LPIC-2 Practice Exam 3 — 20 Questions

Question 1

A system administrator needs to find out which kernel parameters were passed at boot time. Which command displays the kernel boot parameters?

Accepted Answer

cat /proc/cmdline. The correct command is `cat /proc/cmdline` because the Linux kernel stores the boot parameters (also known as the kernel command line) passed by the bootloader (e.g., GRUB) in the virtual file `/proc/cmdline`. Reading this file directly displays the exact parameters used during boot, such as `root=`, `quiet`, or `splash`.

Answer

dmesg

Answer

lsmod

Answer

cat /proc/version

Question 2

A DHCP server is configured to serve multiple subnets but only clients on one subnet receive IP addresses. The server is connected to a router that does not forward DHCP broadcasts. What should be configured to support the other subnets?

Accepted Answer

Set up a DHCP relay agent on the other subnets. The router does not forward DHCP broadcasts, so clients on other subnets cannot reach the DHCP server. A DHCP relay agent (e.g., `dhcrelay` or `ip helper-address`) intercepts broadcast requests on those subnets and forwards them as unicast to the DHCP server, allowing the server to assign addresses from the appropriate subnet pools. This is the standard solution per RFC 1542 when routers do not support BOOTP forwarding.

Answer

Add more subnet declarations to the DHCP server

Answer

Add 'shared-network' declarations

Answer

Configure the router to act as a DHCP server

Question 3

An administrator wants to disable the graphical splash screen during boot. What change should be made in /etc/default/grub?

Accepted Answer

Remove 'splash' from GRUB_CMDLINE_LINUX_DEFAULT. The graphical splash screen during boot is controlled by the 'splash' kernel parameter. Removing 'splash' from GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub disables the splash screen, allowing verbose boot messages to be displayed. This parameter is passed to the kernel via the bootloader, and its absence prevents the plymouth or similar splash service from activating.

Answer

Set GRUB_CMDLINE_LINUX="nosplash"

Answer

Remove 'quiet' from GRUB_CMDLINE_LINUX_DEFAULT

Answer

Set GRUB_TIMEOUT=0

Question 4

A system administrator notices that the SSH service on a Linux server is failing to start. The log shows: 'sshd: error: Could not load host key: /etc/ssh/ssh_host_rsa_key'. What is the most likely cause and solution?

Accepted Answer

The host key file is missing or corrupt. Run 'ssh-keygen -A' to regenerate all missing host keys.. The error message indicates that the SSH daemon cannot load the RSA host key file. Host keys are generated during package installation or manually via ssh-keygen. Option D is correct because running 'ssh-keygen -A' automatically generates all missing host key types (RSA, ECDSA, Ed25519) that are configured for use, resolving the missing or corrupt key issue without manual intervention.

Answer

The sshd_config file has a syntax error. Run 'sshd -t' to check it.

Answer

The SSH service is managed by xinetd and the configuration is missing. Edit /etc/xinetd.d/ssh.

Answer

The /etc/ssh/sshd_config file has incorrect permissions. Change them to 600.

Question 5

An administrator wants to configure Samba to allow only specific users to access a share. Which TWO configuration parameters in smb.conf can be used to restrict access based on usernames?

Accepted Answer

invalid users. Option B, invalid users, is correct because it explicitly denies the listed usernames from accessing the share, so any account named there is blocked regardless of other permissions. Option D, valid users, is correct because it defines an allow-list of usernames (or groups) that are permitted to log in and access the share, restricting access to only those accounts. Together they provide username-based access control in smb.conf. Option A, hosts allow, is incorrect because it filters by client IP address or network, not by username. Option C, write list, is incorrect because it grants write permission to listed users but does not restrict who may access the share. Option E, read list, is incorrect because it grants read-only access to listed users rather than limiting share access by username.

Answer

hosts allow

Answer

write list

Answer

read list

Question 6

A Samba share is configured with 'force user = jane'. A user 'bob' accesses the share. With what effective user ID will file operations be performed?

Accepted Answer

jane. The 'force user' directive in Samba overrides the authenticated user's identity for all file operations on the share. When 'force user = jane' is set, any user accessing the share, including 'bob', will have their effective user ID changed to 'jane' for all file reads, writes, and ownership checks. This ensures that files created or modified on the share are owned by 'jane', regardless of who actually connects.

Answer

root

Answer

nobody

Answer

bob

Question 7

An administrator needs to create a Samba share that allows all users in the 'staff' group read/write access, but denies access to everyone else. Which configuration achieves this?

Accepted Answer

[share]
   path = /data
   valid users = @staff
   read only = no. It uses `valid users = @staff` to restrict access exclusively to members of the 'staff' group, and `read only = no` grants read/write permissions to those valid users. The `@` prefix in Samba denotes a group, ensuring only group members can connect, while `read only = no` overrides the default read-only behavior to allow writes.

Answer

[share]
   path = /data
   read list = staff
   read only = yes

Answer

[share]
   path = /data
   valid users = staff
   read only = yes

Answer

[share]
   path = /data
   write list = @staff
   browseable = yes

Question 8

Which TWO of the following tools are used to capture and analyze network packets on a Linux system?

Accepted Answer

tcpdump. tcpdump is a command-line packet analyzer that captures raw network packets from the wire by placing the network interface into promiscuous mode and using libpcap to read packets. It allows filtering based on protocols, ports, and hosts using BPF (Berkeley Packet Filter) syntax, making it a fundamental tool for network troubleshooting and security analysis.

Answer

iptables

Answer

netstat

Answer

nmap

Question 9

A company wants to host multiple websites on a single Apache server with different domain names. Which approach is most appropriate?

Accepted Answer

Name-based virtual hosting. Name-based virtual hosting allows a single Apache server to serve multiple websites using the same IP address and port by relying on the HTTP Host header sent by the client. This is the most efficient and commonly used method for hosting multiple domains on one server, as it conserves IP addresses and requires minimal configuration via the `<VirtualHost *:80>` directive.

Answer

IP-based virtual hosting

Answer

Port-based virtual hosting

Answer

Using mod_rewrite for each domain

Question 10

A system fails to boot due to a corrupted initramfs. Which TWO methods can be used to recover? (Choose two.)

Accepted Answer

Use the rescue mode of the installation media (e.g., RHEL rescue, Ubuntu recovery). Booting from installation media (e.g., RHEL rescue or Ubuntu recovery) provides a minimal environment that can mount the root filesystem, chroot into it, and then rebuild the initramfs using the system's own kernel and modules. This method does not require a working initramfs on the disk, as the rescue environment supplies its own kernel and initial RAM disk.

Answer

Edit GRUB command line to add 'init=/bin/bash' and then rebuild initramfs from that shell

Answer

Reinstall the kernel package from the GRUB command line using a network boot

Answer

Use kexec to boot a different kernel

Question 11

Which protocol does Samba implement to provide file sharing services to Windows clients?

Accepted Answer

SMB. Samba implements the SMB (Server Message Block) protocol, specifically the CIFS variant, to provide file and printer sharing services to Windows clients. SMB operates over TCP port 445 (direct hosting) or NetBIOS over TCP/IP (ports 137-139), enabling cross-platform file access in mixed Linux/Windows environments.

Answer

HTTP

Answer

AFP

Answer

NFS

Question 12

An administrator notices that clients are unable to obtain IP addresses from the DHCP server. The server logs show 'no free leases' error. What is the most likely cause?

Accepted Answer

The DHCP server's address range is exhausted.. The 'no free leases' error indicates that the DHCP server has exhausted all available IP addresses in its configured pool. This occurs when the address range defined in the dhcpd.conf file has been fully allocated to clients and no leases are available for new requests. The server logs confirm this specific condition, making address exhaustion the most likely cause.

Answer

The DHCP server's subnet declaration does not match the client's network.

Answer

The dhcpd.conf file has invalid syntax.

Answer

The DHCP relay agent is misconfigured.

Question 13

A client mounts the export with 'mount -t nfs server:/data /mnt/data' and root on the client can write files. Which option in /etc/exports allows root to retain its privileges?

Accepted Answer

no_root_squash. (no_root_squash) is correct because it prevents the NFS server from mapping the client's root user (UID 0) to the anonymous 'nobody' user. By default, NFS exports use root_squash, which maps root to an unprivileged user for security. With no_root_squash, the client's root retains UID 0 on the server, allowing write access to files owned by root on the export.

Answer

root_squash

Answer

rw

Answer

async

Question 14

Which TWO are true about the autofs automounter configuration? (Choose two.)

Accepted Answer

The master configuration file is /etc/auto.master.. Option C is correct because /etc/auto.master is indeed the master configuration file for autofs; it lists mount points along with the map files that define the individual mounts, and it is the primary file the automounter reads. Option E is correct because direct maps allow autofs to manage mount points at arbitrary absolute paths that do not fall under a single parent directory such as /net or /home, unlike indirect maps which require a common base directory. Option A is incorrect because autofs mounts are typically unmounted automatically after a timeout period of inactivity, not kept indefinitely. Option B is incorrect because autofs uses its own map files (such as /etc/auto.master and associated maps) rather than /etc/fstab to define automount points. Option D is incorrect because autofs supports many filesystem types beyond NFS, including local filesystems, CIFS/SMB, and others.

Answer

Autofs mounts remain indefinitely once accessed.

Answer

Autofs uses /etc/fstab to define automount points.

Answer

Autofs can only be used with NFS filesystems.

Question 15

Which legacy SMB protocol version should be disabled for security best practices on a modern Samba server?

Accepted Answer

SMB1. SMB1 (also known as CIFS) is a legacy protocol that lacks modern security features such as pre-authentication integrity, encryption, and secure dialect negotiation. It is notoriously vulnerable to attacks like EternalBlue and SMB relay, and disabling it is a fundamental security best practice on any modern Samba server. Samba allows disabling SMB1 via the 'server min protocol = SMB2' or 'ntlm auth = no' directives in smb.conf.

Answer

SMB2_02

Answer

SMB3

Answer

SMB2

Question 16

A company has a Linux server with two network interfaces: eth0 connected to the internal 192.168.1.0/24 network, and eth1 connected to the internet via a public IP of 203.0.113.10. The server runs a web server on port 80 and needs to allow internal clients to access the internet while hiding their private IPs (MASQUERADE). Additionally, external users should be able to reach the web server using the public IP. The administrator has enabled IP forwarding and configured iptables with the following rules:

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

However, internal clients can access the internet, but external users cannot reach the web server. What should the administrator do to fix the issue?

Accepted Answer

Add a DNAT rule in the PREROUTING chain of the nat table to translate destination 203.0.113.10:80 to 192.168.1.100:80.. The current iptables rules perform SNAT/MASQUERADE for outbound traffic and allow forwarding of related/established inbound traffic, but they do not redirect incoming connections destined for the public IP (203.0.113.10:80) to the internal web server (e.g., 192.168.1.100:80). A DNAT rule in the PREROUTING chain of the nat table is required to translate the destination address and port, so that external packets are forwarded to the internal server and the response traffic is handled by the existing MASQUERADE rule.

Answer

Add a FORWARD rule to allow new connections from eth1 to eth0.

Answer

Add a rule in the INPUT chain to accept traffic on port 80.

Answer

Change the MASQUERADE rule to SNAT with the public IP.

Question 17

Refer to the exhibit. What is the effect of this sudoers configuration?

Accepted Answer

Users alice and bob can run apt-get and dpkg on any host as root, requiring a password.. The sudoers configuration specifies that users alice and bob are allowed to run only the commands /usr/bin/apt-get and /usr/bin/dpkg as root on any host (ALL). The absence of the NOPASSWD tag means that a password is required for these commands. The syntax 'alice,bob ALL=(root) /usr/bin/apt-get, /usr/bin/dpkg' restricts the command set and requires authentication.

Answer

Users alice and bob can run any software command on the localhost only.

Answer

Members of ADMINS can run any command as root on any host.

Answer

Users alice and bob can run apt-get and dpkg without a password.

Question 18

A database server experiences performance degradation. Analysis shows high I/O wait on a LVM logical volume that uses striping across two physical volumes. What is the most effective way to improve performance?

Accepted Answer

Add a cache layer using lvmcache on a fast SSD. Adding a cache layer using lvmcache on a fast SSD is the most effective way to reduce high I/O wait because it places frequently accessed (hot) data on the faster SSD while keeping the bulk of data on the slower striped HDDs. This directly addresses the I/O bottleneck without requiring data migration or downtime, and it leverages the existing striped layout for sequential throughput while improving latency for random reads/writes.

Answer

Increase the stripe size and recreate the LV

Answer

Add an additional PV to the VG and extend the LV

Answer

Convert the LV to use linear mapping instead of striping

Question 19

An administrator wants to drop incoming TCP packets on port 22 from IP 10.0.0.5 using iptables. Which command is correct?

Accepted Answer

iptables -A INPUT -s 10.0.0.5 -p tcp --dport 22 -j DROP. It adds a rule to the INPUT chain, which processes packets destined for the local system. The `-s 10.0.0.5` flag specifies the source IP address, `-p tcp --dport 22` matches TCP packets destined for port 22 (SSH), and `-j DROP` silently discards matching packets. This configuration drops incoming SSH traffic from the specified host before it reaches any local service.

Answer

iptables -A INPUT -d 10.0.0.5 -p tcp --dport 22 -j DROP

Answer

iptables -A FORWARD -s 10.0.0.5 -p tcp --dport 22 -j DROP

Answer

iptables -A OUTPUT -s 10.0.0.5 -p tcp --dport 22 -j DROP

Question 20

Which TWO statements about VLAN tagging are correct?

Accepted Answer

Untagged frames on a trunk port are typically assigned to the native VLAN. On a trunk port, frames that do not carry a VLAN tag are considered to belong to the native VLAN. The switch forwards these untagged frames as part of the native VLAN, which is typically VLAN 1 by default but can be configured to any VLAN. This behavior is defined in IEEE 802.1Q and is essential for interoperability with devices that do not support VLAN tagging.

Answer

VLAN tagging can only be used with Ethernet

Answer

VLAN tags are always 12 bits

Answer

VLAN tags are added by the switch, not the host