LPIC-2 Practice Test 23 — 15 Questions

Question 1

After adding a new LUN to an existing SAN, the administrator runs multipath -ll but sees the new LUN as 'failed'. The multipathd service is running. What is the most likely cause?

Accepted Answer

The new LUN has not been presented to the host from the SAN. When a new LUN appears as 'failed' in `multipath -ll` output, the most common cause is that the LUN has not been properly presented to the host from the SAN. Even if the multipathd service is running, multipathd can only manage devices that the SCSI layer has already discovered. If the SAN administrator has not zoned or masked the LUN to the host, the host's SCSI subsystem never sees the device, so multipathd reports it as 'failed' because it cannot find the underlying paths.

Answer

The multipathd daemon needs to be restarted

Answer

The /etc/multipath.conf needs to be edited to include the new LUN

Answer

The scsi device needs to be manually created with mknod

Question 2

A host on 192.168.2.100 tries to SSH to the firewall's IP address (192.168.1.1). The firewall's input chain policy is drop. Will the SSH connection be allowed?

Accepted Answer

No, because the input chain drops all packets that don't match rules.. The stem provides no specific firewall rule. With the input chain policy set to 'drop', all packets not matching any rule are dropped. Since no rule is stated to permit SSH, the connection from 192.168.2.100 to 192.168.1.1 will be blocked. Therefore, the correct answer is 'No' (Option A). Options B and C are incorrect because they either misidentify the traffic type or reference a non‑existent forward rule. Option D is incorrect because the stem does not mention any rule accepting SSH from the 192.168.2.0/24 subnet; such a rule is not provided.

Answer

No, because SSH to firewall is considered forwarded traffic.

Answer

Yes, because the forward chain accepts SSH.

Answer

Yes, because there is a rule accepting SSH from 192.168.2.0/24.

Question 3

An administrator wants to ensure that a Linux client sends all DNS queries to a specific DNS server without relying on DHCP-provided DNS servers. Which configuration files should be modified?

Accepted Answer

Edit /etc/dhcp/dhclient.conf to add 'supersede domain-name-servers <desired IP>;'. The dhclient.conf file allows an administrator to override DHCP-provided DNS servers using the 'supersede' directive. This forces the DHCP client to ignore the DNS servers received from the DHCP server and instead use the manually specified DNS server when writing /etc/resolv.conf. This is a standard method for controlling DNS resolution on systems using dhclient.

Answer

Configure NetworkManager to ignore DNS from DHCP and set the DNS manually in the connection profile

Answer

Edit /etc/sysconfig/network-scripts/ifcfg-eth0 and set PEERDNS=no and DNS1=<desired IP>

Answer

Edit /etc/resolv.conf and set the nameserver to the desired IP

Question 4

A Samba server is configured with 'security = ads' and joined to an Active Directory domain. Users report that SIDs are not being resolved correctly. Which service and configuration file are critical for ID mapping?

Accepted Answer

winbind and /etc/samba/smb.conf. When Samba is configured with 'security = ads' and joined to an Active Directory domain, the winbind service is responsible for resolving Windows SIDs to Unix UIDs/GIDs and vice versa. The critical configuration for ID mapping is defined in the 'idmap config' directives within /etc/samba/smb.conf, making winbind and smb.conf the correct pair. Without winbind running and proper idmap configuration, SID resolution will fail.

Answer

smbd and /etc/samba/smb.conf

Answer

winbind and /etc/security/pam_winbind.conf

Answer

nmbd and /etc/samba/smb.conf

Question 5

Which THREE conditions can cause a Linux DHCP client to fail to obtain an IP address? (Select THREE.)

Accepted Answer

A firewall on the client is blocking UDP port 67 (DHCP server).. A client-side firewall blocking UDP port 67 prevents the DHCP client from receiving DHCPOFFER and DHCPACK messages from the server. DHCP uses UDP ports 67 (server) and 68 (client); blocking port 67 on the client disrupts inbound server responses, causing the client to fail to obtain an IP address.

Answer

The DHCP server is configured with a different subnet than the client's broadcast domain.

Answer

The client interface is configured with a static IP address.

Question 6

A system administrator compiled a custom kernel module for a new hardware device. After copying the .ko file to /lib/modules/$(uname -r)/, the module is not loading automatically at boot. What is the most likely cause?

Accepted Answer

The module is blacklisted in /etc/modprobe.d/.. A blacklist entry in /etc/modprobe.d/ explicitly prevents the kernel from loading the module at boot, regardless of its presence in /lib/modules/$(uname -r)/. The modprobe system reads these configuration files during early boot and skips any module listed with a 'blacklist' directive, which is the most likely cause when a module is present but fails to load automatically.

Answer

The module needs to be added to /etc/modules.

Answer

The module has a dependency error.

Answer

The kernel version does not match the module.

Question 7

A financial institution uses a Linux server with a custom application that runs as the 'appuser' and writes logs to /var/log/app/. The security team recently detected that the application is vulnerable to a local privilege escalation via log injection. To mitigate, they decide to implement mandatory access control (MAC) using SELinux. The system is CentOS 7 with SELinux in enforcing mode. The current context of /var/log/app is 'unconfined_u:object_r:var_log_t:s0'. The application should only be allowed to write to logs in that directory, and no other processes should modify them. Which SELinux policy change should be made?

Accepted Answer

Create a custom SELinux policy module that defines a new type for the log directory and transitions for the application domain.. The application needs a dedicated SELinux type for its log directory and a domain transition so that only the 'appuser' process running in the 'app_t' domain can write to that directory. Creating a custom policy module with a new type (e.g., 'app_log_t') and a file transition rule ensures that other processes (even those with 'var_log_t' access) cannot modify the logs, meeting the strict confinement requirement.

Answer

Use 'semanage permissive -a app_t' to put the application domain in permissive mode.

Answer

Run 'chcon -t var_log_t /var/log/app' to set the correct context.

Answer

Use 'audit2allow' to create a local policy module based on current denials.

Question 8

Which THREE configuration directives are necessary to enable Winbind for Active Directory authentication on a Samba domain member?

Accepted Answer

security = ads. Setting 'security = ads' tells Samba to operate as an Active Directory domain member, using Kerberos for authentication and LDAP for identity lookups. This directive is mandatory for Winbind to communicate with an AD domain controller.

Answer

winbind use default domain = yes

Answer

workgroup = EXAMPLE

Question 9

An administrator configures a DHCP relay agent using 'dhcrelay' in a network with multiple VLANs. The relay agent is on a Linux server with interfaces eth0 (VLAN 10) and eth1 (VLAN 20). The DHCP server is on VLAN 10. Which command correctly sets up the relay to forward requests from VLAN 20 to the DHCP server at 192.168.1.5?

Accepted Answer

dhcrelay -i eth1 192.168.1.5. The `-i eth1` flag specifies the interface on which the relay agent should listen for DHCP client broadcasts (VLAN 20). The relay then unicasts those requests to the DHCP server at 192.168.1.5, which resides on VLAN 10. This ensures that only broadcasts from the client-side VLAN are forwarded, not those from the server-side network.

Answer

dhcrelay -i eth0 192.168.1.5

Answer

dhcrelay -i eth0 -i eth1 192.168.1.5

Answer

dhcrelay 192.168.1.5

Question 10

Which THREE statements about PAM configuration are correct? (Select three.)

Accepted Answer

The order of modules in a stack affects the outcome.. PAM (Pluggable Authentication Modules) processes modules in a defined order within a stack, and the control flags (required, requisite, sufficient, optional) determine how the success or failure of each module affects the overall authentication result. The order matters because a 'sufficient' module that succeeds can cause authentication to succeed immediately, bypassing later modules, while a 'required' module that fails can cause authentication to fail after all modules in the stack have been evaluated.

Answer

The control flag 'required' means the module must succeed; if it fails, authentication fails immediately.

Answer

The module type 'auth' is used for account management.

Question 11

Which TWO of the following are common symptoms of a misconfigured winbind service when Samba is joined to an Active Directory domain?

Accepted Answer

`getent passwd` does not list domain users.. When winbind is misconfigured, the Name Service Switch (NSS) module may not be properly set up to query winbind for domain users. This means `getent passwd` will not return domain users even if winbind itself can enumerate them via `wbinfo -u`. The core issue is that NSS is not configured to use the `winbind` source in `/etc/nsswitch.conf`, or the winbind service is not correctly communicating with the NSS subsystem.

Answer

`net ads join` fails with 'access denied'.

Answer

Domain users cannot authenticate via SSH.

Question 12

Which of the following is the correct command to add an IPv6 address 2001:db8::1/64 to interface eth0?

Accepted Answer

ip -6 addr add 2001:db8::1/64 dev eth0. The `ip -6 addr add` command is the proper way to add an IPv6 address to an interface using the `ip` tool from the iproute2 suite. The `-6` option restricts the operation to IPv6, and the address must include the prefix length (`/64`) to define the subnet. The `dev eth0` parameter specifies the target interface.

Answer

ip addr add 2001:db8::1/64 dev eth0

Answer

ip -6 addr add 2001:db8::1 dev eth0

Answer

ip link set eth0 ipv6 2001:db8::1/64

Answer

ifconfig eth0 inet6 add 2001:db8::1/64

Question 13

Which TWO daemons are commonly used by DHCP clients on Linux to obtain an IP address? (Choose two.)

Accepted Answer

dhclient. dhclient is the default DHCP client for many Linux distributions, including those based on Red Hat and Debian. It uses the DHCP protocol (RFC 2131) to discover, request, and lease an IP address from a DHCP server, configuring the network interface accordingly.

Answer

dhcrelay

Answer

dhcpd

Answer

tcpdump

Question 14

A data center administrator is troubleshooting a server that hangs during boot after a kernel update. The server uses UEFI and GRUB 2. The administrator observes that the server displays the GRUB menu, selects the new kernel entry, but then the screen goes blank and the system does not respond. The administrator can boot the previous kernel from the GRUB menu successfully. Which of the following is the most likely cause of this issue?

Accepted Answer

The new kernel includes a graphics driver that conflicts with the hardware, causing the display to blank. The blank screen after selecting the new kernel, while the old kernel works, strongly indicates a graphics driver conflict. In GRUB 2 with UEFI, the kernel may switch from the UEFI framebuffer to a native graphics driver (e.g., nouveau, i915, amdgpu) that fails to initialize on the specific hardware, causing the display to go blank. The system is not truly hung; it continues booting without console output, which is a known issue with incompatible or buggy kernel graphics drivers.

Answer

The initramfs for the new kernel was not generated

Answer

Secure Boot is enabled and the new kernel is not signed

Answer

The new kernel's root= parameter points to an invalid device

Question 15

A Samba share is configured with 'valid users = @staff' but users in the staff group still get 'NT_STATUS_ACCESS_DENIED' when accessing the share. The server uses 'security = user'. Which additional configuration is required?

Accepted Answer

Run smbpasswd -a for each user. With 'security = user', Samba requires each user to have a separate Samba password stored in the smbpasswd file (or another passdb backend). Even if a user is a member of the 'staff' group and exists in the system's /etc/passwd, they cannot authenticate to the share without an smbpasswd entry. Running 'smbpasswd -a' for each user creates that entry, resolving the NT_STATUS_ACCESS_DENIED error.

Answer

Set 'guest ok = yes'

Answer

Set 'force group = staff'

Answer

Add the share to [global]