LPIC-2 Practice Test 20 — 15 Questions

Question 1

After adding a new network interface, the system assigns it the name 'enp0s3' instead of 'eth0'. Which of the following best describes the reason for this change?

Accepted Answer

The system uses the new predictable network interface naming scheme.. The system uses the predictable network interface naming scheme (also known as Consistent Network Device Naming), introduced in systemd/udev. This scheme assigns names like 'enp0s3' based on the physical location of the device (e.g., 'en' for Ethernet, 'p0' for PCI bus 0, 's3' for slot 3), replacing the traditional 'eth0' naming that could change unpredictably across reboots or hardware additions.

Answer

The kernel assigns names randomly to avoid conflicts.

Answer

The network card is faulty, causing the kernel to rename it.

Answer

The interface is a virtual device, so it gets a non-standard name.

Question 2

Which TWO tools are commonly used for traffic shaping and QoS on Linux? (Choose two.)

Accepted Answer

wondershaper. Wondershaper is a user-friendly shell script that wraps the `tc` command to simplify traffic shaping by limiting bandwidth on a network interface. It uses the Linux kernel's QoS capabilities, specifically the HTB (Hierarchical Token Bucket) queuing discipline, to prioritize and throttle traffic. This makes it a common tool for basic traffic shaping tasks on Linux.

Answer

ethtool

Answer

iptables

Answer

route

Question 3

An Apache administrator is troubleshooting a slow website. Which THREE modules could be causing performance issues if misconfigured?

Accepted Answer

mod_proxy. mod_proxy (A) is correct because a misconfigured reverse or forward proxy can introduce latency, connection-pool exhaustion, or proxy loops that severely degrade website performance. mod_ssl (B) is correct because SSL/TLS handshakes are CPU-intensive, and poor configuration such as weak ciphers, no session caching (SSLSessionCache), or no session tickets forces repeated full handshakes that slow every HTTPS request. mod_rewrite (E) is correct because complex or poorly ordered RewriteRule/RewriteCond directives are evaluated on every request and can cause excessive regex processing or unintended internal redirects that multiply request handling. mod_status (C) only exposes server status/metrics and does not itself process request content, so it is not a typical performance bottleneck. mod_include (D) handles server-side includes and, while it adds some parsing overhead, is not among the modules most commonly implicated in the severe performance problems described here.

Answer

mod_status

Answer

mod_include

Question 4

Refer to the exhibit. A DNS query for 'ftp.example.com' returns NXDOMAIN. What configuration change would best resolve this?

Accepted Answer

Add an A record for ftp pointing to an IP address.. An NXDOMAIN response means the queried domain name does not exist in the zone. To resolve 'ftp.example.com', a DNS record must be created that maps the name to an IP address. Option D adds an A record, which directly provides the IPv4 address for the host, making the query succeed.

Answer

Add a CNAME record for ftp pointing to www.example.com.

Answer

Increase the serial number in the SOA record.

Answer

Ensure recursion is enabled on the server.

Question 5

Which file on a Linux client determines the order in which different name resolution methods (e.g., hosts file, DNS, LDAP) are consulted?

Accepted Answer

/etc/nsswitch.conf. /etc/nsswitch.conf (Name Service Switch) controls the order and sources for system databases like 'hosts', 'passwd', and 'group'. For hostname resolution, the 'hosts' line specifies the lookup order (e.g., 'files dns ldap'), meaning the system checks /etc/hosts first, then DNS, then LDAP. This file is the central configuration for name resolution order on Linux systems.

Answer

/etc/host.conf

Answer

/etc/resolv.conf

Answer

/etc/named.conf

Question 6

A Samba server provides printer sharing using CUPS. Which three global parameters are essential for CUPS integration? (Select THREE)

Accepted Answer

printing = cups. The `printing = cups` parameter explicitly tells Samba to use CUPS as its printing subsystem, enabling communication between Samba and CUPS via the CUPS API. Option C is correct because `printcap name = cups` tells Samba to retrieve the printer list from CUPS, which is necessary for automatic printer discovery. Option D is correct because `load printers = yes` instructs Samba to populate the printer list from the printcap file (or CUPS), making printers available to clients. Together, these three parameters are essential for seamless CUPS integration.

Answer

cups server = localhost

Answer

cups options = "raw"

Question 7

An administrator notices that an NFS mount on a client becomes unresponsive when the NFS server goes offline. The admin wants the mount to return an error to the application after a short timeout instead of hanging indefinitely. Which mount option should be added to the fstab entry?

Accepted Answer

soft. The `soft` mount option causes the NFS client to return an error to the application after a short timeout (typically 60 seconds by default) if the NFS server becomes unresponsive, rather than hanging indefinitely. This is the correct choice because the administrator specifically wants the mount to return an error after a short timeout instead of hanging.

Answer

intr

Answer

bg

Answer

hard

Question 8

Which TWO of the following are valid methods to join a Samba server to an Active Directory domain using Samba 4?

Accepted Answer

`net ads join`. Option C, `net ads join`, is correct because the `net` utility's `ads` subcommand performs a Kerberos-based join of a Samba member server to an Active Directory domain, creating the machine account and keytab. Option D, `samba-tool domain join`, is correct because Samba 4's `samba-tool` provides the `domain join` subcommand to join a host to an AD domain (e.g., as a member server or DC), handling the machine account and secrets. Option A, `smbpasswd -j`, is not a valid AD join method; `smbpasswd` manages Samba passwords and its `-j` option relates to joining a domain in older NT4-style contexts, not AD. Option B, `winbindd -j`, is invalid because `winbindd` is the Winbind daemon and has no `-j` join option. Option E, `net rpc join`, while a real command, performs an NT4-style RPC join rather than an Active Directory join, so it is not the correct AD method here.

Answer

`smbpasswd -j`

Answer

`winbindd -j`

Answer

`net rpc join`

Question 9

A security analyst notices that an /etc/pam.d/common-auth file contains the line 'auth required pam_tally2.so deny=5'. What is the effect?

Accepted Answer

Account lockout after 5 failed login attempts. The `pam_tally2.so` module tracks login attempts and, when used with `deny=5`, locks the account after five consecutive failed authentication attempts. The `required` control ensures that if the tally threshold is exceeded, authentication fails immediately, preventing further access until the count is reset by an administrator or via `pam_tally2` reset.

Answer

Log failed attempts only

Answer

Password expiration after 5 days

Answer

Maximum 5 concurrent sessions

Question 10

A Linux client is configured with the following in /etc/nslcd.conf: 'uri ldap://10.0.0.1/', 'base dc=example,dc=com'. Which command can be used to test connectivity to the LDAP server and verify the base DN?

Accepted Answer

ldapsearch -x -H ldap://10.0.0.1 -b dc=example,dc=com. The `ldapsearch` command with `-x` (simple authentication), `-H ldap://10.0.0.1` (specifying the LDAP URI), and `-b dc=example,dc=com` (setting the search base DN) directly performs an anonymous LDAP search against the server. If the server is reachable and the base DN exists, it returns entries, confirming both connectivity and the validity of the base DN. This matches the configuration in `/etc/nslcd.conf` and is the standard tool for testing LDAP server responses.

Answer

authconfig --test

Answer

getent passwd

Answer

nslcd -d

Question 11

Which TWO Samba security modes are considered insecure and should be avoided? (Choose two.)

Accepted Answer

share. Options A (share) and B (server) are the two insecure Samba security modes that should be avoided. In share mode, Samba performs no authentication at all — each client is mapped to a single guest or specified user, so anyone with network access can read/write shares without credentials, which is why it is deprecated and dangerous. In server mode, Samba delegates authentication to a separate SMB server (typically a Windows server) by passing the username and plaintext password to that remote host; this exposes credentials on the wire and relies on an external, often untrusted, authentication source, making it insecure. By contrast, C (domain) makes Samba a domain member authenticating against a domain controller, D (user) is the default mode where Samba itself validates credentials against its local smbpasswd/tdbsam database, and E (ads) makes Samba an Active Directory domain member using Kerberos — all three are the recommended, secure modes.

Answer

domain

Answer

user

Answer

ads

Question 12

An administrator observes that only one path is shown as active for mpathb. What is the most likely cause?

Accepted Answer

The blacklist rule excludes the other path.. When only one path is active for a multipath device (mpathb), the most likely cause is that the other path is being excluded by a blacklist rule in the multipath configuration. The blacklist can filter out devices based on WWID, device name, or vendor/product, preventing them from being aggregated into the multipath map. This results in the path being visible to the system but not used by multipathd.

Answer

The find_multipaths setting is incorrect.

Answer

The SCSI devices are not properly connected.

Answer

The multipathd service is not running.

Question 13

In a PAM configuration file, which control flag is used for modules that are not required but can provide additional functionality?

Accepted Answer

optional. In PAM (Pluggable Authentication Modules) configuration files, the 'optional' control flag indicates that the module's success or failure is not critical to the overall authentication result. It is used for modules that provide additional functionality, such as logging or session recording, without affecting whether access is granted or denied. This allows administrators to add supplementary checks without breaking existing authentication flows.

Answer

required

Answer

sufficient

Answer

requisite

Question 14

Refer to the exhibit. A user cannot log in via SSH even though the password is correct. What is the most likely issue?

Accepted Answer

The /etc/nologin file exists, preventing non-root logins.. The /etc/nologin file, when present, prevents all non-root users from logging into the system via any authentication method, including SSH. This is a common administrative mechanism to block user access during maintenance or security incidents. Since the password is correct but login fails, the existence of /etc/nologin is the most likely cause, as it overrides successful PAM authentication for non-root users.

Answer

The password module is not configured correctly.

Answer

pam_unix.so nullok allows blank passwords, causing authentication to fail.

Answer

pam_securetty.so restricts root login via SSH, but the user is not root.

Question 15

An administrator configures iptables on a Linux firewall with the following rules: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT; -A INPUT -p tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT; -A INPUT -j DROP. Users report that SSH connections are being dropped. What is the most likely cause?

Accepted Answer

The SSH rule should have -m state --state NEW to allow new connections.. The most likely cause is that the SSH rule only matches packets that are already part of an established or related connection. New SSH connections start with a SYN packet that is in the NEW state, so they are not matched by the second rule. They fall through to the final DROP rule and are dropped. Adding `-m state --state NEW` (or `-m state --state NEW,ESTABLISHED,RELATED`) to the SSH rule would allow new connections. Option A is incorrect because the default INPUT policy is not relevant when explicit DROP exists; B confuses source and destination ports; D is wrong because reordering does not change the state matching logic.

Answer

The default INPUT policy is DROP, so the last rule is redundant but harmless.

Answer

The rule for SSH uses --dport 22, but the source port is randomized; it should use --sport 22.

Answer

The established/related rule should come after the SSH rule.