LPIC-2 Practice Test 25 — 15 Questions

Question 1

A security auditor is reviewing a Linux server that uses SELinux in enforcing mode. The audit log shows numerous AVC denials for the httpd_t domain accessing files labeled with the default_t type. The administrator wants to allow httpd to read these files without disabling SELinux or changing the files' labels. Which action is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom SELinux policy module using audit2allow that permits httpd_t to read default_t files.. Creating a custom SELinux policy module with audit2allow is the correct approach because it grants the specific permission httpd_t needs to read default_t files without altering file labels or switching to permissive mode. This maintains enforcing mode and follows the principle of least privilege, addressing the AVC denials directly while adhering to the stated constraints.

Answer

Add the line 'allow httpd_t default_t:file read;' to /etc/selinux/targeted/contexts/files/file_contexts.

Answer

Run chcon -t httpd_sys_content_t on the files.

Answer

Set the httpd_t domain to permissive mode using semanage permissive -a httpd_t.

Question 2

A security team is auditing SSH access on a production server. The administrator must ensure that users in the group 'contractors' can authenticate only with an SSH key and never with a password, while all other users retain the existing password and key authentication methods. Which sshd_config directive accomplishes this?

Accepted Answer

Match Group contractors followed by PasswordAuthentication no. Conditional per-group authentication settings require a Match block, which scopes the directives that follow to connections matching the criteria. Placing PasswordAuthentication no inside Match Group contractors disables password logins for that group only, while the global default continues to permit both password and key authentication for all other accounts. Keyword ordering matters: the Match section must be the final part of the file.

Answer

AllowGroups contractors in the global section

Answer

DenyGroups contractors in the global section

Answer

AuthenticationMethods publickey,password applied globally

Question 3

A junior administrator needs to see which DNS servers a systemd-resolved client is actually using for a specific network interface. Which command displays the current per-link DNS configuration?

Accepted Answer

resolvectl status. systemd-resolved maintains per-link resolver state, and resolvectl status is the tool that reports it, listing DNS servers, search domains, and related flags for each interface. Restarting the service, validating a BIND file, or issuing a single query does not reveal the per-link server list, so only the status command answers the question directly.

Answer

systemctl restart systemd-resolved

Answer

dig @127.0.0.53 example.com

Answer

named-checkconf /etc/resolv.conf

Question 4

An administrator needs to configure a Linux client to authenticate users against an LDAP server. After installing the necessary packages, they edit /etc/ldap/ldap.conf and set the URI to ldap://ldap.example.com. However, when they run 'getent passwd testuser', the command returns no output. The server is reachable and testuser exists in the LDAP directory. Which of the following is the most likely cause?

Accepted Answer

The /etc/nsswitch.conf file does not include 'ldap' for the passwd database.. The correct answer is that /etc/nsswitch.conf must include 'ldap' for the passwd database. Without this entry, the system will not query LDAP for user information, resulting in no output from getent. Even if LDAP client configuration is correct, the NSS configuration determines which sources are used for name service lookups. This is a common oversight when setting up LDAP authentication.

Answer

The LDAP server requires TLS, but the URI uses ldap:// instead of ldaps://.

Answer

The LDAP client does not have a valid bind DN and password configured in /etc/ldap/ldap.conf.

Answer

The /etc/ldap/ldap.conf file should be /etc/openldap/ldap.conf on this system.

Question 5

A Linux server running a mainline distribution kernel has begun showing intermittent I/O errors on a SATA disk attached to an AHCI controller. The administrator suspects that a recently backported driver in the running kernel is at fault and wants to boot the system using the previous kernel version that is still installed, without modifying GRUB's default entry permanently. Which GRUB 2 feature should the administrator use at the boot menu to select the older kernel for this boot only?

Accepted Answer

At the GRUB menu, navigate to the 'Advanced options for <distro>' submenu and select the previous kernel version entry.. The Advanced options submenu in GRUB 2 exposes every installed kernel and its initramfs as separate entries. Choosing a previous kernel entry boots that kernel for the current boot only, which is ideal for testing whether a recent driver backport caused the I/O errors. Editing entries or changing the default would either alter persistent configuration or bypass the normal boot path, neither of which matches the one-time kernel selection requirement.

Answer

Press 'e' on the desired menu entry, then append 'init=/bin/bash' to the linux line and press Ctrl+X.

Answer

Press 'c' to enter the GRUB command line, then run 'linux /vmlinuz.old root=/dev/sda2' and 'boot'.

Answer

Run 'grub-set-default 1' from the running system and reboot.

Question 6

A Linux server is configured as a Samba file server. The administrator wants to ensure that user passwords are stored in a separate LDAP directory and that Samba uses that directory for authentication. The LDAP server supports the sambaSamAccount schema. Which TWO steps are required to integrate Samba with LDAP for authentication? (Choose two.)

Accepted Answer

Configure 'ldap admin dn' and 'ldap suffix' in smb.conf to allow Samba to write to LDAP.. Integrating Samba with LDAP for authentication requires setting the passdb backend to ldapsam and providing the necessary LDAP connection details, including an administrative DN and base suffix. These two steps allow Samba to store and retrieve password hashes in LDAP. Local password tools and winbind are not part of this direct integration; winbind is for domain membership, not for ldapsam backend operation.

Answer

Run 'smbpasswd -a username' to add each user to the local Samba password database.

Answer

Enable the 'obey pam restrictions' parameter to force Samba to use PAM for authentication.

Answer

Install and configure the winbind daemon to map LDAP users to local accounts.

Question 7

A Samba server is configured to share a directory that contains files with POSIX ACLs. A Windows client maps the share and attempts to modify permissions on a file. The Windows ACL editor shows only basic permissions and cannot display advanced permissions. Which Samba parameter, when set to yes, allows the Windows client to see and edit the full set of POSIX ACLs as Windows ACLs?

Accepted Answer

nt acl support = yes. The 'nt acl support' parameter is essential for Samba to expose POSIX ACLs as Windows ACLs. When enabled, Windows clients can view and modify the full ACL, including advanced permissions. The other parameters affect inheritance, DOS attributes, or execute permissions, but none of them enable the translation required for Windows ACL editing.

Answer

acl allow execute always = yes

Answer

inherit permissions = yes

Answer

map archive = yes

Question 8

A network administrator needs to set up a Linux router that forwards packets between two internal networks. The router has two interfaces: eth0 (192.168.1.1/24) and eth1 (10.0.0.1/24). After enabling IP forwarding, clients on 192.168.1.0/24 can reach 10.0.0.0/24, but clients on 10.0.0.0/24 cannot reach 192.168.1.0/24. What is the most likely cause?

Accepted Answer

The administrator forgot to add a route on the 10.0.0.0/24 clients pointing to 10.0.0.1 as the gateway.. For clients on 10.0.0.0/24 to reach 192.168.1.0/24, they must have a route to that network via the router at 10.0.0.1. Typically, this is done by setting a default gateway. If they lack this, they cannot send packets off their local subnet. The router's forwarding is already proven by the reverse traffic.

Answer

IP forwarding is not enabled on the router.

Answer

The router's firewall is blocking traffic from 10.0.0.0/24 to 192.168.1.0/24.

Answer

The subnet mask on eth1 is incorrect, causing the router to not recognize the 10.0.0.0/24 network.

Question 9

An administrator is troubleshooting a Samba server that is a member of an Active Directory domain. Users from the AD domain are unable to access a share that has 'valid users = @DOMAIN\staff' in its configuration. The administrator has verified that winbind is running and 'wbinfo -u' lists the domain users. Which action is most likely to resolve the access issue?

Accepted Answer

Ensure that the 'idmap config' lines in smb.conf define a range for the DOMAIN backend and that the domain SID is mapped.. When Samba is integrated with AD via winbind, it must map domain SIDs to local UIDs and GIDs using the idmap config parameters. If the domain's SID is not mapped, winbind may still list users, but group resolution for access checks fails. The valid users directive with @DOMAIN\staff requires that the group be resolved to a local GID. Proper idmap configuration ensures this mapping, allowing Samba to verify group membership and grant access.

Answer

Run 'net rpc join' again to rejoin the domain.

Answer

Set 'security = ads' and 'realm = DOMAIN.EXAMPLE.COM' in smb.conf.

Answer

Add 'winbind use default domain = yes' to smb.conf and restart Samba.

Question 10

A network administrator is configuring a Linux client to use an NIS server for user authentication. The NIS domain is set to 'example' and the server is at 192.168.1.10. After running 'ypbind' and editing /etc/nsswitch.conf to include 'nis' for passwd, shadow, and group, users still cannot log in. Which additional configuration is required to allow NIS authentication?

Accepted Answer

Set the NIS domain name with 'domainname example' or by editing /etc/defaultdomain.. The NIS client requires the system's NIS domainname to be set correctly. ypbind uses this domainname to locate and bind to the NIS server. Without it, ypbind cannot function, and NIS lookups fail, preventing logins. The domainname can be set with the domainname command or persistently in /etc/defaultdomain. Once set and ypbind restarted, NIS authentication should work if nsswitch.conf is properly configured.

Answer

Add the NIS server to /etc/hosts and set 'nis_server' in /etc/yp.conf.

Answer

Add 'nis' to the 'hosts' line in /etc/nsswitch.conf.

Answer

Start the 'ypserv' service on the client.

Question 11

A Linux administrator wants to prevent the system from loading a specific kernel module named 'floppy' at boot because it is not needed and causes delays. The module is currently loaded. Which command will add the module to the blacklist configuration so it is not automatically loaded on future boots?

Accepted Answer

echo 'blacklist floppy' >> /etc/modprobe.d/blacklist.conf. Blacklisting a module is done by adding a blacklist line in a .conf file under /etc/modprobe.d/. This prevents modprobe from loading the module when an alias request occurs, which is how udev and systemd trigger module loading at boot. Removing the module now or using systemd masking does not create the persistent configuration needed to stop automatic loading on subsequent boots.

Answer

systemctl mask floppy

Answer

modprobe -r floppy

Answer

echo 'install floppy /bin/false' >> /etc/modules

Question 12

A system administrator needs to modify the kernel command line for a system using GRUB 2 on a BIOS-based machine. The change should persist across reboots. Which file should be edited to add the parameter `quiet splash`?

Accepted Answer

/etc/default/grub. Persistent kernel command line changes in GRUB 2 are made by editing `/etc/default/grub`, specifically the `GRUB_CMDLINE_LINUX_DEFAULT` variable for default boot entries. After editing, `update-grub` regenerates `grub.cfg`. Directly editing `grub.cfg` or other files is not persistent or appropriate.

Answer

/boot/grub2/grubenv

Answer

/etc/grub.d/40_custom

Answer

/boot/grub/grub.cfg

Question 13

A Linux server uses a DHCP client to obtain its network configuration. The administrator wants to ensure that the DHCP client sends a specific hostname to the DHCP server. Which configuration file should be edited to set the hostname sent by the DHCP client?

Accepted Answer

/etc/dhcp/dhclient.conf. The ISC DHCP client, dhclient, reads its configuration from /etc/dhcp/dhclient.conf. To send a specific hostname to the DHCP server, the administrator should add a line such as 'send host-name "myhost";' in this file. Other files mentioned are either for the DHCP server or distribution-specific network configuration, not the generic DHCP client configuration.

Answer

/etc/sysconfig/network-scripts/ifcfg-eth0

Answer

/etc/dhcp/dhcpd.conf

Answer

/etc/network/interfaces

Question 14

A Linux server must establish a site-to-site IPsec tunnel to a remote peer using strongSwan. The administrator wants to use pre-shared key authentication and needs to define the connection parameters in ipsec.conf. Which configuration correctly specifies the local and remote subnets and the PSK-based authentication?

Accepted Answer

conn site-to-site
    left=192.0.2.1
    leftsubnet=10.1.0.0/24
    right=198.51.100.1
    rightsubnet=10.2.0.0/24
    authby=secret
    auto=start. strongSwan ipsec.conf conn blocks define left/right gateways, leftsubnet/rightsubnet traffic selectors, and authentication via authby. Pre-shared key authentication requires authby=secret with a matching entry in ipsec.secrets, and auto=start brings the tunnel up at service start. Using rsasig, auto=route, or forcing IKEv1 changes the authentication or activation behavior away from the stated requirement.

Answer

conn site-to-site
    left=192.0.2.1
    leftsubnet=10.1.0.0/24
    right=198.51.100.1
    rightsubnet=10.2.0.0/24
    authby=secret
    auto=route

Answer

conn site-to-site
    left=192.0.2.1
    leftsubnet=10.1.0.0/24
    right=198.51.100.1
    rightsubnet=10.2.0.0/24
    authby=rsasig
    auto=start

Answer

conn site-to-site
    left=192.0.2.1
    leftsubnet=10.1.0.0/24
    right=198.51.100.1
    rightsubnet=10.2.0.0/24
    authby=secret
    keyexchange=ikev1
    auto=start

Question 15

An administrator needs to assign the IPv6 address 2001:db8:1::10/64 with gateway 2001:db8:1::1 to interface eth0 on a server that uses systemd-networkd. Which configuration snippet in /etc/systemd/network/10-eth0.network achieves this?

Accepted Answer

[Match]
Name=eth0

[Network]
Address=2001:db8:1::10/64
Gateway=2001:db8:1::1. In systemd-networkd, interface matching is done in [Match] and addressing plus the default gateway are configured in [Network] using Address and Gateway. The prefix length is mandatory with Address, and Gateway works for both IPv4 and IPv6. Sections such as [Address], invalid keys such as Gateway6, and enabling DHCPv6 all deviate from the requested static configuration.

Answer

[Match]
Name=eth0

[Network]
Address=2001:db8:1::10/64
Gateway=2001:db8:1::1
DHCP=ipv6

Answer

[Match]
Name=eth0

[Network]
Address=2001:db8:1::10
Gateway6=2001:db8:1::1

Answer

[Match]
Name=eth0

[Address]
Address=2001:db8:1::10/64
Gateway=2001:db8:1::1