LPIC-2 Practice Test 24 — 15 Questions

Question 1

A Samba server uses the 'acl_xattr' VFS module to store Windows ACLs in extended attributes. Users report that permissions set from Windows are not enforced; they can access files they should not. Running 'getfattr -d /srv/data/file.txt' shows no user.* attributes. Which parameter must be verified in smb.conf to ensure ACLs are stored correctly?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

vfs objects = acl_xattr. To store Windows NT ACLs in extended attributes, the acl_xattr VFS module must be loaded via the 'vfs objects' parameter on the share. If the module is missing, Samba cannot persist the security descriptors in user.* extended attributes, and Windows ACLs are not enforced. The absence of user.* attributes from getfattr is a clear indicator that the module is not active, so verifying 'vfs objects = acl_xattr' is the necessary step.

Answer

nt acl support = yes

Answer

store dos attributes = yes

Answer

map acl inherit = yes

Question 2

A Samba server is configured as a standalone file server. The administrator wants to restrict access to a share named [finance] to members of the group 'accounting' and deny access to all other users, including guests. The share is currently accessible to everyone. Which two actions must be taken to achieve this? (Choose two.)

Accepted Answer

Set valid users = @accounting in the [finance] share section.. To restrict access to only members of the accounting group, the valid users parameter must be set to @accounting, which explicitly allows only that group. Additionally, guest ok must be set to no to prevent anonymous access. Together, these settings ensure that only authenticated accounting users can access the share, while all others are denied.

Answer

Set browseable = no in the [finance] share section.

Answer

Set read only = yes in the [finance] share section.

Answer

Set invalid users = @accounting in the [finance] share section.

Question 3

An administrator configures a Samba share named 'projects' with 'valid users = @design' and 'write list = @design'. A user named priya, who belongs to the design group, reports that she can open files but cannot create new ones. Running 'smbstatus' shows her connected as user priya. Which single configuration change is most likely to resolve the write failure?

Accepted Answer

Set read only = no on the projects share. A Samba share is read only by default, and the write list parameter only takes effect when the share is writable. Since priya is already a member of the design group listed in write list, the missing piece is explicitly setting read only = no on the projects share. Without that, Samba denies all write operations regardless of group membership or write list entries.

Answer

Add priya to the write list explicitly

Answer

Set force user = priya on the projects share

Answer

Add priya to the 'admin users' parameter

Question 4

A Linux server uses systemd and has a custom kernel module named `foo.ko` located in `/lib/modules/$(uname -r)/kernel/drivers/misc/`. The administrator wants to ensure that this module is loaded automatically at boot, but only after a specific hardware device is detected. Which approach is most appropriate?

Accepted Answer

Create a udev rule that matches the device and runs `modprobe foo`.. To load a module conditionally when a specific hardware device is detected, a udev rule is the correct mechanism. The rule matches the device and invokes modprobe, ensuring the module loads only when the hardware is present. This provides the necessary ordering and dependency handling, unlike unconditional loading via modules-load.d or legacy methods.

Answer

Add the module name to `/etc/modules-load.d/foo.conf`.

Answer

Add `foo` to `/etc/modprobe.d/blacklist.conf` with an alias.

Answer

Run `depmod -a` and add the module to `/etc/rc.local`.

Question 5

A Linux administrator runs a Samba server that must expose a share to clients on a network where name resolution is unreliable. The administrator wants clients to discover the server without relying on NetBIOS broadcast resolution. Which smb.conf global parameter should be configured to advertise the server's presence through mDNS?

Accepted Answer

multicast dns register = yes. To advertise a Samba server for discovery without relying on NetBIOS broadcasts, the multicast dns register parameter must be enabled. It causes Samba to publish its hostname and SMB service records via multicast DNS, which modern clients can query directly. Turning off NetBIOS or tuning the server's own name resolution order does not give clients an mDNS-based way to locate the server.

Answer

wins support = yes

Answer

name resolve order = lmhosts host bcast

Answer

disable netbios = yes

Question 6

An administrator must harden a production web server that stores TLS private keys under /etc/pki/private. The keys are currently mode 0644 owned by root:root, and several unprivileged service accounts run on the host. The administrator wants to restrict access so only root and members of the group sslkeys can read the private keys, while leaving the directory traversable for processes that must reach files beside them. (Choose two.)

Accepted Answer

Run chmod 0640 on the private key files. Effective key protection requires both correct group ownership and a restrictive mode. Setting group ownership to sslkeys and mode 0640 ensures only root and that group can read the keys, while others are excluded. Directory permissions should permit traversal without world listing. Attributes and broad ACL grants address different concerns and either fail the goal or weaken it.

Answer

Run chmod 0755 on /etc/pki/private

Answer

Run setfacl -m u:www-data:rwx /etc/pki/private/*.key

Answer

Run chattr +i on the private key files

Question 7

A Samba server is configured with the recycle VFS module to move deleted files to a .recycle directory. The share is defined as follows:

[projects]
path = /srv/projects
vfs objects = recycle
recycle:repository = .recycle
recycle:keeptree = yes
recycle:versions = yes

A user deletes a file named report.docx from a subdirectory called Q1. Where will the file be moved?

Accepted Answer

/srv/projects/.recycle/Q1/report.docx. The recycle VFS module moves deleted files to a specified repository. When recycle:keeptree is enabled, the module recreates the original directory structure under the repository. Since the file was in Q1, it is moved to .recycle/Q1/report.docx. The recycle:versions parameter only adds version numbers when a file with the same name already exists in the repository, which is not the case here.

Answer

/srv/projects/.recycle/report.docx

Answer

/srv/projects/Q1/.recycle/report.docx

Answer

/srv/projects/.recycle/report.docx.1

Question 8

A DNS administrator is debugging why a BIND 9 secondary server for the zone corp.example.net is not receiving zone transfers from the primary. The primary's named.conf defines the zone with type master and allow-transfer { 10.20.30.40; };. The secondary's named.conf defines the zone with type slave and masters { 10.20.30.10; };. The administrator wants to verify the transfer path directly from the secondary host. (Choose two.)

Accepted Answer

rndc retransfer corp.example.net. An AXFR query sent straight to the primary verifies whether the primary permits the transfer, and rndc retransfer on the secondary forces an immediate fresh transfer attempt whose outcome shows whether the transfer completes. Together they test both ends of the path. SOA queries, zone-file validation, and local reloads do not exercise the AXFR exchange.

Answer

dig @10.20.30.10 corp.example.net SOA

Answer

named-checkzone corp.example.net /var/named/corp.example.net.zone

Answer

rndc reload corp.example.net

Question 9

A Debian-based Linux server runs SSH on TCP port 2222 with PermitRootLogin yes. The administrator notices thousands of failed authentications in /var/log/auth.log and wants an automated tool that reads that log file and inserts firewall rules to block offending source addresses. Which tool should the administrator deploy?

Accepted Answer

fail2ban. The requirement is automated log-driven reaction: read auth.log and block source addresses. fail2ban is purpose-built for this, pairing filters with jails and firewall actions. The other tools either inspect packets without log awareness, restrict authentication counts without blocking sources, or only report on events. Only a log-monitoring daemon that triggers firewall actions meets the described need.

Answer

iptables with the recent module loaded

Answer

logwatch with a custom reporting script

Answer

sshd with UsePAM and MaxAuthTries tightened

Question 10

A Linux server uses an nftables ruleset for its firewall. The administrator wants to log and drop packets arriving on the external interface eth0 that are new inbound TCP connections to port 22 from any address except 203.0.113.0/24. Which nftables rule added to a base chain with hook input and policy accept accomplishes this?

Accepted Answer

iifname "eth0" tcp dport 22 ip saddr != 203.0.113.0/24 ct state new log prefix "SSH-DENY " drop. The correct rule combines the inbound interface, destination port, negated trusted source, and a ct state new match, then logs and drops. Established traffic must be exempted via conntrack state to avoid breaking active sessions. Using the output interface, inverting the source match, or omitting the state qualifier all produce rules that either never match the intended traffic or disrupt legitimate connections.

Answer

iifname "eth0" tcp dport 22 ip saddr 203.0.113.0/24 ct state new log prefix "SSH-DENY " drop

Answer

oifname "eth0" tcp dport 22 ip saddr != 203.0.113.0/24 ct state new log prefix "SSH-DENY " drop

Answer

iifname "eth0" tcp dport 22 ip saddr != 203.0.113.0/24 log prefix "SSH-DENY " reject

Question 11

An administrator must ensure that a newly generated GPG key pair used to sign software packages keeps its private key protected by a passphrase and is stored in the user's default GnuPG home directory. Which command accomplishes this?

Accepted Answer

gpg --full-generate-key. Generating a passphrase-protected key pair interactively is done with gpg --full-generate-key, which walks through algorithm, size, expiration, identity, and passphrase entry, then stores the keys in the default GnuPG home. Exporting, listing, or batch-generating without a parameter file does not satisfy the passphrase and generation requirements together.

Answer

gpg --list-keys --with-fingerprint

Answer

gpg --export-secret-keys > secret.asc

Answer

gpg --gen-key --batch

Question 12

A Linux administrator is troubleshooting a server that takes an unusually long time to boot. The administrator suspects that a service unit is waiting for a network resource that is not available. Which systemd command will show the time each unit took to initialize during the last boot, helping identify the slowest unit?

Accepted Answer

systemd-analyze blame. systemd-analyze blame produces a sorted list of units by initialization time, making it the most direct way to identify a slow unit. The critical-chain view is useful for understanding the dependency path but does not enumerate every unit's duration. Listing running services or filtering error logs does not provide timing data, so blame is the correct tool for this troubleshooting step.

Answer

systemctl list-units --type=service --state=running

Answer

systemd-analyze critical-chain

Answer

journalctl -b -p err

Question 13

A Linux server with a custom-compiled kernel 5.10 and a matching initramfs fails to boot after the administrator added a new SCSI controller and moved the root filesystem to a disk attached to it. The kernel panics with 'VFS: Unable to mount root fs on unknown-block(0,0)'. The administrator confirms that the new controller driver was built as a module and is present in /lib/modules/5.10.0-custom/. Which action will most directly allow the initramfs to load the controller driver and mount the root filesystem?

Accepted Answer

Add the module name for the new SCSI controller to /etc/initramfs-tools/modules, then run 'update-initramfs -u -k 5.10.0-custom'.. The initramfs must contain the storage controller driver to access the root filesystem before the real root is mounted. On Debian-based systems, /etc/initramfs-tools/modules forces specific modules into the initramfs, and update-initramfs -u -k rebuilds it for that kernel. This directly addresses the missing driver that causes the VFS panic. Other actions either do not affect initramfs contents or only delay the inevitable failure.

Answer

Run 'depmod -a 5.10.0-custom' followed by 'mkinitramfs -o /boot/initrd.img-5.10.0-custom 5.10.0-custom'.

Answer

Add 'rootdelay=10' to the kernel command line in GRUB and reboot.

Answer

Run 'modprobe <controller_module>' on the running system and then reboot.

Question 14

A Linux server uses DHCP to obtain its IP address, but the administrator needs it to always receive the same address from the DHCP server. The server's MAC address is 00:1a:2b:3c:4d:5e and the DHCP server is ISC dhcpd. Which configuration should the administrator add to the DHCP server to ensure this?

Accepted Answer

host server1 { hardware ethernet 00:1a:2b:3c:4d:5e; fixed-address 192.168.1.50; }. To ensure a DHCP client always receives the same IP, the DHCP server must have a host declaration that maps the client's MAC address to a fixed IP using the fixed-address parameter. This is the correct method in ISC dhcpd. Other approaches like ranges or classes do not provide a guaranteed static assignment for a specific client.

Answer

class "server1" { match if substring(hardware,1,6) = 00:1a:2b:3c:4d:5e; }

Answer

subnet 192.168.1.0 netmask 255.255.255.0 { range 192.168.1.50 192.168.1.50; }

Answer

option fixed-address 192.168.1.50;

Question 15

A Linux server hosts an internal API that must accept TLS connections only from clients presenting a certificate signed by the organization's internal CA. The administrator has configured the server certificate and key. Which directive pair in the server's TLS configuration enforces client certificate verification against the internal CA?

Accepted Answer

SSLCACertificateFile pointing to the internal CA certificate, with SSLVerifyClient require. Mutual TLS requires two distinct pieces: a trust anchor for validating client certificates and a policy that makes client certificates mandatory. SSLCACertificateFile names the internal CA as the trust anchor, while SSLVerifyClient require makes presenting a valid certificate non-negotiable. The other combinations either supply the wrong file role, weaken verification, or omit the trust anchor entirely.

Answer

SSLCACertificateFile pointing to the internal CA certificate, with SSLVerifyClient optional_no_ca

Answer

SSLCertificateFile pointing to the internal CA certificate, with SSLVerifyClient require

Answer

SSLCertificateChainFile pointing to the internal CA certificate, with SSLVerifyDepth 1