LPIC-2 Practice Test 3 — 25 Questions

Question 1

Which protocol does Samba implement to provide file sharing services to Windows clients?

Accepted Answer

SMB. Samba implements the SMB (Server Message Block) protocol, specifically the CIFS variant, to provide file and printer sharing services to Windows clients. SMB operates over TCP port 445 (direct hosting) or NetBIOS over TCP/IP (ports 137-139), enabling cross-platform file access in mixed Linux/Windows environments.

Answer

HTTP

Answer

AFP

Answer

NFS

Question 2

An administrator notices that clients are unable to obtain IP addresses from the DHCP server. The server logs show 'no free leases' error. What is the most likely cause?

Accepted Answer

The DHCP server's address range is exhausted.. The 'no free leases' error indicates that the DHCP server has exhausted all available IP addresses in its configured pool. This occurs when the address range defined in the dhcpd.conf file has been fully allocated to clients and no leases are available for new requests. The server logs confirm this specific condition, making address exhaustion the most likely cause.

Answer

The DHCP server's subnet declaration does not match the client's network.

Answer

The dhcpd.conf file has invalid syntax.

Answer

The DHCP relay agent is misconfigured.

Question 3

A client mounts the export with 'mount -t nfs server:/data /mnt/data' and root on the client can write files. Which option in /etc/exports allows root to retain its privileges?

Accepted Answer

no_root_squash. (no_root_squash) is correct because it prevents the NFS server from mapping the client's root user (UID 0) to the anonymous 'nobody' user. By default, NFS exports use root_squash, which maps root to an unprivileged user for security. With no_root_squash, the client's root retains UID 0 on the server, allowing write access to files owned by root on the export.

Answer

root_squash

Answer

rw

Answer

async

Question 4

Which TWO are true about the autofs automounter configuration? (Choose two.)

Accepted Answer

The master configuration file is /etc/auto.master.. Option C is correct because /etc/auto.master is indeed the master configuration file for autofs; it lists mount points along with the map files that define the individual mounts, and it is the primary file the automounter reads. Option E is correct because direct maps allow autofs to manage mount points at arbitrary absolute paths that do not fall under a single parent directory such as /net or /home, unlike indirect maps which require a common base directory. Option A is incorrect because autofs mounts are typically unmounted automatically after a timeout period of inactivity, not kept indefinitely. Option B is incorrect because autofs uses its own map files (such as /etc/auto.master and associated maps) rather than /etc/fstab to define automount points. Option D is incorrect because autofs supports many filesystem types beyond NFS, including local filesystems, CIFS/SMB, and others.

Answer

Autofs mounts remain indefinitely once accessed.

Answer

Autofs uses /etc/fstab to define automount points.

Answer

Autofs can only be used with NFS filesystems.

Question 5

Which legacy SMB protocol version should be disabled for security best practices on a modern Samba server?

Accepted Answer

SMB1. SMB1 (also known as CIFS) is a legacy protocol that lacks modern security features such as pre-authentication integrity, encryption, and secure dialect negotiation. It is notoriously vulnerable to attacks like EternalBlue and SMB relay, and disabling it is a fundamental security best practice on any modern Samba server. Samba allows disabling SMB1 via the 'server min protocol = SMB2' or 'ntlm auth = no' directives in smb.conf.

Answer

SMB2_02

Answer

SMB3

Answer

SMB2

Question 6

A company has a Linux server with two network interfaces: eth0 connected to the internal 192.168.1.0/24 network, and eth1 connected to the internet via a public IP of 203.0.113.10. The server runs a web server on port 80 and needs to allow internal clients to access the internet while hiding their private IPs (MASQUERADE). Additionally, external users should be able to reach the web server using the public IP. The administrator has enabled IP forwarding and configured iptables with the following rules:

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

However, internal clients can access the internet, but external users cannot reach the web server. What should the administrator do to fix the issue?

Accepted Answer

Add a DNAT rule in the PREROUTING chain of the nat table to translate destination 203.0.113.10:80 to 192.168.1.100:80.. The current iptables rules perform SNAT/MASQUERADE for outbound traffic and allow forwarding of related/established inbound traffic, but they do not redirect incoming connections destined for the public IP (203.0.113.10:80) to the internal web server (e.g., 192.168.1.100:80). A DNAT rule in the PREROUTING chain of the nat table is required to translate the destination address and port, so that external packets are forwarded to the internal server and the response traffic is handled by the existing MASQUERADE rule.

Answer

Add a FORWARD rule to allow new connections from eth1 to eth0.

Answer

Add a rule in the INPUT chain to accept traffic on port 80.

Answer

Change the MASQUERADE rule to SNAT with the public IP.

Question 7

Refer to the exhibit. What is the effect of this sudoers configuration?

Accepted Answer

Users alice and bob can run apt-get and dpkg on any host as root, requiring a password.. The sudoers configuration specifies that users alice and bob are allowed to run only the commands /usr/bin/apt-get and /usr/bin/dpkg as root on any host (ALL). The absence of the NOPASSWD tag means that a password is required for these commands. The syntax 'alice,bob ALL=(root) /usr/bin/apt-get, /usr/bin/dpkg' restricts the command set and requires authentication.

Answer

Users alice and bob can run any software command on the localhost only.

Answer

Members of ADMINS can run any command as root on any host.

Answer

Users alice and bob can run apt-get and dpkg without a password.

Question 8

A database server experiences performance degradation. Analysis shows high I/O wait on a LVM logical volume that uses striping across two physical volumes. What is the most effective way to improve performance?

Accepted Answer

Add a cache layer using lvmcache on a fast SSD. Adding a cache layer using lvmcache on a fast SSD is the most effective way to reduce high I/O wait because it places frequently accessed (hot) data on the faster SSD while keeping the bulk of data on the slower striped HDDs. This directly addresses the I/O bottleneck without requiring data migration or downtime, and it leverages the existing striped layout for sequential throughput while improving latency for random reads/writes.

Answer

Increase the stripe size and recreate the LV

Answer

Add an additional PV to the VG and extend the LV

Answer

Convert the LV to use linear mapping instead of striping

Question 9

An administrator wants to drop incoming TCP packets on port 22 from IP 10.0.0.5 using iptables. Which command is correct?

Accepted Answer

iptables -A INPUT -s 10.0.0.5 -p tcp --dport 22 -j DROP. It adds a rule to the INPUT chain, which processes packets destined for the local system. The `-s 10.0.0.5` flag specifies the source IP address, `-p tcp --dport 22` matches TCP packets destined for port 22 (SSH), and `-j DROP` silently discards matching packets. This configuration drops incoming SSH traffic from the specified host before it reaches any local service.

Answer

iptables -A INPUT -d 10.0.0.5 -p tcp --dport 22 -j DROP

Answer

iptables -A FORWARD -s 10.0.0.5 -p tcp --dport 22 -j DROP

Answer

iptables -A OUTPUT -s 10.0.0.5 -p tcp --dport 22 -j DROP

Question 10

Which TWO statements about VLAN tagging are correct?

Accepted Answer

Untagged frames on a trunk port are typically assigned to the native VLAN. On a trunk port, frames that do not carry a VLAN tag are considered to belong to the native VLAN. The switch forwards these untagged frames as part of the native VLAN, which is typically VLAN 1 by default but can be configured to any VLAN. This behavior is defined in IEEE 802.1Q and is essential for interoperability with devices that do not support VLAN tagging.

Answer

VLAN tagging can only be used with Ethernet

Answer

VLAN tags are always 12 bits

Answer

VLAN tags are added by the switch, not the host

Question 11

A developer compiled a custom kernel, installed it, but the system hangs before init starts. The previous kernel works. Which step was most likely missed?

Accepted Answer

Not rebuilding initramfs. When a custom kernel is compiled and installed, the initramfs must be rebuilt to include the necessary kernel modules for mounting the root filesystem at boot. If the initramfs is not regenerated, the kernel may lack critical drivers (e.g., for storage controllers or filesystems), causing the system to hang before init starts because it cannot access the root device. The previous kernel works because its initramfs was built with the correct modules for that kernel version.

Answer

Not updating GRUB configuration

Answer

Not running depmod

Answer

Not setting the correct root filesystem

Question 12

An administrator needs to ensure a kernel module is never loaded, even if requested. Which file should be used?

Accepted Answer

/etc/modprobe.d/blacklist.conf. The standard mechanism to prevent a kernel module from loading is to add a `blacklist` directive in a file under `/etc/modprobe.d/`, typically named `blacklist.conf`. The `modprobe` utility reads all `.conf` files in this directory, and a `blacklist <module_name>` entry ensures the module is never automatically loaded or loaded via `modprobe`, even if explicitly requested.

Answer

/etc/modprobe.d/deny.conf

Answer

/lib/modprobe.d/blacklist.conf

Answer

/etc/modules-load.d/blacklist.conf

Question 13

An administrator wants to limit the size of the kernel ring buffer to prevent memory overflow. Which kernel boot parameter should be used?

Accepted Answer

log_buf_len. `log_buf_len` is the kernel boot parameter that explicitly sets the size of the kernel ring buffer (dmesg buffer). By specifying a value (e.g., `log_buf_len=4M`), the administrator can increase or limit the buffer size to prevent memory overflow when a large volume of kernel messages is generated.

Answer

log_size

Answer

kernel.log.size

Answer

dmesg_size

Question 14

A system administrator needs to ensure that a custom kernel module loads automatically at boot. The module is named 'my_driver' and is built for the current kernel. Which configuration file should be modified to ensure the module loads automatically?

Accepted Answer

Add a configuration file in /etc/modules-load.d/. Systemd-based Linux distributions use /etc/modules-load.d/ to specify kernel modules that should be loaded automatically at boot. Placing a configuration file (e.g., my_driver.conf) containing the module name 'my_driver' in this directory instructs systemd-modules-load.service to load the module during early boot. This is the modern, distribution-agnostic method for ensuring a custom kernel module loads automatically.

Answer

Add the insmod command in /etc/rc.local

Answer

Add the module name to /etc/modules.conf

Answer

Add a configuration file in /etc/modprobe.d/

Question 15

During boot, the kernel panics because the root filesystem cannot be mounted. Which kernel parameter should be added at the GRUB prompt to try an alternative root device?

Accepted Answer

root=/dev/sdb1. The kernel parameter 'root=' specifies the device for the root filesystem. When the default root device fails to mount, adding 'root=/dev/sdb1' at the GRUB prompt overrides the compiled-in root and tells the kernel to attempt mounting from that alternative block device. This is the standard method to redirect the root mount during boot troubleshooting.

Answer

init=/bin/sh

Answer

rescue

Answer

single

Question 16

A system administrator notices that the 'pcspkr' kernel module is causing beeps on the server console. The administrator wants to prevent this module from loading permanently. Which of the following is the correct method to blacklist the module?

Accepted Answer

Add 'blacklist pcspkr' to /etc/modprobe.d/blacklist.conf. The standard method to permanently prevent a kernel module from loading is to add a 'blacklist' directive to a file in /etc/modprobe.d/. The 'blacklist pcspkr' line tells modprobe not to load the pcspkr module automatically, even if it is requested by hardware detection or dependencies. This is the recommended approach on modern Linux distributions using modprobe's configuration system.

Answer

Add 'install pcspkr /bin/false' to /etc/modprobe.conf

Answer

Set the kernel parameter 'pcspkr=off' in GRUB

Answer

Remove the module file from /lib/modules/$(uname -r)/kernel/drivers/input/misc/

Question 17

Refer to the exhibit. Which kernel version will be booted by default when using a standard GRUB2 configuration that uses the symlinks vmlinuz and initrd.img?

Accepted Answer

5.10.0-9-amd64. In a standard GRUB2 configuration, the symlinks `vmlinuz` and `initrd.img` point to the latest installed kernel version. When GRUB2 generates its boot menu using `update-grub` (or `grub-mkconfig`), it reads these symlinks to create the default boot entry. Therefore, the default booted kernel is the one pointed to by these symlinks, which in this case is 5.10.0-9-amd64.

Answer

Depends on GRUB_DEFAULT setting, but if not set, it will boot the highest versioned kernel

Answer

It will prompt to choose between the two kernels

Answer

5.10.0-8-amd64

Question 18

Which file is used by the NetworkManager daemon to store connection profiles on a Linux system?

Accepted Answer

/etc/NetworkManager/system-connections/. NetworkManager stores per-connection profiles in the `/etc/NetworkManager/system-connections/` directory. Each profile is a keyfile (`.nmconnection` file) containing connection parameters such as SSID, security settings, and IP configuration. When NetworkManager starts or a connection is modified, it reads and writes these files to persist network configurations across reboots.

Answer

/etc/sysconfig/network-scripts/

Answer

/etc/netctl/

Answer

/etc/systemd/network/

Question 19

Which Postfix configuration parameter specifies the domain that is appended to unqualified email addresses?

Accepted Answer

myorigin. The `myorigin` parameter in Postfix controls the domain that is appended to locally-originated mail from unqualified addresses (e.g., 'user' becomes 'user@example.com'). By default, it uses the value of `myhostname`, but it is commonly set to `$mydomain` to append the domain rather than the full hostname. This ensures that outbound mail has a consistent and clean sender domain.

Answer

myhostname

Answer

mydomain

Answer

mydomainname

Question 20

Which of the following commands creates a new network namespace named 'test'?

Accepted Answer

ip netns add test. The correct command to create a new network namespace named 'test' is 'ip netns add test'. The 'ip netns' command is part of the iproute2 suite and is the standard tool for managing network namespaces in Linux. The 'add' subcommand creates a new namespace by binding it to a mount point under /var/run/netns/.

Answer

netns add test

Answer

network namespace add test

Answer

ip netns create test