LPIC-2 Practice Test 2 — 10 Questions

Question 1

The administrator wants to create a RAID 1 array using /dev/sdb1 and /dev/sdc1, then create a filesystem and mount it at /mnt/raid1. Which command sequence should be used first?

Accepted Answer

mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1. The first step in creating a RAID 1 array is to assemble the underlying block devices into a RAID device using mdadm. The command `mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1` initializes the RAID metadata and creates the array at /dev/md0. Only after the array is created can a filesystem be built on it and then mounted.

Answer

mkfs.ext4 /dev/md0

Answer

pvcreate /dev/sdb1 /dev/sdc1

Answer

fdisk /dev/sdb && fdisk /dev/sdc

Question 2

A company runs a critical database server on a Linux system. The server is subject to a strict compliance policy that requires all commands executed by the database administrator (user 'dbadmin') to be logged. Additionally, any attempt to change the system time must be logged regardless of the user. The administrator has configured auditd and added the following rules: -w /usr/bin -p x -k binary_exec, -a always,exit -F arch=b64 -S adjtimex -F key=time_change. However, during a compliance audit, it is discovered that not all commands executed by dbadmin are being logged. Which of the following is the most likely cause?

Accepted Answer

The rule -w /usr/bin -p x only monitors executables in /usr/bin, not commands in other directories or built-in shell commands.. The rule `-w /usr/bin -p x` only monitors execution of binaries located in `/usr/bin`. Commands executed from other directories (e.g., `/usr/local/bin`, `/opt`, or built-in shell commands like `cd` or `alias`) are not captured. Additionally, the rule does not log commands run via absolute paths outside `/usr/bin` or scripts executed by interpreters, leaving gaps in the audit trail for dbadmin's activities.

Answer

The auditd logs are being overwritten because the audit log file size is too small.

Answer

The auditd service is not running because the kernel was not compiled with audit support.

Answer

The adjtimex syscall rule is incorrect and prevents other rules from being processed.

Question 3

An administrator creates a new XFS filesystem on /dev/vg/data and needs to mount it at /data with noatime and a stripe unit of 1 MiB. Which /etc/fstab entry is correct?

Accepted Answer

/dev/vg/data /data xfs defaults,noatime,sunit=2048 0 0. The `sunit` mount option specifies the stripe unit in 512-byte blocks. A stripe unit of 1 MiB equals 2048 blocks (1 MiB = 1024 KiB = 2048 * 512 bytes). The `noatime` option disables access time updates. This entry correctly mounts the XFS filesystem at /data with the required parameters.

Answer

/dev/vg/data /data xfs defaults,noatime,swidth=2048 0 0

Answer

/dev/vg/data /data xfs defaults,noatime,allocsize=1m 0 0

Answer

/dev/vg/data /data xfs defaults,noatime,sunit=1024 0 0

Question 4

A company has a Linux client running Ubuntu 20.04 that is used by multiple developers. The client has two network interfaces: eth0 (connected to the corporate network with DHCP) and eth1 (connected to a test lab with static IP 192.168.100.10/24). The client needs to access both the internet (via eth0) and the lab network (192.168.100.0/24). The default gateway is 10.0.0.1 on eth0. The lab network has a server at 192.168.100.50 that provides DHCP for the lab devices, but the client's eth1 is statically configured. Recently, the client cannot reach the lab server at 192.168.100.50. The administrator checks the routing table and sees:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.0.1        0.0.0.0         UG    100    0        0 eth0
10.0.0.0        0.0.0.0         255.255.255.0   U     100    0        0 eth0
192.168.100.0   0.0.0.0         255.255.255.0   U     100    0        0 eth1

The administrator can ping 192.168.100.50 from the client. However, the lab server cannot ping the client. What is the most likely cause?

Accepted Answer

The client's firewall is blocking incoming ICMP echo requests.. The client can ping the lab server (192.168.100.50), proving that outbound traffic from the client to the lab network works correctly. However, the lab server cannot ping the client, which indicates that either the return traffic is blocked or the client does not have a route back to the server. Since the client's routing table shows a direct route to 192.168.100.0/24 via eth1, the issue is not a missing route; instead, the most likely cause is that the client's firewall (e.g., iptables or ufw) is blocking incoming ICMP Echo Requests (ping) on eth1, while allowing outbound traffic.

Answer

The lab server's default gateway is misconfigured.

Answer

The client has no route to the lab subnet.

Answer

The client's default gateway is misconfigured.

Question 5

Which two of the following are valid methods to pass kernel parameters during the boot process? (Choose two.)

Accepted Answer

Edit /boot/grub/grub.cfg and append parameters to the 'linux' line. Editing /boot/grub/grub.cfg to append parameters to the 'linux' line directly modifies the kernel command line that GRUB 2 passes to the Linux kernel at boot. This is a standard method for permanently adding kernel parameters like 'quiet' or 'nomodeset'.

Answer

Use the 'initrd' command in GRUB

Answer

Write the parameter directly to /proc/cmdline

Answer

Set the parameter in /etc/sysctl.conf

Question 6

Which TWO commands can be used to display the current IP address and netmask of network interfaces on a Linux system?

Accepted Answer

ifconfig. Option B (ifconfig) is correct because the legacy net-tools command ifconfig, when run without arguments, prints each network interface's inet address and netmask (e.g., inet 192.168.1.10 netmask 255.255.255.0). Option C (ip addr show) is correct because the modern iproute2 command ip addr show (equivalently ip a) displays each interface's inet/inet6 addresses with their prefix length, which represents the netmask. Option A (arp -a) only lists the ARP cache mapping IP addresses to MAC addresses, not interface addresses or netmasks. Option D (netstat -i) shows interface statistics and flags but not IP addresses or netmasks. Option E (route -n) displays the kernel routing table in numeric form, not the addresses and netmasks assigned to interfaces.

Answer

arp -a

Answer

netstat -i

Answer

route -n

Question 7

A filesystem created with mkfs.ext4 on /dev/sda1 has a reserved block count of 5%. How can the administrator reduce it to 1% without reformatting?

Accepted Answer

tune2fs -m 1 /dev/sda1. The `-m` option of tune2fs sets the reserved block percentage for the filesystem. Since the question asks to reduce the reserved block count from 5% to 1% without reformatting, `tune2fs -m 1 /dev/sda1` correctly adjusts the reserved blocks percentage to 1% on the existing ext4 filesystem.

Answer

tune2fs -r 1 /dev/sda1

Answer

dumpe2fs -r 1 /dev/sda1

Answer

resize2fs -r 1 /dev/sda1

Question 8

An AppArmor profile for a database server is too restrictive and denies legitimate queries. The administrator wants to learn the required accesses by running the application in complain mode. Which command puts the profile into complain mode?

Accepted Answer

aa-complain /etc/apparmor.d/usr.sbin.mysqld. The `aa-complain` command places an AppArmor profile into complain mode, where policy violations are logged but not blocked. This allows the administrator to run the database server and observe which accesses are denied, then use the logs to update the profile with the required permissions. The correct syntax is `aa-complain /etc/apparmor.d/usr.sbin.mysqld` to target the specific profile file.

Answer

aa-disable /etc/apparmor.d/usr.sbin.mysqld

Answer

aa-enforce /etc/apparmor.d/usr.sbin.mysqld

Answer

aa-log /etc/apparmor.d/usr.sbin.mysqld

Question 9

An administrator wants to ensure a kernel module is loaded automatically at boot for a hardware device. Which file should be modified to add the module name?

Accepted Answer

/etc/modules-load.d/. The `/etc/modules-load.d/` directory contains configuration files that list kernel module names to be loaded automatically at boot by the `systemd-modules-load.service`. This is the standard mechanism in modern Linux distributions using systemd to ensure specific modules are loaded early in the boot process, before udev or other services handle device detection.

Answer

/etc/modprobe.d/blacklist.conf

Answer

/etc/udev/rules.d/

Answer

/proc/sys/kernel/

Question 10

A Samba server is configured as above. Users alice and bob have local system accounts but neither can connect to the share. What is the most likely cause?

Accepted Answer

The users have not been added to the Samba password database.. Samba maintains its own password database separate from the local system accounts. Even though alice and bob have valid local UNIX accounts, they must also be added to the Samba password database using `smbpasswd -a` or `pdbedit -a` before they can authenticate to any Samba share. Without this step, Samba will reject their connection attempts regardless of share permissions or path validity.

Answer

The share path /srv/share does not exist or has incorrect permissions.

Answer

The parameter 'read only = no' is misspelled; it should be 'writable = yes'.

Answer

The valid users list must use group names with '@' prefix, not individual names.