LPIC-2 Practice Exam 2 — 20 Questions

Question 1

A Linux router running multiple routing tables is misconfigured. The administrator wants to add a policy routing rule that sends all traffic from subnet 10.10.0.0/16 to routing table 200. Which command should be used?

Accepted Answer

ip rule add from 10.10.0.0/16 table 200. Option B is correct because the `ip rule` command is used to add policy routing rules in Linux, which direct packets to specific routing tables based on criteria like source address. The `from` parameter specifies the source subnet (10.10.0.0/16), and `table 200` directs matching traffic to routing table 200, enabling policy-based routing beyond the default table.

Answer

route add -net 10.10.0.0/16 table 200

Answer

iptables -A FORWARD -s 10.10.0.0/16 -j table 200

Answer

ip route add 10.10.0.0/16 dev eth0 table 200

Question 2

A company uses BIND9 as the authoritative name server for its public zone example.com. External users report that they cannot resolve the MX record for the domain, but internal users can. What is the most likely cause?

Accepted Answer

The allow-query ACL restricts queries to the internal network.. Option B is correct because the allow-query ACL in BIND9 restricts which source IP addresses are permitted to send queries to the server. If it is set to allow only the internal network (e.g., 192.168.0.0/16), external users' queries are rejected, causing resolution failures for MX records and all other records. Internal users succeed because their IPs match the ACL, while external users receive a REFUSED response or no answer.

Answer

The zone file lacks an MX record.

Answer

The server is behind a firewall that blocks UDP port 53.

Answer

The recursion is set to no.

Question 3

An administrator is troubleshooting network isolation in a Linux container environment. The container should have its own network stack, but it appears to be using the host's interfaces. Which command correctly runs a command inside a network namespace named 'ns1' to verify its network configuration?

Accepted Answer

ip netns exec ns1 ip addr show. Option B is correct because the `ip netns exec` command is specifically designed to execute a command within a given network namespace. In this scenario, `ip netns exec ns1 ip addr show` runs the `ip addr show` command inside the network namespace named 'ns1', allowing the administrator to verify that the container has its own network stack and is not using the host's interfaces.

Answer

nsenter -t 1234 -n ip addr show

Answer

unshare -n ip addr show

Answer

ip netns add ns1

Question 4

Which Apache module is used to rewrite URLs based on rules?

Accepted Answer

mod_rewrite. mod_rewrite is the correct Apache module for rewriting URLs based on rules. It uses a regular expression engine to match incoming request URIs against patterns defined in .htaccess or server configuration files, then transforms them according to specified substitution rules. This module is essential for creating clean URLs, redirecting traffic, and implementing URL-based access control.

Answer

mod_proxy

Answer

mod_alias

Answer

mod_redirect

Question 5

A company has two BIND DNS servers, a primary and a secondary. The secondary fails to receive zone updates. Which command can be used to check if the primary allows zone transfers to the secondary?

Accepted Answer

dig axfr example.com @primary. The `dig axfr example.com @primary` command performs an AXFR (full zone transfer) request against the primary DNS server. If the primary allows zone transfers to the secondary, the command will return the entire zone file; if it is denied, it will return a 'Transfer failed' or 'refused' message. This directly tests the allow-transfer ACL configuration on the primary, which is the most common cause of secondary servers failing to receive zone updates.

Answer

host -l example.com primary

Answer

dig -x 192.0.2.1 @primary

Answer

nslookup -type=any example.com primary

Question 6

Which TWO commands can be used to list all currently listening TCP ports and the associated processes?

Accepted Answer

ss -tlnp. Option B (ss -tlnp) is correct because the ss command with -t (TCP), -l (listening), -n (numeric), and -p (process) shows all listening TCP ports and their associated processes. Option C (netstat -tlnp) is correct because netstat with the same flags provides equivalent output, though ss is the modern replacement on many distributions.

Answer

lsof -i TCP -s TCP:LISTEN

Answer

fuser -v 80/tcp

Answer

nmap -sT localhost

Question 7

During boot, the kernel panics with 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

The kernel lacks the driver for the storage controller.. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot find a driver for the block device containing the root filesystem. This most commonly occurs when the kernel lacks the necessary storage controller driver (e.g., for SATA, NVMe, or SCSI controllers), often because the driver was built as a module and not included in the initramfs or compiled into the kernel.

Answer

The kernel image is corrupted.

Answer

The init process is missing.

Answer

The root filesystem is formatted with an unsupported filesystem.

Question 8

An organization runs a Samba server in standalone mode. They want to allow anonymous (guest) access to a public share. Which configuration option enables guest access for a share?

Accepted Answer

map to guest = Bad User and guest ok = yes. Option D is correct because Samba requires both `map to guest = Bad User` (which tells Samba to treat any connection attempt with an invalid username as a guest connection) and `guest ok = yes` (which explicitly permits guest access to the share). Without both, anonymous access will be denied. The `map to guest` directive can also be set to `Bad Password` or `Never`, but `Bad User` is the typical choice for public shares.

Answer

anonymous = yes

Answer

security = share

Answer

guest account = nobody

Question 9

A Samba share is configured with 'writable = no'. What does this mean?

Accepted Answer

The share is read-only.. When a Samba share is configured with 'writable = no', it explicitly denies write access to the share at the Samba level, regardless of underlying Unix file permissions. This directive overrides any other settings (like 'write list') and makes the share read-only for all clients connecting via SMB/CIFS protocols. The correct interpretation is that the share is read-only, which matches option A.

Answer

Users can read and write.

Answer

Only root can write.

Answer

Write access depends on Unix permissions.

Question 10

An administrator needs to create a Samba share that allows all users in the 'staff' group read/write access, but denies access to everyone else. Which configuration achieves this?

Accepted Answer

[share]
   path = /data
   valid users = @staff
   read only = no. Option B is correct because it uses `valid users = @staff` to restrict access exclusively to members of the 'staff' group, and `read only = no` grants read/write permissions to those valid users. The `@` prefix in Samba denotes a group, ensuring only group members can connect, while `read only = no` overrides the default read-only behavior to allow writes.

Answer

[share]
   path = /data
   read list = staff
   read only = yes

Answer

[share]
   path = /data
   valid users = staff
   read only = yes

Answer

[share]
   path = /data
   write list = @staff
   browseable = yes

Question 11

A Samba server experiences slow file transfers for large files. The administrator suspects oplock issues. Which set of parameters should be adjusted to disable opportunistic locking?

Accepted Answer

oplocks = no and level2 oplocks = no. Option D is correct because disabling opportunistic locking (oplocks) in Samba requires setting both 'oplocks = no' and 'level2 oplocks = no'. The 'oplocks = no' directive disables exclusive oplocks, but Samba's default behavior still allows level2 oplocks (read-only caching). To fully disable all forms of oplock caching, both parameters must be set to 'no', preventing client-side caching that can cause conflicts and slow transfers for large files.

Answer

oplocks = false alone is sufficient

Answer

strict locking = yes

Answer

kernel oplocks = no

Question 12

A Samba share is configured with 'guest ok = yes'. What must also be configured to allow guest access?

Accepted Answer

map to guest = Bad User. When 'guest ok = yes' is set on a Samba share, the server still requires a mechanism to map unauthenticated or failed authentication attempts to the guest account. The 'map to guest = Bad User' directive tells Samba to treat any connection attempt with an invalid username as a guest connection, which is necessary for guest access to function. Without this mapping, clients presenting a non-existent or incorrect username will be rejected rather than being granted guest privileges.

Answer

security = share

Answer

force user = nobody

Answer

guest only = Yes

Question 13

A Samba server is configured to authenticate users against an Active Directory domain using winbind. After joining the domain, some users report that they cannot access shares, while others can. The administrator runs 'wbinfo -u' and sees a list of domain users. However, 'getent passwd' does not show domain users. Which configuration parameter is most likely missing or misconfigured in /etc/samba/smb.conf?

Accepted Answer

winbind enum users = yes. The `wbinfo -u` command lists domain users because it queries the winbind daemon directly, which has successfully joined the AD domain. However, `getent passwd` does not show domain users because the Name Service Switch (NSS) module for winbind is not configured to enumerate users. The parameter `winbind enum users = yes` in smb.conf tells winbind to provide user enumeration to NSS, allowing commands like `getent passwd` to return domain users. Without this, the NSS winbind module will not list domain users, even though authentication may work for known users.

Answer

winbind use default domain = yes

Answer

winbind nested groups = yes

Answer

idmap config * : backend = tdb

Question 14

A Samba server is experiencing slow authentication for domain users. The logs show repeated winbind connections to the domain controllers. The administrator suspects that winbind is not caching credentials properly. Which parameter should be checked or increased to improve caching?

Accepted Answer

winbind cache time. The `winbind cache time` parameter controls how long winbindd caches user and group information retrieved from domain controllers. Increasing this value reduces the frequency of authentication requests to the DCs, improving performance. The default is 300 seconds; a higher value (e.g., 900 or 1800) can significantly reduce repeated connections.

Answer

winbind rpc only

Answer

winbind offline logon

Answer

winbind request timeout

Question 15

A company is migrating from a workgroup environment to an Active Directory domain. The Samba server is already configured as a domain member using winbind. The administrator wants to ensure that files created by domain users on the Samba server are owned by the corresponding UNIX user accounts derived from the domain. Which idmap backend and configuration is recommended for this purpose?

Accepted Answer

idmap config * : backend = rid. Option D is correct because the 'rid' backend uses the RID of domain users to generate consistent UNIX IDs without a mapping database, which is simple and common. Option A is wrong because 'tdb' is for local mapping, not consistent across machines. Option B is wrong because 'ad' requires RFC2307 schema in AD. Option C is wrong because 'autorid' is for multiple domains but may not provide consistent IDs.

Answer

idmap config * : backend = ad

Answer

idmap config * : backend = tdb

Answer

idmap config * : backend = autorid

Question 16

A server with multiple network cards needs a specific kernel module loaded before network configuration. Where should loading be configured for early boot?

Accepted Answer

/etc/modules-load.d/. Option D is correct because systemd-based systems use /etc/modules-load.d/ to specify kernel modules that must be loaded early in the boot process, before network configuration. Files in this directory are processed by systemd-modules-load.service, which runs before network services, ensuring the module is available when interfaces are brought up.

Answer

/boot/grub/grub.cfg

Answer

/etc/modprobe.d/

Answer

/etc/sysconfig/modules/

Question 17

Which three of the following are required steps to compile and install a custom Linux kernel from source? (Choose three.)

Accepted Answer

Run 'make modules_install' to install compiled modules. Option A is correct because after building kernel modules with 'make', you must run 'make modules_install' to copy the compiled modules into the appropriate directory under /lib/modules/$(uname -r)/, making them available for the kernel to load. This step is essential for any kernel that uses loadable modules, as it populates the module tree with the correct .ko files.

Answer

Run 'update-grub' to regenerate GRUB configuration

Answer

Run 'depmod -a' to generate module dependencies

Question 18

A user reports that an external USB hard drive is not detected when plugged in. The system uses a standard kernel with USB support. What is the most likely reason?

Accepted Answer

The usb_storage module is blacklisted.. Option B is correct because the blacklist.conf file prevents the usb_storage module from loading, which is required for USB mass storage devices. The module is installed but not loaded due to blacklisting.

Answer

The USB driver is not installed.

Answer

The external drive is incompatible.

Answer

The kernel lacks USB support.

Question 19

Refer to the exhibit. Which kernel parameter is responsible for reducing the amount of kernel messages displayed on the console?

Accepted Answer

quiet. The `quiet` kernel parameter suppresses most kernel log messages from being printed to the console during boot, reducing console output to only critical or error-level messages. This is controlled by the kernel's console log level, which `quiet` effectively lowers to KERN_WARNING (4) or higher, filtering out informational and debug messages.

Answer

ro

Answer

splash

Answer

BOOT_IMAGE

Question 20

Which THREE kernel boot parameters can be added to the GRUB command line to enable verbose debug output during boot? (Choose three.)

Accepted Answer

debug. The `debug` kernel boot parameter enables verbose debug output from the kernel during boot, printing extensive diagnostic messages. It is a valid parameter that can be added to the GRUB command line to increase verbosity for troubleshooting.

Answer

verbose

Answer

quiet