LPIC-2 Practice Test 4 — 25 Questions

Question 1

Which TWO of the following are valid methods to join a Samba server to an Active Directory domain using Samba 4?

Accepted Answer

`net ads join`. `net ads join` is the traditional Samba tool for joining an Active Directory domain using the LDAP and Kerberos protocols over TCP/IP, which is the standard method for Samba 3 and later versions. Option D is correct because `samba-tool domain join` is the native Samba 4 command that directly integrates with the built-in AD domain controller functionality, allowing a Samba server to join an existing AD domain as a member server.

Answer

`smbpasswd -j`

Answer

`winbindd -j`

Answer

`net rpc join`

Question 2

A Postfix mail server is configured to use Dovecot SASL for authentication. Users report that they can send emails but are prompted for password repeatedly and see "SASL authentication failed" in the logs. The Dovecot SASL socket is configured correctly. What is the most likely cause?

Accepted Answer

The postfix user does not have permission to access the Dovecot auth socket.. The most common cause of repeated password prompts and 'SASL authentication failed' errors when Postfix is configured to use Dovecot SASL is a permissions issue on the Dovecot auth socket. Even if the socket path is correct in Postfix's `smtpd_sasl_path`, the Postfix process (typically running as the `postfix` user) must have read/write access to that socket file. Without proper permissions, Postfix cannot communicate with Dovecot's authentication service, causing SASL failures despite correct authentication mechanisms and enabled settings.

Answer

The mynetworks parameter in Postfix is set to the wrong subnet.

Answer

The Dovecot auth mechanism is set to 'login' but Postfix expects 'PLAIN'.

Answer

The smtpd_sasl_auth_enable parameter is set to no.

Question 3

A Samba server is configured as above. Users alice and bob have local system accounts but neither can connect to the share. What is the most likely cause?

Accepted Answer

The users have not been added to the Samba password database.. Samba maintains its own password database separate from the local system accounts. Even though alice and bob have valid local UNIX accounts, they must also be added to the Samba password database using `smbpasswd -a` or `pdbedit -a` before they can authenticate to any Samba share. Without this step, Samba will reject their connection attempts regardless of share permissions or path validity.

Answer

The share path /srv/share does not exist or has incorrect permissions.

Answer

The parameter 'read only = no' is misspelled; it should be 'writable = yes'.

Answer

The valid users list must use group names with '@' prefix, not individual names.

Question 4

Refer to the exhibit. A user cannot connect to the 'share2' Samba share. What is the most likely cause?

Accepted Answer

The share path does not exist or is not accessible.. The most common cause of a user being unable to connect to a Samba share is that the share path specified in the smb.conf file does not exist or is not accessible by the Samba service. Samba does not create the underlying directory; it only maps the share name to a path. If the path is missing, permissions are wrong, or the filesystem is not mounted, the connection will fail with an error like 'NT_STATUS_OBJECT_PATH_NOT_FOUND'.

Answer

The Samba service is not running.

Answer

The user does not have permission to read the share.

Answer

The share name is too long.

Question 5

After modifying /etc/samba/smb.conf, an administrator runs a command to validate the configuration. Which command is correct?

Accepted Answer

testparm. The correct command is `testparm`, which is specifically designed to validate the syntax and configuration of the `/etc/samba/smb.conf` file. It checks for errors in parameters, missing sections, and logical inconsistencies without restarting the Samba services, making it the standard tool for configuration verification.

Answer

smbpasswd

Answer

smbcontrol

Answer

samba-tool

Question 6

Which THREE of the following parameters can improve Samba file transfer performance under heavy load?

Accepted Answer

write raw = Yes. Enabling 'write raw = Yes' allows Samba to use the raw write SMB protocol, which sends larger write requests without waiting for intermediate acknowledgments, reducing protocol overhead and improving throughput under heavy load. This setting is particularly effective when combined with other performance tuning parameters.

Answer

strict allocate = Yes

Answer

oplocks = Yes

Question 7

A Samba server configured as an Active Directory domain member is unable to authenticate users from the domain. The administrator verifies that DNS resolution works, but `wbinfo -u` returns no output. What is the most likely cause?

Accepted Answer

The winbind service is not running.. The `wbinfo -u` command queries the winbind service to list domain users. If it returns no output, the most likely cause is that the winbind service is not running, as it is responsible for resolving Windows domain users and groups on a Samba member server. Without winbind, Samba cannot authenticate domain users even if DNS and Kerberos are working correctly.

Answer

The smb.conf file is missing the 'idmap config' lines.

Answer

The Kerberos ticket is expired.

Answer

The system clock is not synchronized with the domain controller.

Question 8

A Samba administrator needs to configure a share that allows only the user 'alice' and the group 'developers' to read and write files. Others should have no access. Which two parameters should be set in the share definition? (Choose two.)

Accepted Answer

valid users = alice, @developers. The 'valid users' parameter restricts access to only the specified users and groups, so setting 'valid users = alice, @developers' ensures only alice and members of the developers group can connect to the share. The 'write list' parameter grants write access to the listed users and groups, overriding any read-only setting; combining it with 'valid users' ensures that alice and the developers group have both read and write permissions, while all others are denied access entirely.

Answer

invalid users = alice, @developers

Answer

force user = alice

Answer

read list = alice, @developers

Question 9

A Samba share uses the 'acl_xattr' VFS module to store NT ACLs in extended attributes. The administrator runs 'getfattr -d /srv/share/file.txt' and sees no system attributes related to NT ACLs. What is the most likely cause?

Accepted Answer

The filesystem is not mounted with the 'user_xattr' option.. The 'acl_xattr' VFS module stores NT ACLs in extended attributes within the 'system' namespace. If 'getfattr -d' shows no system attributes, the most likely cause is that the underlying filesystem is not mounted with the 'user_xattr' option, which is required to enable extended attribute support. Without this mount option, the filesystem cannot store or retrieve extended attributes, so the NT ACL data is not persisted.

Answer

The VFS module is not loaded globally.

Answer

The share does not have 'nt acl support = yes' set.

Answer

The file's extended attributes are stored in a different namespace.

Question 10

A company develops a custom PCIe device driver as a kernel module. After installing a new kernel version 5.10.50 via a distribution update, the existing driver module fails to load with the error: 'insmod: ERROR: could not insert module mydriver.ko: Invalid module format'. The administrator checks the kernel version and sees that the module was compiled against a previous kernel version 5.10.45. The driver source code is available in /usr/src/mydriver. The administrator needs to get the driver working with the new kernel. Which of the following is the correct course of action?

Accepted Answer

Recompile the module using 'make -C /lib/modules/$(uname -r)/build M=/usr/src/mydriver modules'. The kernel module was compiled against a different kernel version (5.10.45) and the new kernel (5.10.50) has a different vermagic string, which includes the kernel version and other build parameters. The module must be recompiled against the new kernel's build tree located at /lib/modules/$(uname -r)/build to match the vermagic and ensure symbol compatibility. The command 'make -C /lib/modules/$(uname -r)/build M=/usr/src/mydriver modules' uses the kernel build system to compile the module against the running kernel's configuration and headers.

Answer

Copy the compiled .ko file to /lib/modules/5.10.50/kernel/drivers/misc/ and run 'depmod -a'

Answer

Edit the module's Makefile to change the version string to match the new kernel

Answer

Use 'modprobe --force mydriver' to bypass the version check

Question 11

Which TWO conditions are most likely to cause 'NT_STATUS_ACCESS_DENIED' when accessing a Samba share?

Accepted Answer

Linux filesystem permissions disallow write. Samba ultimately relies on the underlying Linux filesystem permissions to enforce write access. Even if Samba share permissions allow writing, if the Linux user or group mapped to the Samba session lacks write permission on the file or directory (e.g., due to chmod or ACL settings), the kernel will deny the write operation, resulting in NT_STATUS_ACCESS_DENIED. This is a common misconfiguration where administrators set share-level permissions correctly but forget to adjust the filesystem ACLs.

Answer

Lmhosts file misconfiguration

Answer

SMB protocol version mismatch

Answer

Windows firewall blocking port 445

Question 12

A Samba share requires that users must provide valid credentials, but the share should be accessible to any authenticated user without further restrictions. Which security mode should be used?

Accepted Answer

security = user. The `security = user` mode requires each user to provide valid credentials (username and password) to access the share, but once authenticated, the share is accessible without further per-share restrictions. This matches the requirement exactly: authentication is mandatory, but authorization is not granularly controlled per share beyond the user's identity.

Answer

security = domain

Answer

security = server

Answer

security = share

Question 13

Which THREE commands are specifically used to diagnose Samba issues?

Accepted Answer

smbstatus. smbstatus is correct because it displays the current Samba connections, including active SMB sessions, open files, and locked files, which is essential for diagnosing who is accessing Samba shares and what resources are in use. It queries the Samba internal state via the smbd daemon, providing real-time diagnostic information about connected clients.

Answer

netstat

Answer

ping

Question 14

Refer to the exhibit. If a user on the local machine tries to SSH to a remote host on eth1, what will happen?

Accepted Answer

The connection will succeed because the OUTPUT chain accepts all.. The OUTPUT chain has a default policy of ACCEPT, meaning all outgoing packets, including SSH traffic (TCP port 22), are allowed by default. Since the user is initiating an SSH connection from the local machine, the packet traverses the OUTPUT chain, and with no explicit DROP or REJECT rule, it is permitted. The INPUT chain's default DROP policy only affects incoming packets, not outgoing connections.

Answer

The connection will succeed only if the remote host is on eth0.

Answer

The connection will fail because there is no rule accepting outgoing SSH.

Answer

The connection will fail because the INPUT chain drops all.

Question 15

An administrator wants to ensure a kernel module is loaded automatically at boot for a hardware device. Which file should be modified to add the module name?

Accepted Answer

/etc/modules-load.d/. The `/etc/modules-load.d/` directory contains configuration files that list kernel module names to be loaded automatically at boot by the `systemd-modules-load.service`. This is the standard mechanism in modern Linux distributions using systemd to ensure specific modules are loaded early in the boot process, before udev or other services handle device detection.

Answer

/etc/modprobe.d/blacklist.conf

Answer

/etc/udev/rules.d/

Answer

/proc/sys/kernel/

Question 16

During kernel development, a developer modifies only a few source files in a module directory. Which make target should be used to rebuild only that module without compiling the entire kernel?

Accepted Answer

make M=./drivers/net. The `M=./drivers/net` argument tells the kernel build system to build only the module(s) in the specified directory as external modules, without recompiling the entire kernel tree. This is the standard way to rebuild a single kernel module after modifying its source files, leveraging the already configured kernel build environment.

Answer

make oldconfig && make

Answer

make modules

Answer

make modules_install

Question 17

A user reports that the command 'smbclient -L //fileserver' fails with a timeout. What is the most likely cause?

Accepted Answer

A firewall on the client or server is blocking TCP port 445.. The command 'smbclient -L //fileserver' uses SMB protocol to list shares. A timeout indicates the client cannot establish a TCP connection to the server on port 445, which is the default SMB port. A firewall blocking TCP 445 would prevent the connection, causing a timeout, while other issues like a stopped smbd service or unreachable server would typically produce different errors (e.g., 'connection refused' or 'no route to host').

Answer

The smbd service on the server is not running.

Answer

The user does not have an account on the server.

Answer

The server is not reachable via ping.

Question 18

A system fails to boot due to a corrupted initramfs. Which TWO methods can be used to recover? (Choose two.)

Accepted Answer

Use the rescue mode of the installation media (e.g., RHEL rescue, Ubuntu recovery). Booting from installation media (e.g., RHEL rescue or Ubuntu recovery) provides a minimal environment that can mount the root filesystem, chroot into it, and then rebuild the initramfs using the system's own kernel and modules. This method does not require a working initramfs on the disk, as the rescue environment supplies its own kernel and initial RAM disk.

Answer

Edit GRUB command line to add 'init=/bin/bash' and then rebuild initramfs from that shell

Answer

Reinstall the kernel package from the GRUB command line using a network boot

Answer

Use kexec to boot a different kernel

Question 19

A system fails to boot with a kernel panic: 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. The administrator suspects the root filesystem is not being detected. Which kernel parameter should be checked first?

Accepted Answer

root=/dev/sda1. The kernel panic 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot locate the root filesystem. The 'root=' kernel parameter specifies the device for the root filesystem (e.g., root=/dev/sda1). Checking this parameter first is critical because if it is missing, incorrect, or the device name is wrong, the kernel will fail to mount the root filesystem and panic.

Answer

init=/sbin/init

Answer

ro

Answer

panic=10

Question 20

An organization is migrating from SysV init to systemd. What systemd command should be used to check the status of the HTTP service?

Accepted Answer

systemctl status httpd. The correct command to check the status of a service in systemd is `systemctl status httpd`. This command displays the current state, recent log entries, and process details for the specified unit. The `systemctl` utility is the primary interface for managing systemd services, while `systemd` itself is the init system daemon, not a user-facing command.

Answer

systemd-analyze httpd

Answer

systemctl list-units httpd

Answer

systemd status httpd