback traffic, which is necessary to prevent breaking local services. The second rule matches TCP destination port 22 and source IP address 192.168.1.0/24, accepting SSH traffic only from the specified subnet. Any SSH traffic from other sources is implicitly dropped by the default policy of the input chain (typically drop). This syntax is valid in nftables, where semicolons are used to separate multiple rules in a single line.

Answer

tcp dport 22 accept #from 192.168.1.0/24

Answer

tcp dport 22 accept; ip saddr 192.168.1.0/22 accept

Answer

tcp dport 22 ip saddr != 192.168.1.0/24 drop

Question 7

A company wants to use Samba to share files with Windows clients. Which service must be enabled in Samba to support Windows Active Directory domain membership?

Accepted Answer

winbind. Winbind (winbindd) is the Samba service that integrates with Windows Active Directory by resolving user and group information from the domain controller. It uses the Microsoft Active Directory authentication protocol (Kerberos) and LDAP to map Windows domain users to local Unix accounts, enabling domain membership and single sign-on.

Answer

nmbd

Answer

smbd

Answer

swat

Question 8

An administrator sets up a Samba server with 'security = user'. Users are stored in the local smbpasswd file. After changing a user's Unix password, the user cannot access Samba shares. What should the administrator do?

Accepted Answer

Run 'smbpasswd username' to set the SMB password.. When Samba is configured with 'security = user', each user must have a separate SMB password stored in the smbpasswd file (or the tdbsam backend). Changing the Unix password does not automatically update the SMB password. Running 'smbpasswd username' sets the SMB password for that user, allowing them to authenticate to Samba shares.

Answer

Add the user to the 'valid users' list.

Answer

Restart the smbd service.

Answer

Run 'pdbedit -u username' to modify the password.

Question 9

After modifying /etc/samba/smb.conf, which command should be used to verify the syntax before restarting the Samba service?

Accepted Answer

testparm. The `testparm` command is specifically designed to parse and validate the syntax of the Samba configuration file `/etc/samba/smb.conf`. It checks for errors such as misspelled parameters, invalid values, or structural issues without requiring the Samba services to be running. This makes it the correct tool to verify syntax before restarting Samba.

Answer

nmblookup

Answer

smbclient

Answer

smbstatus

Question 10

Which TWO configuration files are commonly used to specify DNS resolver settings on a Linux system? (Select TWO.)

Accepted Answer

/etc/systemd/resolved.conf. /etc/systemd/resolved.conf is the configuration file for systemd-resolved, a service that manages DNS resolution on modern Linux systems. Option C is correct because /etc/resolv.conf is the traditional configuration file for specifying DNS resolver settings, including nameserver addresses and search domains, and is still widely used.

Answer

/etc/nsswitch.conf

Answer

/etc/dhcp/dhclient.conf

Answer

/etc/hosts

Question 11

Which TWO commands can be used to list Samba shares on a remote server?

Accepted Answer

findsmb. `findsmb` is a utility that scans the local subnet for Samba/CIFS servers and lists their shares. Option E is correct because `smbclient -L //server` queries the specified remote server for its available shares using the SMB protocol, making it a direct and reliable method for listing shares.

Answer

smbstatus

Answer

nmblookup -S server

Answer

net view \server

Question 12

A Samba server is configured to authenticate users against an Active Directory domain using winbind. After joining the domain, some users report that they cannot access shares, while others can. The administrator runs 'wbinfo -u' and sees a list of domain users. However, 'getent passwd' does not show domain users. Which configuration parameter is most likely missing or misconfigured in /etc/samba/smb.conf?

Accepted Answer

winbind enum users = yes. The `wbinfo -u` command lists domain users because it queries the winbind daemon directly, which has successfully joined the AD domain. However, `getent passwd` does not show domain users because the Name Service Switch (NSS) module for winbind is not configured to enumerate users. The parameter `winbind enum users = yes` in smb.conf tells winbind to provide user enumeration to NSS, allowing commands like `getent passwd` to return domain users. Without this, the NSS winbind module will not list domain users, even though authentication may work for known users.

Answer

winbind use default domain = yes

Answer

winbind nested groups = yes

Answer

idmap config * : backend = tdb

Question 13

Refer to the exhibit. A system administrator wants to replace disk sdb1 in the RAID1 array. After physically removing sdb, which sequence of commands should be used?

Accepted Answer

mdadm /dev/md0 --fail /dev/sdb1; mdadm /dev/md0 --remove /dev/sdb1; mdadm /dev/md0 --add /dev/sdd1; mdadm --manage /dev/md0 --run. After physically removing the failed disk (sdb), the administrator must first mark the device as failed using `--fail`, then remove it with `--remove`, add the new disk (sdd1) with `--add`, and finally run `--run` to ensure the array is activated if it was stopped or degraded. The `--run` flag is necessary because a RAID1 array with a missing device may not automatically start; this command forces the array to become active so the rebuild can begin. Note that the question does not involve filesystem extension; the focus is on the correct sequence for replacing a disk in a RAID array.

Answer

mdadm /dev/md0 --remove /dev/sdb1; mdadm /dev/md0 --add /dev/sdd1

Answer

mdadm /dev/md0 --fail /dev/sdb1; mdadm /dev/md0 --remove /dev/sdb1; mdadm /dev/md0 --add /dev/sdd1

Answer

mdadm /dev/md0 --fail /dev/sdb1; mdadm /dev/md0 --remove /dev/sdb1; mdadm --grow /dev/md0 --add /dev/sdd1; mdadm --manage /dev/md0 --run

Question 14

A Samba server provides printer sharing using CUPS. Which three global parameters are essential for CUPS integration? (Select THREE)

Accepted Answer

printing = cups. The `printing = cups` parameter explicitly tells Samba to use CUPS as its printing subsystem, enabling communication between Samba and CUPS via the CUPS API. Option C is correct because `printcap name = cups` tells Samba to retrieve the printer list from CUPS, which is necessary for automatic printer discovery. Option D is correct because `load printers = yes` instructs Samba to populate the printer list from the printcap file (or CUPS), making printers available to clients. Together, these three parameters are essential for seamless CUPS integration.

Answer

cups server = localhost

Answer

cups options = "raw"

Question 15

A company has a fleet of servers running a custom Linux kernel version 5.4. They have developed several in-house kernel modules that interface with proprietary hardware. Due to a security vulnerability, the company decides to upgrade all servers to kernel version 5.10. After upgrading the kernel on a test server, the custom modules fail to load with the error 'Invalid module format' or 'disagrees about version magic'. The system administrator must resolve this issue for all servers. The modules are closed-source and cannot be modified easily. The administrator considers the following options. Question: What is the most effective course of action to load the custom modules on the new kernel?

Accepted Answer

Use modprobe with the --force-vermagic option to bypass the version check.. The most effective course of action given the constraints. The custom kernel modules are closed-source and cannot be recompiled (Option A is not feasible). The error 'Invalid module format' or 'disagrees about version magic' indicates a version magic mismatch between the module and the kernel. Using `modprobe --force-vermagic` bypasses the version magic check, allowing the module to load. Although this is a risky workaround (may lead to instability or security issues), it is the only viable option without source code access. Option C (patching the binary) is also not feasible without source, and Option D does not address the version magic mismatch.

Answer

Recompile the custom kernel modules against the new kernel headers and install them.

Answer

Update the version magic string in the module binary by patching the file.

Answer

Use systemd-modules-load to load the modules later in the boot process.