LPIC-2 Practice Test 22 — 15 Questions

Question 1

An administrator wants to automatically mount home directories from an NFS server when a user logs in. Which service should be configured?

Accepted Answer

autofs. Autofs is the correct service because it provides on-demand mounting of NFS home directories triggered by user login. It uses the automount daemon to mount directories only when accessed, reducing network overhead and avoiding permanent mount entries in /etc/fstab. This is the standard Linux solution for dynamic NFS home directory mounting.

Answer

rpcbind

Answer

smb

Answer

nfs

Question 2

Refer to the exhibit. A client with MAC address 08:00:27:ab:cd:ef on the 192.168.1.0/24 network receives IP 192.168.2.10 instead of an IP from the 192.168.1.0 subnet. What is the most likely explanation?

Accepted Answer

The server's host declaration assigns a fixed-address from a different subnet.. The DHCP server's host declaration explicitly assigns a fixed-address to the client's MAC address (08:00:27:ab:cd:ef) from a different subnet (192.168.2.10). In ISC DHCP, the 'host' block with a 'fixed-address' directive overrides any subnet pool selection, forcing the server to offer that specific IP regardless of the relay agent or client's subnet. This is a common misconfiguration when administrators copy host declarations between subnet definitions without updating the address.

Answer

The relay agent is misconfigured and forwards requests to the wrong subnet.

Answer

The client's network interface is set to a static IP address.

Answer

The client sent a DHCP request with an incorrect subnet mask.

Question 3

Refer to the exhibit. A user cannot log in via SSH even though the password is correct. What is the most likely issue?

Accepted Answer

The /etc/nologin file exists, preventing non-root logins.. The /etc/nologin file, when present, prevents all non-root users from logging into the system via any authentication method, including SSH. This is a common administrative mechanism to block user access during maintenance or security incidents. Since the password is correct but login fails, the existence of /etc/nologin is the most likely cause, as it overrides successful PAM authentication for non-root users.

Answer

The password module is not configured correctly.

Answer

pam_unix.so nullok allows blank passwords, causing authentication to fail.

Answer

pam_securetty.so restricts root login via SSH, but the user is not root.

Question 4

Which TWO DHCP options are commonly used to provide network configuration to clients? (Choose two.)

Accepted Answer

routers. (routers) is correct because the DHCP option 3 (Router) provides the default gateway address to clients, enabling them to route traffic outside their local subnet. Option E (domain-name-servers) is correct because DHCP option 6 (Domain Name Server) supplies the DNS server addresses, allowing clients to resolve domain names. Both are essential for basic network connectivity and are almost universally configured in DHCP scopes.

Answer

subnet-mask

Answer

ntp-servers

Answer

host-name

Question 5

In a Samba domain member server, which file contains the SID to Unix ID mappings?

Accepted Answer

/var/lib/samba/winbindd_idmap.tdb. B is correct because Samba domain member servers use the winbindd service to map Windows SIDs to Unix UIDs/GIDs, and these mappings are stored in the `winbindd_idmap.tdb` file located in `/var/lib/samba/`. This TDB (Trivial Database) file maintains the persistent ID mapping database, which is essential for translating between the two security identifier systems.

Answer

/etc/group

Answer

/var/lib/samba/private/secrets.tdb

Answer

/etc/passwd

Question 6

Which TWO are best practices for securing an Apache web server?

Accepted Answer

Disable directory listing using Options -Indexes.. Disabling directory listing with `Options -Indexes` prevents Apache from generating a list of files in a directory when no index file (e.g., index.html) is present. This is a fundamental security hardening step that avoids exposing the directory structure, which could reveal sensitive files or paths to attackers. Option D is also correct: setting `ServerTokens Prod` reduces the amount of information Apache reveals about itself in HTTP headers and error pages (e.g., it omits the version number and OS details), making it harder for attackers to target specific vulnerabilities.

Answer

Allow directory indexing for ease of navigation.

Answer

Use .htaccess files for all access control.

Answer

Enable mod_info to monitor server status.

Question 7

Which TWO statements about the DHCP client on Linux are correct?

Accepted Answer

The dhclient command can be used to release and renew a DHCP lease.. The `dhclient` command, when invoked with the `-r` flag, releases the current DHCP lease, and with the `-v` flag (or without flags on many systems), it requests a new lease from the DHCP server. This is a standard method for manually managing DHCP leases on Linux systems using the ISC DHCP client.

Answer

The dhclient-script is used to parse the /etc/resolv.conf file.

Answer

The dhcpcd daemon is the standard DHCP client on all Linux distributions.

Answer

The /etc/dhcpd.conf file configures the DHCP client.

Question 8

You are troubleshooting a Linux client that is unable to connect to the internet. The client is configured to use DHCP on interface eth0. The output of 'ip addr show eth0' shows that the interface has an IP address 192.168.1.100/24, but there is no default gateway. The output of 'ip route show' shows only the local subnet route. The DHCP server is at 192.168.1.1 and is functioning correctly. You have verified that the DHCP client (dhclient) is running, and the lease file /var/lib/dhclient/dhclient-eth0.leases exists and contains option routers 192.168.1.1. Which of the following commands should you run to resolve the issue?

Accepted Answer

dhclient -r eth0 && dhclient eth0. The DHCP client has already obtained a lease with the correct gateway (192.168.1.1), but the default route was not applied. Running `dhclient -r eth0` releases the current lease, and `dhclient eth0` renews it, forcing the client to re-apply all options from the lease, including the default gateway route. This is the standard way to reinitialize the interface's network configuration from the DHCP server without restarting the entire networking service.

Answer

systemctl restart networking

Answer

ip route del default

Answer

ip route add default via 192.168.1.1

Question 9

A DNS administrator wants to implement DNSSEC on an authoritative zone. Which TWO resource records are essential for DNSSEC?

Accepted Answer

DNSKEY. DNSKEY and RRSIG are the two essential resource records for DNSSEC. The DNSKEY record holds the public signing key, while the RRSIG record contains the digital signature for each RRset, allowing resolvers to verify authenticity and integrity of the zone data.

Answer

NSEC

Answer

A

Answer

SOA

Question 10

What is the recommended way to configure a Linux host to obtain an IP address automatically via DHCP on the eth0 interface?

Accepted Answer

Set 'BOOTPROTO=dhcp' in /etc/sysconfig/network-scripts/ifcfg-eth0.. On Red Hat-based Linux distributions, the recommended way to configure an interface for DHCP is to set 'BOOTPROTO=dhcp' in the interface configuration file /etc/sysconfig/network-scripts/ifcfg-eth0. This instructs the network service to use the DHCP protocol to obtain an IP address automatically from a DHCP server. The value 'dhcp' is the standard keyword recognized by the ifcfg scripts, not 'dhclient'.

Answer

Set 'BOOTPROTO=dhclient' in /etc/sysconfig/network-scripts/ifcfg-eth0.

Answer

Edit /etc/dhcp/dhcpd.conf to include the host's MAC address.

Answer

Use 'networkctl' to set DHCP=yes on eth0.

Question 11

An administrator wants to disable the graphical splash screen during boot. What change should be made in /etc/default/grub?

Accepted Answer

Remove 'splash' from GRUB_CMDLINE_LINUX_DEFAULT. The graphical splash screen during boot is controlled by the 'splash' kernel parameter. Removing 'splash' from GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub disables the splash screen, allowing verbose boot messages to be displayed. This parameter is passed to the kernel via the bootloader, and its absence prevents the plymouth or similar splash service from activating.

Answer

Set GRUB_CMDLINE_LINUX="nosplash"

Answer

Remove 'quiet' from GRUB_CMDLINE_LINUX_DEFAULT

Answer

Set GRUB_TIMEOUT=0

Question 12

A DHCP server running on a Linux machine is not leasing IP addresses to clients on a particular VLAN. The server's configuration file includes a subnet declaration for that VLAN, but clients receive only link-local addresses. What is the most likely issue?

Accepted Answer

The DHCP server's interface is not in the same broadcast domain.. The DHCP server's interface must be in the same broadcast domain (i.e., the same VLAN) as the clients to receive their DHCPDISCOVER broadcasts directly. If the server is on a different subnet or VLAN without a DHCP relay agent, the broadcast frames never reach the server, so clients receive no DHCPOFFER and fall back to link-local addresses (APIPA).

Answer

The DHCP server is not running.

Answer

The DHCP relay agent is not forwarding requests to the server.

Answer

The subnet mask in the DHCP configuration is incorrect.

Question 13

A system administrator has multiple kernel modules that depend on each other. Module A must be loaded before module B. How can this dependency be ensured automatically when using modprobe?

Accepted Answer

Add options module_a softdep=module_b to /etc/modprobe.d/. The `softdep` directive in a modprobe configuration file (e.g., `/etc/modprobe.d/*.conf`) allows you to declare a soft dependency where one module should be loaded before another, without creating a hard dependency in the module symbol table. When `modprobe` processes this directive, it ensures that module A is loaded before module B automatically, even if there is no explicit symbol dependency between them.

Answer

Use depmod to generate dependency information

Answer

Use insmod to load module A first, then module B in a startup script

Answer

Add module B to the /etc/modules file

Question 14

A company runs an NTP server that should only synchronize with trusted upstream servers and provide time to internal clients. Which restrict clause in ntp.conf would best secure the server against unauthorized queries?

Accepted Answer

restrict 192.168.0.0 mask 255.255.0.0 nomodify notrap. The best choice among the options because it restricts internal clients with `nomodify` and `notrap`, preventing them from altering the server's configuration or sending control message traps. However, to fully secure against unauthorized queries, a `restrict default ignore` or similar rule is needed; otherwise, external hosts can still query. Option B would block all hosts by default, requiring explicit allows for trusted upstream servers, which is less practical. Option A would block all queries entirely, including internal clients. Option D applies only to localhost and does not affect external queries. Thus, C is the most effective at securing against unauthorized queries while allowing internal client synchronization.

Answer

restrict default ignore

Answer

restrict default kod nomodify notrap nopeer noquery

Answer

restrict 127.0.0.1

Question 15

A developer frequently needs to access a remote database server that is only accessible via SSH from a jump host. To simplify access, the administrator wants to create a local port forward so that the developer can connect to localhost:3306 and reach the remote database's MySQL port 3306. Which SSH command achieves this?

Accepted Answer

ssh -L 3306:db.internal:3306 user@jump.example.com. `ssh -L 3306:db.internal:3306 user@jump.example.com` forwards local port 3306 to `db.internal:3306` through the jump host, allowing the developer to connect to localhost:3306 and reach the remote database. Option E is incorrect because `-L 3306:localhost:3306` forwards to the jump host's own localhost, not the database server; this would only work if the database were running on the jump host itself, which is not the case.

Answer

ssh -J user@jump.example.com -L 3306:localhost:3306 db.internal

Answer

ssh -L localhost:3306:db.internal:3306 user@jump.example.com

Answer

ssh -R 3306:localhost:3306 user@jump.example.com

Answer

ssh -L 3306:localhost:3306 user@jump.example.com