LPIC-2 Practice Test 25 — 15 Questions

Question 1

A security analyst notices that an /etc/pam.d/common-auth file contains the line 'auth required pam_tally2.so deny=5'. What is the effect?

Accepted Answer

Account lockout after 5 failed login attempts. The `pam_tally2.so` module tracks login attempts and, when used with `deny=5`, locks the account after five consecutive failed authentication attempts. The `required` control ensures that if the tally threshold is exceeded, authentication fails immediately, preventing further access until the count is reset by an administrator or via `pam_tally2` reset.

Answer

Log failed attempts only

Answer

Password expiration after 5 days

Answer

Maximum 5 concurrent sessions

Question 2

After installing a new kernel, the system administrator notices that the system boots to the old kernel by default. Which command should be used to update the GRUB configuration to boot the new kernel?

Accepted Answer

update-grub. The `update-grub` command (which is a wrapper for `grub-mkconfig -o /boot/grub/grub.cfg`) scans the installed kernels and regenerates the GRUB configuration file, automatically setting the newest kernel as the default boot entry. This ensures the system boots the newly installed kernel on the next reboot.

Answer

grub-install

Answer

mkinitrd

Answer

grub-set-default

Question 3

Arrange the steps to configure a Linux system as an Apache virtual host.

Accepted Answer

1. Create document root, 2. Create site configuration, 3. Enable the site, 4. Reload Apache, 5. Test. The correct order to configure an Apache virtual host is: first, create the document root directory with appropriate permissions; second, create a site configuration file in /etc/apache2/sites-available/; third, enable the site using a2ensite; fourth, reload Apache with systemctl reload apache2; fifth, test by accessing the site. Option A follows this sequence. Option B is incorrect because the site configuration must be created before enabling. Option C is incorrect because enabling occurs after configuration creation. Option D is incorrect because reloading must happen after enabling.

Answer

1. Create site configuration, 2. Create document root, 3. Enable the site, 4. Reload Apache, 5. Test

Answer

1. Create document root, 2. Enable the site, 3. Create site configuration, 4. Reload Apache, 5. Test

Answer

1. Create document root, 2. Create site configuration, 3. Reload Apache, 4. Enable the site, 5. Test

Question 4

An administrator wants to configure a virtual IP address on interface eth0 with IP 192.168.1.100/24. Which command correctly adds the virtual IP as an alias?

Accepted Answer

ip addr add 192.168.1.100/24 dev eth0:0. The `ip addr add` command with `dev eth0:0` directly assigns the IP address to the virtual interface `eth0:0`, which is the standard method in the `iproute2` suite for creating an alias. The `ip` command does not use an `alias` keyword; instead, the device name itself (e.g., `eth0:0`) defines the alias. This approach is consistent with modern Linux networking, replacing the deprecated `ifconfig` method.

Answer

ip addr add 192.168.1.100/24 dev eth0 alias eth0:0

Answer

ip addr add 192.168.1.100/24 dev eth0 label eth0:0

Answer

ifconfig eth0:0 192.168.1.100 netmask 255.255.255.0

Question 5

A system administrator is responsible for a production server running a custom-compiled Linux kernel version 5.15. After a routine update of the kernel source and recompilation, the server fails to boot. The error message on the console is: 'Kernel panic - not syncing: No working init found. Try passing init= option to kernel.' The administrator verifies that the root filesystem is intact by booting from a live USB and mounting the root partition. The filesystem contains the usual /sbin/init (symlinked to systemd). The administrator also checks the boot loader configuration and sees that the kernel command line includes 'root=/dev/sda1 ro'. The init binary exists and is executable. Which of the following is the most likely cause of this boot failure?

Accepted Answer

The boot loader's 'initrd' directive is missing or points to a non-existent file. The error 'No working init found' indicates the kernel successfully mounted the root filesystem but could not execute the init binary. Since the administrator confirmed the init binary exists and is executable on the root partition, the most likely cause is that the kernel did not have access to the necessary drivers or modules to properly access the root filesystem at boot time. The missing or misconfigured initrd (initial RAM disk) directive means the kernel lacks the temporary root filesystem containing essential modules (e.g., storage controller drivers) needed to mount the real root filesystem, leading to the kernel falling back to a failed init search.

Answer

The kernel was compiled without support for the ext4 filesystem

Answer

The init binary is missing or corrupted

Answer

The root filesystem is corrupted and cannot be mounted properly

Question 6

Which TWO commands can be used to display the current IP address and netmask of network interfaces on a Linux system?

Accepted Answer

ifconfig. Both `ifconfig` and `ip addr show` can display the current IP address and netmask assigned to network interfaces. `ifconfig` is a legacy tool from the net-tools package that shows IPv4 addresses and netmasks (e.g., `inet 192.168.1.10 netmask 255.255.255.0`). `ip addr show` is the modern replacement from the iproute2 package, providing detailed IPv4 and IPv6 addressing information, including netmask in CIDR notation (e.g., `192.168.1.10/24`).

Answer

arp -a

Answer

netstat -i

Answer

route -n

Question 7

Which TWO statements about VLAN tagging are correct?

Accepted Answer

Untagged frames on a trunk port are typically assigned to the native VLAN. On a trunk port, frames that do not carry a VLAN tag are considered to belong to the native VLAN. The switch forwards these untagged frames as part of the native VLAN, which is typically VLAN 1 by default but can be configured to any VLAN. This behavior is defined in IEEE 802.1Q and is essential for interoperability with devices that do not support VLAN tagging.

Answer

VLAN tagging can only be used with Ethernet

Answer

VLAN tags are always 12 bits

Answer

VLAN tags are added by the switch, not the host

Question 8

A server with a custom kernel fails to boot after a kernel update. The system displays a kernel panic: 'VFS: Unable to mount root fs on unknown-block(0,0)'. The root filesystem is on an LVM volume. What is the most likely cause?

Accepted Answer

The initramfs is missing LVM support.. The kernel panic 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate the root filesystem. Since the root filesystem resides on an LVM volume, the initramfs must contain LVM tools and modules to activate the volume group and logical volumes before the kernel can mount the root. If the initramfs was not rebuilt after the kernel update, it will lack LVM support, causing the boot failure.

Answer

The GRUB configuration is pointing to the wrong kernel partition.

Answer

The kernel does not have the necessary device drivers compiled in.

Answer

The root filesystem is formatted with an unsupported filesystem.

Question 9

Which TWO files are commonly used by Samba for configuration and user authentication? (Choose two.)

Accepted Answer

/etc/samba/smbpasswd. `/etc/samba/smbpasswd` is the traditional Samba password file used for user authentication in Samba's own encrypted password format (LM/NT hashes). Option E is correct because `/etc/samba/smb.conf` is the primary Samba configuration file that defines shares, global settings, and security parameters. Both files are essential for Samba's operation: `smb.conf` controls the server behavior, while `smbpasswd` stores user credentials for SMB/CIFS authentication.

Answer

/etc/samba/smbusers

Answer

/etc/passwd

Answer

/etc/hosts.allow

Question 10

A Linux server requires several VLAN interfaces on eth0. The network switch expects 802.1Q tagged frames for VLAN 10. Which command correctly creates the VLAN interface?

Accepted Answer

ip link add link eth0 name eth0.10 type vlan id 10. The `ip link` command with the `type vlan id 10` parameter creates a VLAN subinterface on eth0 that tags outgoing frames with VLAN 10 using the 802.1Q standard. This is the modern, recommended method for VLAN interface creation on Linux, replacing legacy tools like `vconfig`.

Answer

modprobe 8021q; ifconfig eth0 up

Answer

vconfig add eth0 10

Answer

ifconfig eth0:10 192.168.10.1/24 up

Question 11

Given the mount options shown, which of the following events will cause the NFS mount to become unresponsive (hang)?

Accepted Answer

The NFS server reboots.. When the NFS server reboots, the client's TCP connection to the server is broken. With the `hard` mount option (default), the client will retry indefinitely until the server comes back online, causing all processes accessing the mount to hang (become unresponsive). The `intr` option (if not set) prevents interruption by signals, making the hang persistent until the server responds.

Answer

The network becomes saturated.

Answer

The client runs out of disk space on /mnt/data.

Answer

The /mnt/data directory is deleted locally.

Question 12

You are a systems administrator for a company that runs a critical web server on a Linux system. The server has been running stably for months, but after a recent kernel update from version 5.10.0-8 to 5.10.0-9, the server fails to boot. The boot process starts, but after the kernel loads, the system hangs with no output on the console. You have physical access to the server and can interrupt the boot process. The server uses GRUB 2 as the bootloader and the root filesystem is on an LVM logical volume. The previous kernel (5.10.0-8) is still present in /boot. Which of the following is the best course of action to restore the server to a working state?

Accepted Answer

Interrupt the boot process at GRUB, select the advanced options, and boot the old kernel 5.10.0-8.. The server fails to boot after a kernel update, but the previous kernel is still present in /boot. By interrupting GRUB 2 at boot, selecting 'Advanced options for Ubuntu' (or similar), and booting the old kernel 5.10.0-8, you bypass the problematic new kernel without modifying the bootloader or filesystem. This is the fastest, least invasive recovery method because GRUB 2 automatically detects and lists all installed kernels in /boot, including the previous one.

Answer

Reinstall GRUB from a live CD to fix the bootloader configuration.

Answer

Boot from a live CD, chroot into the system, and reinstall the new kernel package.

Answer

Boot from a live CD, chroot into the system, and rebuild the initrd for the new kernel.

Question 13

A company uses NIS for user authentication. A client cannot log in with network accounts but local accounts work. Which command should be used to check if the client is bound to the NIS domain?

Accepted Answer

ypwhich. The `ypwhich` command is used to display the NIS server to which the client is currently bound. If the client is not bound to any NIS domain, `ypwhich` returns an error, confirming the binding issue. This directly checks the NIS client-server binding, which is essential for network authentication.

Answer

ypset

Answer

ypcat passwd

Answer

domainname

Question 14

An administrator is configuring a BIND 9 DNS server to support DNSSEC for the zone 'example.com'. The zone is signed using the NSEC3 algorithm. Which TWO statements are correct regarding the configuration and operation of NSEC3?

Accepted Answer

The NSEC3 record uses the 'opt-out' flag to allow insecure delegations to exist without being covered by NSEC3 records.. The NSEC3 specification (RFC 5155) includes an 'opt-out' flag that allows insecure delegations (i.e., delegations that are not signed with DNSSEC) to exist in a zone without requiring corresponding NSEC3 records. This prevents the zone from being forced to cover every possible owner name, reducing the size of the signed zone and improving performance when many unsigned delegations are present.

Answer

NSEC3 records are stored in the zone in plain text order to allow efficient denial of existence.

Answer

The NSEC3 record type is NXT and is used to provide authenticated denial of existence.

Answer

NSEC3 uses SHA-256 as the default hash algorithm.

Question 15

An administrator needs to configure a Linux client to automatically obtain an IP address from a DHCP server but also ensure that the client uses a specific static DNS server (8.8.8.8) regardless of the DHCP-provided DNS. Which configuration should be applied?

Accepted Answer

Add 'supersede domain-name-servers 8.8.8.8;' to /etc/dhcp/dhclient.conf. The `supersede` directive in `/etc/dhcp/dhclient.conf` forces the DHCP client to replace any DNS server addresses received from the DHCP server with the specified value (8.8.8.8). This ensures the client uses the static DNS server regardless of what the DHCP server offers, while still obtaining its IP address dynamically.

Answer

Add 'append domain-name-servers 8.8.8.8;' to /etc/dhcp/dhclient.conf

Answer

Edit /etc/sysconfig/network-scripts/ifcfg-eth0 and set PEERDNS=no and DNS1=8.8.8.8

Answer

Add 'prepend domain-name-servers 8.8.8.8;' to /etc/dhcp/dhclient.conf