LPIC-2 Practice Test 23 — 15 Questions

Question 1

A Linux server must send all traffic destined for 198.51.100.0/24 through a VPN gateway at 192.0.2.10 instead of the default gateway. The address 192.0.2.10 is reachable via the existing default route. Which command adds the correct route?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip route add 198.51.100.0/24 via 192.0.2.10. A route for a specific prefix via the VPN gateway takes precedence over the default route because the kernel prefers the longest matching prefix. The gateway address must be reachable through an existing route, which it is here via the default. This directs only the target subnet through the VPN while preserving normal internet access.

Answer

ip route add 198.51.100.0/24 dev 192.0.2.10

Answer

ip route add 198.51.100.0/24 via 192.0.2.10 metric 100

Answer

ip route add default via 192.0.2.10

Question 2

An administrator is configuring policy-based routing on a Linux router. Traffic from the 10.10.0.0/16 subnet must be routed through gateway 203.0.113.1, while all other traffic uses the default gateway 198.51.100.1. The administrator has added a routing table entry in /etc/iproute2/rt_tables and populated it with a default route. Which command is required to make the kernel use this table for packets from 10.10.0.0/16?

Accepted Answer

ip rule add from 10.10.0.0/16 table custom. Policy-based routing on Linux relies on routing rules that select a routing table based on criteria such as source address, destination address, or firewall mark. After creating and populating a custom table, the administrator must add a rule with ip rule add that matches the desired traffic and points to that table. Only then does the kernel consult the custom table for those packets.

Answer

ip route add default via 203.0.113.1 table custom

Answer

iptables -t mangle -A PREROUTING -s 10.10.0.0/16 -j MARK --set-mark 1

Answer

ip route change default via 203.0.113.1 dev eth0

Question 3

A Linux server acts as a gateway for an internal network. Internal clients report that they can reach external web servers by IP address but cannot resolve domain names. The server's /etc/resolv.conf contains nameserver 127.0.0.1, and a local caching resolver is running on port 53. Which command should the administrator use to verify that the resolver is answering queries from the server itself?

Accepted Answer

dig @127.0.0.1 example.com. To verify that a local DNS resolver is answering queries, the administrator should send a query directly to the loopback address where the resolver listens. The dig command with @127.0.0.1 does exactly that and reveals whether the resolver returns a valid answer. Other commands either query external servers or only check listening ports, which does not confirm functional resolution.

Answer

host -t A example.com

Answer

nslookup example.com 8.8.8.8

Answer

ss -tulpn | grep :53

Question 4

A Linux administrator maintains a BIND 9 authoritative name server for the zone 'corp.example.net'. The zone file is signed with DNSSEC, and the administrator must publish the public keys so that validating resolvers can build a chain of trust. Which resource record type must be created in the parent zone to delegate trust to this signed child zone?

Accepted Answer

A DS record containing the key tag, algorithm, digest type, and digest of the child's KSK. The parent zone delegates DNSSEC trust by publishing a DS record that contains a digest of the child zone's key-signing key. Validating resolvers fetch this DS record and use it to authenticate the child's DNSKEY RRset, thereby extending the chain of trust down to corp.example.net. Without the DS record, the child zone remains an island of trust.

Answer

An RRSIG record covering the child zone's SOA record

Answer

An NSEC3 record proving the non-existence of unsigned delegations

Answer

A DNSKEY record containing the zone's public key material

Question 5

A backup server has /dev/md0 as a RAID1 array assembled from /dev/sdd1 and /dev/sde1. During routine maintenance the administrator must remove /dev/sde1 from the array so the disk can be replaced, while keeping /dev/md0 mounted and serving data. Which command marks /dev/sde1 as failed and removes it from the active array?

Accepted Answer

mdadm /dev/md0 --fail /dev/sde1 --remove /dev/sde1. Removing a member from a live RAID1 array is done in two logical steps: mark the device faulty so the kernel stops issuing I/O to it, then detach it from the array. mdadm accepts both --fail and --remove in one invocation, and because a healthy mirror remains, /dev/md0 keeps operating in degraded mode with no unmount required. Zeroing superblocks or stopping the array are either premature or disruptive.

Answer

mdadm --stop /dev/md0 then mdadm --assemble /dev/md0 /dev/sdd1

Answer

mdadm --zero-superblock /dev/sde1 then mdadm /dev/md0 --remove /dev/sde1

Answer

mdadm --manage /dev/md0 --add /dev/sde1 --re-add /dev/sde1

Question 6

An administrator runs Postfix 3.x on a mail gateway that must relay outbound mail for an internal application server. The application connects from 10.20.30.40 and sends mail with an envelope sender of 'reports@internal.example.com'. The administrator wants Postfix to accept and relay this mail without requiring SMTP AUTH, but only for that specific host, while rejecting all other unauthorized relaying. Which main.cf parameter should be configured?

Accepted Answer

mynetworks = 10.20.30.40/32. Postfix grants relay access to clients whose IP addresses appear in mynetworks. By listing 10.20.30.40/32, the administrator trusts only that application server to relay mail without authentication. Other clients remain subject to smtpd_relay_restrictions and will be rejected unless they authenticate, satisfying the requirement for selective relay authorization.

Answer

relay_domains = internal.example.com

Answer

smtpd_client_restrictions = check_client_access hash:/etc/postfix/access

Answer

smtpd_relay_restrictions = permit_sasl_authenticated, reject

Question 7

An administrator is troubleshooting a Linux router that uses tc to shape traffic. The goal is to limit outbound bandwidth on eth0 to 100 Mbit/s and to prioritize interactive SSH traffic over bulk HTTP downloads. Which TWO statements about the required tc configuration are correct? (Choose two.)

Accepted Answer

A classful qdisc such as htb or hfsc must be attached to eth0 before classes and filters can be created.. Building a tc shaping and prioritization policy requires a classful root qdisc such as htb or hfsc, and classifiers like u32 or flower to place packets into the appropriate classes. The default qdisc is replaced automatically when a new root qdisc is added, tbf is classless and unsuitable for multiple priorities, and outbound shaping is handled on the egress path rather than requiring an ingress qdisc.

Answer

Traffic shaping with tc only affects inbound traffic on eth0, so an ingress qdisc must be used for outbound limits.

Answer

The tbf qdisc is the recommended root qdisc because it supports multiple classes and priorities.

Answer

The default pfifo_fast qdisc on eth0 must be removed with tc qdisc del before any new qdisc can be added.

Question 8

A Linux router uses nftables and must translate the source address of packets leaving via eth1 to the address 203.0.113.5, but only for traffic originating from the 10.10.0.0/16 network and only when the destination is not the internal 10.20.0.0/16 network. The administrator writes a rule in the postrouting chain of the nat table. Which nftables rule correctly expresses this requirement?

Accepted Answer

ip saddr 10.10.0.0/16 ip daddr != 10.20.0.0/16 oifname "eth1" snat to 203.0.113.5. Source NAT in nftables is expressed with snat to a fixed address and must be evaluated in the postrouting hook of the nat table, where the outgoing interface is known. The rule must match the internal source prefix, exclude the internal destination prefix with !=, and constrain to the WAN interface so that only Internet-bound traffic is rewritten to the public address.

Answer

ip saddr 10.10.0.0/16 ip daddr != 10.20.0.0/16 oifname "eth1" dnat to 203.0.113.5

Answer

ip saddr 10.10.0.0/16 ip daddr 10.20.0.0/16 oifname "eth1" snat to 203.0.113.5

Answer

ip saddr 10.10.0.0/16 ip daddr != 10.20.0.0/16 iifname "eth0" masquerade

Question 9

A Linux server is configured with a bridge interface br0 that includes physical interfaces eth0 and eth1. The administrator wants to enable STP on the bridge to prevent loops. Which TWO commands are required to enable and verify STP on the bridge? (Choose two.)

Accepted Answer

ip link set br0 type bridge stp_state 1. To enable STP on a Linux bridge using modern tools, the command 'ip link set br0 type bridge stp_state 1' is used. To verify that STP is enabled, 'ip -d link show br0' displays detailed bridge information, including the stp_state field. These two commands are part of the iproute2 suite, which is the current standard, whereas brctl is deprecated.

Answer

brctl showstp br0

Answer

brctl stp br0 on

Answer

bridge link show

Question 10

A mail administrator is troubleshooting a Postfix server that relays outbound mail for internal applications. Remote recipients report that messages are rejected with relay access denied, and the administrator confirms that the internal application hosts are not listed in any Postfix access map or authenticated session. The administrator wants those internal hosts to be permitted to relay. Which TWO main.cf parameters should be configured to allow this? (Choose two.)

Accepted Answer

mynetworks. Postfix authorizes relaying for non-authenticating clients by trusting their source addresses through mynetworks, and by including permit_mynetworks in smtpd_recipient_restrictions so the relay decision at RCPT TO accepts them. Both pieces are required: the network list identifies trusted clients, and the restriction list actually grants them permission to relay.

Answer

smtpd_sasl_auth_enable

Answer

inet_interfaces

Answer

relayhost

Question 11

A web administrator runs Apache HTTP Server 2.4 with mod_proxy and mod_proxy_balancer. Backend application servers are configured as balancer members in a ProxyPass directive using the balancer://appcluster URL. One backend begins returning HTTP 500 responses for every request, but the balancer keeps sending it traffic, so about one third of user requests fail. The administrator wants the balancer to stop using that member automatically without editing the configuration. Which action achieves this?

Accepted Answer

Enable the balancer member's failonstatus parameter so the member is placed in error state when it returns the specified HTTP status.. mod_proxy_balancer only removes a member from rotation when it is placed in error state. The failonstatus parameter makes the balancer interpret specific HTTP response codes from a member, such as 500, as failures, marking that member in error so the remaining healthy backends serve all requests until it recovers.

Answer

Configure the balancer's lbmethod to byrequests instead of bytraffic.

Answer

Set the ProxyPass directive's retry parameter to 0 for the cluster.

Answer

Add the ping parameter to each BalancerMember so the balancer performs health checks.

Question 12

A junior administrator has been asked to configure Apache HTTPD 2.4 to serve a static website from /var/www/html and to allow directory listings only for the /var/www/html/docs directory. The administrator adds the directive Options +Indexes inside a block in httpd.conf. After restarting Apache, directory listings for /docs still return 403 Forbidden. Which directive must be present in the block to permit the listing?

Accepted Answer

Require all granted. Apache 2.4 changed the authorization model, replacing Order/Allow/Deny with the Require directive. To allow access to a directory, you must include Require all granted. The Options +Indexes directive only enables the generation of directory listings; it does not override access control. Both are needed for a browsable directory.

Answer

Order allow,deny

Answer

AllowOverride All

Answer

Options +FollowSymLinks

Question 13

A DNS administrator is adding a new mail exchanger record for the domain example.com. The mail server is mail.example.com with IP address 203.0.113.5, and it should be the primary MX with priority 10. The administrator also wants to ensure that mail servers attempting delivery can resolve mail.example.com. Which TWO resource records must be added to the zone file to satisfy these requirements?

Accepted Answer

An MX record for example.com pointing to mail.example.com with priority 10, and an A record for mail.example.com pointing to 203.0.113.5.. For mail delivery, an MX record specifies the mail server hostname for a domain, and an A record provides the IPv4 address for that hostname. The MX record must be placed at the domain receiving mail, and its target must have an address record. Using a CNAME or PTR in place of the A record would not correctly resolve the mail server's address.

Answer

An MX record for example.com pointing to mail.example.com with priority 10, and a CNAME record for mail.example.com pointing to example.com.

Answer

An MX record for mail.example.com pointing to example.com with priority 10, and an A record for example.com pointing to 203.0.113.5.

Answer

An MX record for example.com pointing to mail.example.com with priority 10, and a PTR record for mail.example.com pointing to 203.0.113.5.

Question 14

A Samba share is configured with 'guest ok = yes' and 'map to guest = bad user'. A Windows client attempts to connect without providing credentials. Which of the following best describes the authentication behavior?

Accepted Answer

The client is authenticated as the guest account specified by the 'guest account' parameter.. When 'map to guest = bad user' is set, any connection attempt with an invalid or missing username is automatically mapped to the guest account. Combined with 'guest ok = yes' on the share, this grants access under the Unix identity defined by the 'guest account' parameter, typically 'nobody'. The client is not denied, nor is it prompted for credentials; it simply operates as the guest user with the permissions assigned to that account.

Answer

The client is denied access because no credentials were supplied.

Answer

The client is authenticated as the user 'nobody' only if the username matches 'nobody'.

Answer

The client is prompted to enter valid credentials before being mapped to guest.

Question 15

An administrator needs to mount a Samba share on a Linux client at boot and ensure that file ownership on the mounted filesystem reflects a specific local user and group, because the server does not provide Unix extensions. Which mount option combination should be used?

Accepted Answer

uid=1000,gid=1000. When a CIFS/SMB server does not expose Unix ownership, the client must map all files to a local identity. The uid and gid mount options do exactly that, forcing every file and directory on the mount to appear owned by the specified local user and group. This is the standard solution for consistent ownership on Linux clients mounting Samba shares.

Answer

credentials=/etc/cifs.creds

Answer

vers=3.0

Answer

nounix