LPIC-2 Practice Test 20 — 15 Questions

Question 1

An administrator is configuring netfilter rules to implement a stateful firewall. Which TWO of the following commands are necessary to allow the firewall to correctly forward TCP traffic from internal to external networks (assuming proper default policies)?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

iptables -A FORWARD -m state --state ESTABLISHED -j ACCEPT. A stateful firewall must allow packets belonging to already established connections to pass through the FORWARD chain. The `-m state --state ESTABLISHED` match ensures that any packet that is part of an existing TCP connection (i.e., has seen the three-way handshake) is accepted, which is essential for forwarding return traffic from external networks back to internal hosts.

Answer

iptables -A FORWARD -m state --state NEW -j ACCEPT

Answer

iptables -A FORWARD -j ACCEPT

Answer

iptables -A FORWARD -m state --state NEW -p tcp --dport 80 -j ACCEPT

Question 2

An organization requires that all email traffic from their mail server must be encrypted in transit. Which of the following is the most appropriate solution?

Accepted Answer

Enable STARTTLS on the SMTP server to encrypt connections.. STARTTLS is the standard method for upgrading a plaintext SMTP connection to an encrypted one using TLS, as defined in RFC 3207. It allows the mail server to negotiate encryption on the standard SMTP port (25) or submission port (587), ensuring that email traffic is encrypted in transit without requiring a separate port or protocol. This is the most appropriate solution because it is widely supported, interoperable, and aligns with modern email security best practices.

Answer

Implement IPsec to encrypt all traffic between mail servers.

Answer

Use SMTPS (SMTP over SSL) on port 465.

Answer

Configure the mail server to use SSH tunneling for all SMTP connections.

Question 3

A Linux server with two NICs bonded in mode 1 (active-backup) was working correctly until a switch was replaced. Now, although both interfaces are up, the bond always shows only one active slave, and if that slave fails, traffic does not fail over. The bonding configuration uses miimon=100 and neither arp_interval nor arp_ip_target is set. You run 'cat /proc/net/bonding/bond0' and see that the MII status of both slaves is 'up' but the link failures count is 0 for the backup slave. What is the most likely cause, and which parameter should be adjusted?

Accepted Answer

Configure arp_interval and arp_ip_target to enable ARP monitoring.. Without ARP monitoring (arp_interval and arp_ip_target), the bond relies solely on MII status to detect link failures. MII monitoring only detects physical link loss at the NIC level, not upstream switch failures or misconfigurations. In this scenario, the switch replacement likely caused a layer-2 or layer-3 issue that does not bring the NIC link down, so MII reports 'up' but traffic cannot pass. Enabling ARP monitoring forces the bond to verify reachability of a target IP, triggering failover when ARP replies are lost.

Answer

Change bonding mode to mode 4 (802.3ad) with LACP.

Answer

Use ifenslave to manually reassign the backup slave.

Answer

Decrease miimon to 50 for faster detection.

Question 4

A company runs a critical web server on a custom-built Linux distribution. The server has been stable for months, but after a recent kernel update from version 5.10 to 5.15, the server experiences intermittent crashes. The crashes occur under heavy load and are accompanied by kernel oops messages mentioning a NULL pointer dereference in a network driver. The network driver is a third-party module that was compiled against the old kernel. The system administrator has recompiled the module against the new kernel, but the crashes persist. The server has 64 GB of RAM and uses a bonded network interface with two 10 GbE NICs. The kernel oops trace points to a function in the bonding driver. Which of the following is the most likely cause of the crashes?

Accepted Answer

Check the kernel configuration changes between versions 5.10 and 5.15 that affect the bonding driver.. The crashes persist after recompiling the third-party network driver, and the oops trace points to the bonding driver. This indicates that the issue is likely due to changes in the kernel's internal APIs or data structures between versions 5.10 and 5.15 that affect the bonding driver, not the third-party module. The bonding driver is part of the kernel itself, so it must be compatible with the new kernel version; checking kernel configuration changes (e.g., modifications to `struct net_device`, bonding sysfs interfaces, or locking mechanisms) is the appropriate next step.

Answer

Increase the system memory to reduce memory pressure.

Answer

Update the firmware on the network interface cards.

Answer

Recompile the network driver module with debugging enabled.

Question 5

A company is migrating from a workgroup environment to an Active Directory domain. The Samba server is already configured as a domain member using winbind. The administrator wants to ensure that files created by domain users on the Samba server are owned by the corresponding UNIX user accounts derived from the domain. Which idmap backend and configuration is recommended for this purpose?

Accepted Answer

idmap config * : backend = rid. The `rid` backend (option D) is recommended because it generates UNIX UIDs/GIDs deterministically from the Windows RID (Relative Identifier) portion of the user's SID, ensuring that files created by domain users on the Samba server are consistently owned by the same UNIX user accounts derived from the domain. This backend does not require an RFC 2307 schema or LDAP attributes, making it ideal for simple domain member setups where automatic UID/GID mapping is needed.

Answer

idmap config * : backend = ad

Answer

idmap config * : backend = tdb

Answer

idmap config * : backend = autorid

Question 6

Which command can be used to test the entire name resolution order as defined in nsswitch.conf?

Accepted Answer

getent hosts. The `getent hosts` command queries the system's Name Service Switch (NSS) configured sources in the exact order defined in `/etc/nsswitch.conf`. It uses the `gethostbyname()` or `getaddrinfo()` library calls, which respect the `hosts:` line in nsswitch.conf (e.g., `files dns myhostname`), testing resolution through each source sequentially until a result is found or all sources are exhausted.

Answer

host

Answer

nslookup

Answer

dig

Question 7

An administrator needs to mount an NFSv4 export from server:/exports/data onto /mnt/data on a client. The requirement is to use Kerberos security, a hard mount, and ensure that the NFS server does not squash root's privileges. Which line in /etc/fstab correctly implements these requirements?

Accepted Answer

server:/exports/data /mnt/data nfs4 defaults,sec=krb5,hard 0 0. It specifies NFSv4 with Kerberos security (sec=krb5) and a hard mount, which meets the requirements. The no_root_squash option is not a valid mount option in /etc/fstab for the client side; it is an export option set on the NFS server in /etc/exports. Thus, D correctly omits it, as the client cannot enforce root squashing behavior.

Answer

server:/exports/data /mnt/data nfs4 defaults,sec=none,hard,no_root_squash 0 0

Answer

server:/exports/data /mnt/data nfs4 defaults,sec=krb5,soft 0 0

Answer

server:/exports/data /mnt/data nfs4 defaults,sec=krb5,hard,no_root_squash 0 0

Question 8

An administrator configures AIDE to monitor /etc. After initializing the database, what command updates the database with current file hashes without removing old entries?

Accepted Answer

aide --update. AIDE's --update option performs a check and then updates the database with any new or changed file hashes while preserving existing entries. This is the correct way to refresh the database after legitimate changes to monitored files, as it combines --check and --init in a single operation without losing the baseline.

Answer

aide --init

Answer

aide --compare

Answer

aide --check

Question 9

A system administrator wants to verify the integrity of a downloaded package using a GPG signature. Which command should be used after importing the distributor's public key?

Accepted Answer

gpg --verify package.tar.gz.asc package.tar.gz. The `--verify` option is used to check the authenticity and integrity of a file against a detached GPG signature file. After importing the distributor's public key, running `gpg --verify package.tar.gz.asc package.tar.gz` confirms that the package was signed by the corresponding private key and has not been altered since signing.

Answer

gpg --encrypt package.tar.gz

Answer

gpg --decrypt package.tar.gz.asc

Answer

gpg --sign package.tar.gz

Question 10

A company runs a Postfix mail server that relays mail for internal clients. Users report that emails to a specific external domain 'example.org' are delayed by several hours. The administrator checks the mail logs and sees entries like: 'status=deferred (connect to mx.example.org[203.0.113.10]:25: Connection timed out)'. What is the most likely cause?

Accepted Answer

The remote mail server mx.example.org is blocking connections from the company's mail server IP.. The log entry 'Connection timed out' indicates that the company's Postfix server successfully resolved the MX record for example.org to the IP 203.0.113.10 but could not establish a TCP connection to port 25 on that host. This is consistent with the remote server explicitly blocking inbound connections from the company's IP, often via a firewall rule or access control list, rather than a DNS or rate-limiting issue.

Answer

The company's mail server is not authorized to relay mail for the internal clients, causing a deferral.

Answer

The DNS MX record for example.org is misconfigured, pointing to a non-existent host.

Answer

The remote server is rate limiting connections from the company's mail server.

Question 11

A user needs to run a specific command as root without being prompted for a password. The command is /usr/bin/systemctl restart apache2. Which sudoers rule accomplishes this securely?

Accepted Answer

user ALL=(root) NOPASSWD: /usr/bin/systemctl restart apache2. It uses the NOPASSWD tag before the command specification, allowing the user to execute /usr/bin/systemctl restart apache2 as root without a password prompt. The syntax 'user ALL=(root) NOPASSWD: /usr/bin/systemctl restart apache2' is the proper sudoers format, where the tag applies to the following command list. This grants minimal privilege by restricting the user to only that specific command and arguments.

Answer

user ALL=(root) /usr/bin/systemctl restart apache2

Answer

user ALL=(root) NOPASSWD: ALL

Answer

user ALL=(root) NOPASSWD:: /usr/bin/systemctl restart apache2

Question 12

Which command would add the default gateway 192.168.1.1 to this interface?

Accepted Answer

ip route add default via 192.168.1.1 dev eth0. The `ip route add default via 192.168.1.1 dev eth0` command explicitly specifies both the gateway address and the outgoing interface, which is necessary when multiple interfaces exist or when the kernel needs to resolve the next-hop without ambiguity. The `default` keyword is a shorthand for `0.0.0.0/0` in IPv4, and the `dev eth0` clause ensures the route is bound to the correct interface.

Answer

ip route add 0.0.0.0/0 via 192.168.1.1 dev eth0

Answer

route add default gw 192.168.1.1

Answer

ip route add default via 192.168.1.1

Question 13

An administrator needs to configure a wireless interface wlan0 with WPA2-PSK authentication and a static IP address 192.168.2.50/24. Which tool should be used to configure the wireless settings?

Accepted Answer

wpa_supplicant with a configuration file containing the PSK. WPA2-PSK authentication requires the wpa_supplicant daemon, which handles the 4-way handshake and key derivation. A configuration file with the PSK (pre-shared key) is the standard method to define the network SSID and passphrase, allowing wpa_supplicant to manage the wireless association securely.

Answer

NetworkManager with nmcli

Answer

iwconfig with key s:password

Answer

ifconfig wlan0 up and route add default gw 192.168.2.1

Question 14

Which user can execute any command as any user without any password restriction?

Accepted Answer

root. The root user (UID 0) has unrestricted superuser privileges by default on Linux systems. Unlike regular users, root can execute any command as any user without needing to provide a password, as there is no sudo or su password requirement for the root account itself. This is a fundamental security property of the Unix/Linux permission model.

Answer

alice

Answer

charlie

Answer

bob

Question 15

A Samba share is configured with 'guest ok = yes'. What must also be configured to allow guest access?

Accepted Answer

map to guest = Bad User. When 'guest ok = yes' is set on a Samba share, the server still requires a mechanism to map unauthenticated or failed authentication attempts to the guest account. The 'map to guest = Bad User' directive tells Samba to treat any connection attempt with an invalid username as a guest connection, which is necessary for guest access to function. Without this mapping, clients presenting a non-existent or incorrect username will be rejected rather than being granted guest privileges.

Answer

security = share

Answer

force user = nobody

Answer

guest only = Yes