LPIC-2 Practice Test 1 — 25 Questions

Question 1

Arrange the steps to perform a disaster recovery from a full system backup using tar.

Accepted Answer

Boot into rescue mode, then prepare disks, then mount the root filesystem, then extract backup using tar, then reboot.. The correct sequence for disaster recovery from a full system backup using tar ensures a logical progression: first gain access to a recovery environment (rescue mode), then prepare the storage devices, mount the target filesystem, restore the data from the backup archive, and finally reboot to the restored system. Any deviation leads to errors such as missing filesystem or incomplete restoration.

Answer

Boot into rescue mode, then mount the root filesystem, then prepare disks, then extract backup using tar, then reboot.

Answer

Boot into rescue mode, then prepare disks, then extract backup using tar, then mount the root filesystem, then reboot.

Answer

Boot into rescue mode, then prepare disks, then mount the root filesystem, then reboot, then extract backup using tar.

Question 2

Which TWO of the following commands can be used to list currently loaded kernel modules? (Choose two.)

Accepted Answer

cat /proc/modules. `/proc/modules` is a virtual file maintained by the kernel that lists all currently loaded kernel modules, including their size, usage count, and dependent modules. Reading this file provides a real-time snapshot of the kernel's module state. Option E is correct because `lsmod` is a user-space utility that parses `/proc/modules` and formats the output in a human-readable table, making it the standard command for listing loaded modules.

Answer

modinfo -l

Answer

ls /lib/modules/$(uname -r)

Answer

depmod -e

Question 3

A company has multiple subnets and wants to implement policy-based routing to direct traffic from a specific development subnet (192.168.10.0/24) through a specialized firewall for content filtering, while all other traffic uses the default gateway. Which of the following steps is required to achieve this using iproute2 tools?

Accepted Answer

Create a new routing table (e.g., table 100), add a default route via the firewall in that table, and add an ip rule to use table 100 for traffic from 192.168.10.0/24.. Policy-based routing (PBR) with iproute2 requires creating a separate routing table, adding a default route via the firewall in that table, and then using an ip rule to match traffic from the source subnet (192.168.10.0/24) and direct it to that custom table. This allows traffic from the development subnet to follow a different path than the default gateway, while all other traffic continues to use the main routing table.

Answer

Use iptables to mark packets from the development subnet and then use ip rule to use the main table for marked packets.

Answer

Add an ip rule to route traffic from 192.168.10.0/24 to the firewall without creating a new table.

Answer

Add a static route to the main routing table for 192.168.10.0/24 pointing to the firewall.

Question 4

A company uses BIND9 as the authoritative name server for its public zone example.com. External users report that they cannot resolve the MX record for the domain, but internal users can. What is the most likely cause?

Accepted Answer

The allow-query ACL restricts queries to the internal network.. The allow-query ACL in BIND9 restricts which source IP addresses are permitted to send queries to the server. If it is set to allow only the internal network (e.g., 192.168.0.0/16), external users' queries are rejected, causing resolution failures for MX records and all other records. Internal users succeed because their IPs match the ACL, while external users receive a REFUSED response or no answer.

Answer

The zone file lacks an MX record.

Answer

The server is behind a firewall that blocks UDP port 53.

Answer

The recursion is set to no.

Question 5

An administrator needs to prioritize traffic for a VoIP application over other traffic on a Linux router. Which tool should be used to implement traffic shaping and prioritization?

Accepted Answer

tc (traffic control). B is correct because the `tc` (traffic control) command is the standard Linux utility for traffic shaping, prioritization, and bandwidth management. It operates at the kernel's QoS layer, allowing the administrator to define queuing disciplines (qdiscs) such as HTB or PRIO to prioritize VoIP packets based on classification rules, ensuring low latency for real-time traffic.

Answer

ip route with priority

Answer

tcpdump with filters

Answer

iptables with the mangle table

Question 6

An administrator wants to restrict access to a service using PAM. Which file order determines the authentication flow for a service?

Accepted Answer

/etc/pam.d/<service-name>. PAM (Pluggable Authentication Modules) uses per-service configuration files located in /etc/pam.d/ to define the authentication flow. When a service (e.g., sshd, login) calls PAM, it reads the file named after the service (e.g., /etc/pam.d/sshd) to determine the order of modules (auth, account, password, session) and their control flags (required, requisite, sufficient, optional). This file-based approach allows fine-grained, service-specific authentication policies.

Answer

/etc/nsswitch.conf

Answer

/etc/security/access.conf

Answer

/etc/pam.conf

Question 7

Arrange the steps to configure a Linux system as a DNS server using BIND.

Accepted Answer

Install BIND, define the zone in named.conf, create zone file, check configuration syntax, restart named service, test resolution. After installing BIND, define the zone, create zone file, check syntax, then restart and test.

Answer

Define zone, create zone file, check syntax, install BIND, restart and test

Answer

Install BIND, create zone file, define zone, check syntax, restart and test

Answer

Install BIND, define zone, check syntax, create zone file, restart and test

Question 8

Which TWO commands can be used to rebuild the initramfs on modern Linux systems? (Choose two.)

Accepted Answer

dracut -f. `dracut -f` forces the regeneration of the initramfs on modern Red Hat–based distributions (e.g., RHEL, CentOS, Fedora). Option C is correct because `update-initramfs -u` updates the initramfs on Debian/Ubuntu systems by rebuilding the current kernel's initramfs image. Both commands are the standard tools for rebuilding the initial RAM filesystem on their respective distributions.

Answer

mkinitrd

Answer

grub-mkconfig

Answer

mkinitramfs

Question 9

A new network card driver module is not being loaded at boot. The administrator wants to ensure the module is loaded automatically without modifying the kernel command line. Which file should be used?

Accepted Answer

/etc/modules-load.d/.conf. /etc/modules-load.d/.conf is the standard configuration directory used by systemd-modules-load.service to load kernel modules at boot without modifying the kernel command line. Files in this directory list module names (one per line) that are loaded automatically during early boot, making it the proper mechanism for ensuring a network card driver module is loaded.

Answer

/lib/modules/$(uname -r)/modules.builtin

Answer

/etc/modprobe.d/<name>.conf

Answer

/etc/rc.local

Question 10

After upgrading the kernel on a Red Hat Enterprise Linux system, the system fails to boot because the initramfs is missing. Which command can be used to regenerate the initramfs?

Accepted Answer

dracut -f. On Red Hat Enterprise Linux (RHEL) systems, the `dracut` utility is the standard tool for creating and regenerating initial RAM filesystem images (initramfs). The `-f` (force) option overwrites an existing initramfs file, which is necessary after a kernel upgrade to ensure the new kernel has the correct drivers and modules to mount the root filesystem during boot. Without a valid initramfs, the kernel cannot access the root filesystem, causing a boot failure.

Answer

mkinitrd -f

Answer

grub2-mkconfig -o /boot/grub2/grub.cfg

Answer

mkinitramfs -o /boot/initrd.img

Question 11

The administrator wants to create a RAID 1 array using /dev/sdb1 and /dev/sdc1, then create a filesystem and mount it at /mnt/raid1. Which command sequence should be used first?

Accepted Answer

mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1. The first step in creating a RAID 1 array is to assemble the underlying block devices into a RAID device using mdadm. The command `mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1` initializes the RAID metadata and creates the array at /dev/md0. Only after the array is created can a filesystem be built on it and then mounted.

Answer

mkfs.ext4 /dev/md0

Answer

pvcreate /dev/sdb1 /dev/sdc1

Answer

fdisk /dev/sdb && fdisk /dev/sdc

Question 12

A company runs a critical database server on a Linux system. The server is subject to a strict compliance policy that requires all commands executed by the database administrator (user 'dbadmin') to be logged. Additionally, any attempt to change the system time must be logged regardless of the user. The administrator has configured auditd and added the following rules: -w /usr/bin -p x -k binary_exec, -a always,exit -F arch=b64 -S adjtimex -F key=time_change. However, during a compliance audit, it is discovered that not all commands executed by dbadmin are being logged. Which of the following is the most likely cause?

Accepted Answer

The rule -w /usr/bin -p x only monitors executables in /usr/bin, not commands in other directories or built-in shell commands.. The rule `-w /usr/bin -p x` only monitors execution of binaries located in `/usr/bin`. Commands executed from other directories (e.g., `/usr/local/bin`, `/opt`, or built-in shell commands like `cd` or `alias`) are not captured. Additionally, the rule does not log commands run via absolute paths outside `/usr/bin` or scripts executed by interpreters, leaving gaps in the audit trail for dbadmin's activities.

Answer

The auditd logs are being overwritten because the audit log file size is too small.

Answer

The auditd service is not running because the kernel was not compiled with audit support.

Answer

The adjtimex syscall rule is incorrect and prevents other rules from being processed.

Question 13

An administrator creates a new XFS filesystem on /dev/vg/data and needs to mount it at /data with noatime and a stripe unit of 1 MiB. Which /etc/fstab entry is correct?

Accepted Answer

/dev/vg/data /data xfs defaults,noatime,sunit=2048 0 0. The `sunit` mount option specifies the stripe unit in 512-byte blocks. A stripe unit of 1 MiB equals 2048 blocks (1 MiB = 1024 KiB = 2048 * 512 bytes). The `noatime` option disables access time updates. This entry correctly mounts the XFS filesystem at /data with the required parameters.

Answer

/dev/vg/data /data xfs defaults,noatime,swidth=2048 0 0

Answer

/dev/vg/data /data xfs defaults,noatime,allocsize=1m 0 0

Answer

/dev/vg/data /data xfs defaults,noatime,sunit=1024 0 0

Question 14

A company has a Linux client running Ubuntu 20.04 that is used by multiple developers. The client has two network interfaces: eth0 (connected to the corporate network with DHCP) and eth1 (connected to a test lab with static IP 192.168.100.10/24). The client needs to access both the internet (via eth0) and the lab network (192.168.100.0/24). The default gateway is 10.0.0.1 on eth0. The lab network has a server at 192.168.100.50 that provides DHCP for the lab devices, but the client's eth1 is statically configured. Recently, the client cannot reach the lab server at 192.168.100.50. The administrator checks the routing table and sees:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.0.1        0.0.0.0         UG    100    0        0 eth0
10.0.0.0        0.0.0.0         255.255.255.0   U     100    0        0 eth0
192.168.100.0   0.0.0.0         255.255.255.0   U     100    0        0 eth1

The administrator can ping 192.168.100.50 from the client. However, the lab server cannot ping the client. What is the most likely cause?

Accepted Answer

The client's firewall is blocking incoming ICMP echo requests.. The client can ping the lab server (192.168.100.50), proving that outbound traffic from the client to the lab network works correctly. However, the lab server cannot ping the client, which indicates that either the return traffic is blocked or the client does not have a route back to the server. Since the client's routing table shows a direct route to 192.168.100.0/24 via eth1, the issue is not a missing route; instead, the most likely cause is that the client's firewall (e.g., iptables or ufw) is blocking incoming ICMP Echo Requests (ping) on eth1, while allowing outbound traffic.

Answer

The lab server's default gateway is misconfigured.

Answer

The client has no route to the lab subnet.

Answer

The client's default gateway is misconfigured.

Question 15

Which two of the following are valid methods to pass kernel parameters during the boot process? (Choose two.)

Accepted Answer

Edit /boot/grub/grub.cfg and append parameters to the 'linux' line. Editing /boot/grub/grub.cfg to append parameters to the 'linux' line directly modifies the kernel command line that GRUB 2 passes to the Linux kernel at boot. This is a standard method for permanently adding kernel parameters like 'quiet' or 'nomodeset'.

Answer

Use the 'initrd' command in GRUB

Answer

Write the parameter directly to /proc/cmdline

Answer

Set the parameter in /etc/sysctl.conf

Question 16

Which TWO commands can be used to display the current IP address and netmask of network interfaces on a Linux system?

Accepted Answer

ifconfig. Option B (ifconfig) is correct because the legacy net-tools command ifconfig, when run without arguments, prints each network interface's inet address and netmask (e.g., inet 192.168.1.10 netmask 255.255.255.0). Option C (ip addr show) is correct because the modern iproute2 command ip addr show (equivalently ip a) displays each interface's inet/inet6 addresses with their prefix length, which represents the netmask. Option A (arp -a) only lists the ARP cache mapping IP addresses to MAC addresses, not interface addresses or netmasks. Option D (netstat -i) shows interface statistics and flags but not IP addresses or netmasks. Option E (route -n) displays the kernel routing table in numeric form, not the addresses and netmasks assigned to interfaces.

Answer

arp -a

Answer

netstat -i

Answer

route -n

Question 17

A filesystem created with mkfs.ext4 on /dev/sda1 has a reserved block count of 5%. How can the administrator reduce it to 1% without reformatting?

Accepted Answer

tune2fs -m 1 /dev/sda1. The `-m` option of tune2fs sets the reserved block percentage for the filesystem. Since the question asks to reduce the reserved block count from 5% to 1% without reformatting, `tune2fs -m 1 /dev/sda1` correctly adjusts the reserved blocks percentage to 1% on the existing ext4 filesystem.

Answer

tune2fs -r 1 /dev/sda1

Answer

dumpe2fs -r 1 /dev/sda1

Answer

resize2fs -r 1 /dev/sda1

Question 18

An AppArmor profile for a database server is too restrictive and denies legitimate queries. The administrator wants to learn the required accesses by running the application in complain mode. Which command puts the profile into complain mode?

Accepted Answer

aa-complain /etc/apparmor.d/usr.sbin.mysqld. The `aa-complain` command places an AppArmor profile into complain mode, where policy violations are logged but not blocked. This allows the administrator to run the database server and observe which accesses are denied, then use the logs to update the profile with the required permissions. The correct syntax is `aa-complain /etc/apparmor.d/usr.sbin.mysqld` to target the specific profile file.

Answer

aa-disable /etc/apparmor.d/usr.sbin.mysqld

Answer

aa-enforce /etc/apparmor.d/usr.sbin.mysqld

Answer

aa-log /etc/apparmor.d/usr.sbin.mysqld

Question 19

An administrator wants to ensure a kernel module is loaded automatically at boot for a hardware device. Which file should be modified to add the module name?

Accepted Answer

/etc/modules-load.d/. The `/etc/modules-load.d/` directory contains configuration files that list kernel module names to be loaded automatically at boot by the `systemd-modules-load.service`. This is the standard mechanism in modern Linux distributions using systemd to ensure specific modules are loaded early in the boot process, before udev or other services handle device detection.

Answer

/etc/modprobe.d/blacklist.conf

Answer

/etc/udev/rules.d/

Answer

/proc/sys/kernel/

Question 20

A Samba server is configured as above. Users alice and bob have local system accounts but neither can connect to the share. What is the most likely cause?

Accepted Answer

The users have not been added to the Samba password database.. Samba maintains its own password database separate from the local system accounts. Even though alice and bob have valid local UNIX accounts, they must also be added to the Samba password database using `smbpasswd -a` or `pdbedit -a` before they can authenticate to any Samba share. Without this step, Samba will reject their connection attempts regardless of share permissions or path validity.

Answer

The share path /srv/share does not exist or has incorrect permissions.

Answer

The parameter 'read only = no' is misspelled; it should be 'writable = yes'.

Answer

The valid users list must use group names with '@' prefix, not individual names.