LPIC-2 Practice Test 21 — 15 Questions

Question 1

Which THREE actions are typically required to configure a VLAN interface on a Linux system?

Accepted Answer

Create the VLAN interface using ip link.. The `ip link` command is used to create a VLAN interface by specifying the parent physical interface and the VLAN ID (e.g., `ip link add link eth0 name eth0.10 type vlan id 10`). This creates a virtual network interface that tags outgoing frames with the specified 802.1Q VLAN ID and strips tags from incoming frames.

Answer

Add the physical interface to a bridge.

Answer

Configure iptables rules for the VLAN.

Question 2

A client on the 192.168.2.0/24 network cannot obtain an IP address. Other clients on that subnet work fine. The DHCP server logs show no request from the client's MAC. What is the most likely cause?

Accepted Answer

No DHCP relay agent is configured on the client's subnet.. The client's DHCP request never reaches the DHCP server, as indicated by the server logs showing no request from the client's MAC. Since other clients on the same subnet work fine, the DHCP server and the local subnet are functional. The most likely cause is that the client's subnet (192.168.2.0/24) lacks a DHCP relay agent (e.g., configured on a router or switch using the 'ip helper-address' command) to forward broadcast DHCPDISCOVER messages to the DHCP server located on a different subnet. Without a relay agent, DHCP broadcasts are confined to the local subnet and cannot reach a remote server.

Answer

The range is too small for the number of clients.

Answer

The subnet declaration for 192.168.2.0 is missing option routers.

Answer

The client is configured with a static IP address.

Question 3

An administrator wants to create a chroot environment for a potentially compromised service. The service needs to read /etc/resolv.conf and /etc/hosts, and run from a directory /chroot/service. Which of the following steps is essential to ensure the chroot environment is secure and functional?

Accepted Answer

Create /dev/null and /dev/random inside the chroot using mknod.. A chroot environment typically lacks device nodes, and many services require /dev/null and /dev/random for basic I/O operations and entropy. Without these, the service may fail to start or behave unpredictably. Creating them with mknod ensures the service can function securely within the jail.

Answer

Set the chroot directory to be read-only.

Answer

Mount /proc within the chroot jail.

Answer

Copy only the service binaries and configuration files into the chroot.

Question 4

An administrator is troubleshooting network isolation in a Linux container environment. The container should have its own network stack, but it appears to be using the host's interfaces. Which command correctly runs a command inside a network namespace named 'ns1' to verify its network configuration?

Accepted Answer

ip netns exec ns1 ip addr show. The `ip netns exec` command is specifically designed to execute a command within a given network namespace. In this scenario, `ip netns exec ns1 ip addr show` runs the `ip addr show` command inside the network namespace named 'ns1', allowing the administrator to verify that the container has its own network stack and is not using the host's interfaces.

Answer

nsenter -t 1234 -n ip addr show

Answer

unshare -n ip addr show

Answer

ip netns add ns1

Question 5

A small company runs a LAMP stack web server with Postfix mail server on a single Ubuntu 22.04 instance. The web server hosts a PHP application that sends password reset emails via the local mail server using PHP's mail() function. Recently, users report that password reset emails are not arriving. The administrator checks the mail log and finds that messages are being accepted by Postfix but are not being delivered. The mail queue shows messages with the status 'deferred'. There are no obvious errors in the mail log. The server has sufficient disk space and memory. The administrator suspects a DNS resolution issue. Which of the following is the most likely cause of the deferred mail?

Accepted Answer

The DNS resolver on the server is unable to resolve the MX records for the recipient domains.. Postfix accepts the messages but defers delivery when it cannot resolve the recipient domain's MX record. The mail log shows no errors because the deferral is a normal queue action, not a failure. DNS resolution failure for MX records is a common cause of deferred mail, as Postfix cannot determine where to deliver the message.

Answer

The server's firewall is blocking outbound connections on port 25, causing connection timeouts.

Answer

The SPF record for the sender domain is missing, causing the recipient's mail server to reject the email.

Answer

The server's IP address has no PTR record, causing the recipient's mail server to reject the connection.

Question 6

Based on the ACL output, which user(s) can write to the file /var/www/html/index.html?

Accepted Answer

Only root.. The ACL output shows that the mask is set to r--, which limits the effective permissions of named users and groups to read-only, regardless of their ACL entries. However, the root user is not subject to ACL restrictions and always has full access to any file, including write permission, making root the only user who can write to the file.

Answer

Only the user www-data.

Answer

No one, because the mask is r--.

Answer

Any user in the www-data group.

Question 7

A system administrator is setting up mutual TLS (mTLS) for communication between a web server and a backend application on a Linux server. The security team requires encryption and proper certificate management with automated renewal using open-source tools on a small budget. Which solution should the administrator implement?

Accepted Answer

Set up a private CA with easy-rsa and configure a cron job for certificate renewal.. Easy-rsa provides a simple wrapper around OpenSSL to create a private CA, and a cron job can automate certificate renewal, meeting the budget and open-source requirements. This is a common approach for internal mTLS in Linux environments.

Answer

Generate self-signed certificates using OpenSSL and manually distribute them via SCP.

Answer

Deploy Hashicorp Vault with PKI backend.

Answer

Use Let's Encrypt with an ACME client to issue internal certificates.

Question 8

An administrator has configured Samba as a domain member for an Active Directory environment. For user authentication via winbind, which daemon must be running?

Accepted Answer

winbindd. In a Samba domain member configuration for Active Directory, the winbindd daemon is responsible for resolving user and group information from the Windows domain and providing authentication services via the Winbind protocol. It communicates with the Active Directory domain controller using DCE/RPC and LDAP to map Windows SIDs to Unix UIDs/GIDs, enabling seamless user authentication. Without winbindd running, winbind-based authentication (e.g., via PAM or nsswitch) will fail, even if smbd and nmbd are active.

Answer

smbd

Answer

samba

Answer

nmbd

Question 9

A company has multiple subnets and wants to implement policy-based routing to direct traffic from a specific development subnet (192.168.10.0/24) through a specialized firewall for content filtering, while all other traffic uses the default gateway. Which of the following steps is required to achieve this using iproute2 tools?

Accepted Answer

Create a new routing table (e.g., table 100), add a default route via the firewall in that table, and add an ip rule to use table 100 for traffic from 192.168.10.0/24.. Policy-based routing (PBR) with iproute2 requires creating a separate routing table, adding a default route via the firewall in that table, and then using an ip rule to match traffic from the source subnet (192.168.10.0/24) and direct it to that custom table. This allows traffic from the development subnet to follow a different path than the default gateway, while all other traffic continues to use the main routing table.

Answer

Use iptables to mark packets from the development subnet and then use ip rule to use the main table for marked packets.

Answer

Add an ip rule to route traffic from 192.168.10.0/24 to the firewall without creating a new table.

Answer

Add a static route to the main routing table for 192.168.10.0/24 pointing to the firewall.

Question 10

A company runs a database server on Linux with a 4-disk RAID 10 array using mdadm. The server recently experienced a power outage. After reboot, the array is not assembling automatically. The administrator runs `mdadm --assemble --scan` and it fails with a message: 'mdadm: /dev/md0 has been found but is not a valid md superblock.' The administrator checks /proc/mdstat and sees no arrays. The disks /dev/sda, /dev/sdb, /dev/sdc, /dev/sdd are present. Running `mdadm --examine /dev/sda` shows no md superblock, but the disk contains data partitions. The administrator suspects that the superblock may be corrupted or that the disks were accidentally overwritten. The administrator has documentation that the array was created with the following parameters: RAID level 10, 4 disks, chunk size 512 KiB, metadata 1.2. What is the best course of action to recover the array?

Accepted Answer

Use `mdadm --create --level=10 --raid-devices=4 --chunk=512 --metadata=1.2 --assume-clean /dev/md0 /dev/sda /dev/sdb /dev/sdc /dev/sdd` and then mount.. When the md superblock is missing or corrupted on all disks (as confirmed by `mdadm --examine` showing no superblock), the only way to recover the array is to recreate it with `--assume-clean`. This tells mdadm to trust that the data on the disks is already in a consistent RAID 10 layout without performing an initial resync, which would overwrite the existing data. The parameters must exactly match the original creation (RAID 10, 4 disks, chunk 512 KiB, metadata 1.2) to reconstruct the correct data mapping.

Answer

Use `mdadm --create --level=10 --raid-devices=4 --chunk=512 --metadata=1.2 /dev/md0 /dev/sda /dev/sdb /dev/sdc /dev/sdd` without --assume-clean and then run fsck.

Answer

Run `mdadm --examine --scan` to probe for superblocks on all disks, then attempt recovery with --super-minor or --uuid.

Answer

Use `dd` to backup each disk's first few sectors, then use a data recovery tool.

Question 11

Which TWO of the following commands can be used to load a kernel module into the running kernel?

Accepted Answer

insmod. Both `insmod` and `modprobe` can load a kernel module into the running kernel. `insmod` directly inserts a single module file (e.g., `.ko` file) into the kernel, but it does not resolve dependencies automatically. `modprobe` is a higher-level tool that uses the module dependency file (`modules.dep`) to load a module along with any required dependencies, making it the preferred method for most situations.

Answer

depmod

Answer

rmmod

Answer

modinfo

Question 12

A systems administrator is configuring a Postfix mail server to use Dovecot for SASL authentication. The authentication method is set to PLAIN in Dovecot, and Postfix has smtpd_sasl_auth_enable=yes and smtpd_sasl_type=dovecot. Dovecot's auth socket is at /var/run/dovecot/auth-client. The mail logs show repeated "SASL authentication failed" errors for known good credentials. The administrator checks that the socket exists and that Dovecot is running. What is the most likely cause?

Accepted Answer

The postfix user does not have read permission on the Dovecot auth socket.. The most likely cause is that the Postfix user (typically 'postfix' or the mail queue owner) lacks read permission on the Dovecot auth socket at /var/run/dovecot/auth-client. Dovecot's SASL authentication via a Unix socket requires the connecting process (Postfix) to have read/write access to that socket file. Even though the socket exists and Dovecot is running, if the permissions are too restrictive (e.g., owned by 'dovecot' with mode 0600), Postfix cannot communicate with Dovecot's auth service, resulting in repeated 'SASL authentication failed' errors despite valid credentials.

Answer

The smtpd_recipient_restrictions does not include permit_sasl_authenticated.

Answer

The Dovecot service is not listening on TCP port 143 for IMAP.

Answer

The mynetworks parameter in Postfix is set incorrectly.

Question 13

A Samba share is configured with 'writable = no'. What does this mean?

Accepted Answer

The share is read-only.. When a Samba share is configured with 'writable = no', it explicitly denies write access to the share at the Samba level, regardless of underlying Unix file permissions. This directive overrides any other settings (like 'write list') and makes the share read-only for all clients connecting via SMB/CIFS protocols. The correct interpretation is that the share is read-only, which matches option A.

Answer

Users can read and write.

Answer

Only root can write.

Answer

Write access depends on Unix permissions.

Question 14

A Samba server uses 'security = domain' with an NT4-style domain. After a domain controller outage, users cannot authenticate. Which configuration change would allow fallback to local authentication?

Accepted Answer

Set 'security = user' and 'passdb backend = tdbsam'. When a Samba server is configured with 'security = domain', it relies on a remote NT4-style domain controller for authentication. If the domain controller is unavailable, users cannot authenticate because Samba has no local fallback. Changing to 'security = user' and setting 'passdb backend = tdbsam' switches Samba to authenticate users against its own local password database (tdbsam), allowing authentication even when the domain controller is down.

Answer

Set 'domain master = no'

Answer

Set 'local master = yes'

Answer

Set 'preferred master = no'

Question 15

A small office network uses a Linux server running dnsmasq to provide DHCP and DNS services. The server runs Ubuntu with dnsmasq version 2.80. The configuration file /etc/dnsmasq.conf includes: 'interface=eth0', 'dhcp-range=192.168.1.100,192.168.1.200,12h', and no other DNS-related options. Clients receive IP addresses from the DHCP server and can access the internet. However, clients cannot ping other clients by hostname (e.g., 'ping workstation1' fails with NXDOMAIN). The dnsmasq logs show that DHCP requests are handled and the client hostnames are recorded. The administrator verifies that /etc/hosts contains only the localhost entry. Which of the following is the most likely cause?

Accepted Answer

The dnsmasq 'local' directive is not configured to treat local hostnames as authoritative.. Without the 'local' directive (or equivalent '--local' / 'localise-queries'), dnsmasq does not treat hostnames from DHCP leases as authoritative for DNS resolution. By default, dnsmasq only answers queries for names it knows from /etc/hosts or from upstream DNS, but it does not automatically resolve DHCP client hostnames unless explicitly told to do so via 'local' or 'domain' settings. Since the logs show hostnames are recorded but NXDOMAIN is returned, the missing 'local' directive is the most likely cause.

Answer

The dnsmasq 'expand-hosts' option is not enabled.

Answer

The dnsmasq 'domain-needed' option is set, blocking local domain resolution.

Answer

The dnsmasq 'no-hosts' option is configured, ignoring /etc/hosts.