LPIC-2 Practice Test 4 — 25 Questions

Question 1

Refer to the exhibit. What is the root filesystem device as specified in the kernel command line?

Accepted Answer

/dev/sda2. The kernel command line includes the parameter `root=/dev/sda2`, which explicitly specifies the root filesystem device as `/dev/sda2`. This is the standard way to indicate the partition where the root filesystem is mounted during boot, making option D correct.

Answer

Could not be determined

Answer

/dev/sda1

Answer

/dev/sda3

Question 2

A system administrator wants to verify the integrity of a downloaded package using a GPG signature. Which command should be used after importing the distributor's public key?

Accepted Answer

gpg --verify package.tar.gz.asc package.tar.gz. The `--verify` option is used to check the authenticity and integrity of a file against a detached GPG signature file. After importing the distributor's public key, running `gpg --verify package.tar.gz.asc package.tar.gz` confirms that the package was signed by the corresponding private key and has not been altered since signing.

Answer

gpg --encrypt package.tar.gz

Answer

gpg --decrypt package.tar.gz.asc

Answer

gpg --sign package.tar.gz

Question 3

An administrator wants to enhance the security of a web server running Apache. Which TWO of the following actions are recommended best practices?

Accepted Answer

Disable directory listing in the Apache configuration using Options -Indexes.. Option B is correct because disabling directory listing with 'Options -Indexes' prevents Apache from automatically generating browsable file indexes when no DirectoryIndex file (e.g., index.html) exists, closing an information-disclosure vector that could reveal sensitive files. Option D is correct because Apache should bind to privileged port 80/443 as root but then drop privileges so worker/child processes run as an unprivileged account like www-data, limiting the impact of a compromise via the principle of least privilege. Option A is not recommended because mod_info exposes detailed server configuration and module information that aids attackers, so it should be disabled or tightly restricted. Option C is not a best practice because .htaccess files allow decentralized per-directory overrides, increase parsing overhead, and can introduce misconfigurations; centralizing configuration in the main server config with 'AllowOverride None' is preferred. Option E is not recommended because the HTTP TRACE method can be abused in Cross-Site Tracing (XST) attacks to steal cookies or credentials, so it should be disabled with 'TraceEnable Off'.

Answer

Enable the mod_info module to monitor server configuration.

Answer

Enable .htaccess files to allow per-directory configuration changes.

Answer

Enable the HTTP TRACE method for debugging purposes.

Question 4

A system fails to boot with the error shown. Which kernel parameter should be added to the kernel command line to resolve the issue?

Accepted Answer

rootdelay=10. The error indicates that the system cannot find the root filesystem, often because the storage device is not ready when the kernel attempts to mount it. Adding `rootdelay=10` instructs the kernel to wait 10 seconds before attempting to mount the root device, giving USB, SCSI, or other slow-to-probe controllers time to initialize. This is a common fix for boot failures on systems with external or hot-pluggable storage.

Answer

root=/dev/sda1

Answer

noprompt

Answer

rootfstype=ext4

Answer

single

Question 5

Refer to the exhibit. The /data filesystem is nearly full. The administrator has added a new disk /dev/sdc with 10GB capacity. The VG currently has no free space. Which steps will increase the available space for /data using LVM and ext4?

Accepted Answer

pvcreate /dev/sdc; vgextend vg /dev/sdc; lvextend -l +100%FREE /dev/vg/data; resize2fs /dev/vg/data. It follows the proper LVM workflow: create a physical volume (pvcreate), add it to the volume group (vgextend), extend the logical volume using all free space in the VG (lvextend -l +100%FREE), and then resize the ext4 filesystem (resize2fs). This ensures the new 10GB disk is fully utilized for /data.

Answer

vgextend vg /dev/sdc; lvextend -L +10G /dev/vg/data; resize2fs /dev/vg/data

Answer

pvcreate /dev/sdc; lvextend -L +10G /dev/vg/data; resize2fs /dev/vg/data

Answer

pvcreate /dev/sdc; vgextend vg /dev/sdc; lvextend -l +50%FREE /dev/vg/data; resize2fs /dev/vg/data

Question 6

A sysadmin is configuring VLAN tagging on a Linux server that will act as a router-on-a-stick for multiple VLANs (10, 20, 30). The server has a single physical interface enp0s3 connected to a switch trunk port that allows VLANs 10, 20, and 30. The administrator uses systemd-networkd and creates VLAN interfaces enp0s3.10, enp0s3.20, enp0s3.30 with IP addresses 10.0.10.1/24, 10.0.20.1/24, and 10.0.30.1/24 respectively. They enable IP forwarding and, for security, set the iptables FORWARD chain default policy to DROP, but they add no specific rules. Clients in VLAN 10 can ping their gateway (10.0.10.1) but cannot ping clients in VLAN 20 (10.0.20.2). The switch confirms correct configuration. Which of the following is the most likely cause?

Accepted Answer

The server's iptables FORWARD chain is set to DROP by default.. The default policy of the iptables FORWARD chain is set to DROP, and no specific rules are added to allow traffic between VLANs. Since the server is acting as a router-on-a-stick, inter-VLAN traffic must be forwarded by the kernel, which requires explicit ACCEPT rules in the FORWARD chain. Without these rules, packets from VLAN 10 to VLAN 20 are dropped, even though the VLAN interfaces and switch configuration are correct.

Answer

The VLAN interface enp0s3.10 is missing the 'vlan' flag or is not properly bound.

Answer

The server's MAC address is not allowed on the switch for VLAN 10.

Answer

The switch port is configured as an access port instead of a trunk.

Question 7

A Linux administrator is setting up an IPsec VPN between two sites using strongSwan. The VPN established successfully, but traffic between the sites is not being encrypted. What is the most probable cause?

Accepted Answer

The IPsec policies are not configured to match the traffic.. The most probable cause for traffic not being encrypted after a successful IPsec tunnel establishment is that the IPsec policies (e.g., strongSwan's `ipsec.conf` `conn` section with `leftsubnet`/`rightsubnet`) do not match the actual traffic flows. Even if the IKE/SA is up, strongSwan only applies encryption to packets that match the configured selectors; mismatched subnets or protocols result in cleartext traffic bypassing the tunnel.

Answer

The firewall is blocking UDP port 500.

Answer

The kernel does not support IPsec (net.ipv4.ip_forward=0).

Answer

The IPsec daemon is not started.

Question 8

A network administrator notices that VLAN tagging is not working on a Linux bridge. The bridge interface br0 has member ports eth0 and eth1. The administrator runs 'bridge vlan show' and sees that only the default VLAN 1 is present. What is the most likely cause?

Accepted Answer

The bridge is not enabled for VLAN filtering. The 'bridge vlan show' command only displays VLAN filtering information when VLAN filtering is enabled on the bridge. By default, Linux bridges operate in a simple switching mode without VLAN awareness, meaning all frames are forwarded regardless of VLAN tags. The administrator must explicitly enable VLAN filtering using 'ip link set dev br0 type bridge vlan_filtering 1' to activate per-VLAN forwarding and filtering, which is why only the default untagged VLAN 1 appears.

Answer

The kernel module for VLAN is not loaded

Answer

The VLAN protocol is not set to 802.1Q

Answer

Ports eth0 and eth1 are not set to promiscuous mode

Question 9

A company requires link aggregation between a Linux server and a switch to increase throughput and provide redundancy. The switch supports only standard 802.3ad (LACP). Which bonding mode should be configured on the Linux server?

Accepted Answer

mode=4 (802.3ad). Mode=4 (802.3ad) implements the IEEE 802.3ad standard for Link Aggregation Control Protocol (LACP). This mode requires the switch to support LACP, which the scenario states, and provides both increased throughput through load balancing and redundancy through automatic failover if a link fails.

Answer

mode=2 (balance-xor)

Answer

mode=1 (active-backup)

Answer

mode=3 (broadcast)

Answer

mode=0 (balance-rr)

Question 10

Which THREE factors can cause a kernel panic during boot? (Select THREE.)

Accepted Answer

Corrupted kernel image. A kernel panic during boot occurs when the kernel cannot continue initializing the system. Option B (Corrupted kernel image) is correct because if the kernel binary itself is damaged or truncated, the bootloader loads invalid code and the kernel cannot execute, triggering a panic. Option C (Hardware incompatibility) is correct because unsupported or faulty hardware (e.g., CPU features, memory, or chipset) can cause the kernel to hit an unrecoverable error during early initialization. Option E (Missing device drivers for storage controllers) is correct because if the kernel lacks the driver needed to access the root filesystem's storage controller, it cannot mount root and will panic with a 'VFS: Unable to mount root fs' error. Option A (Too many kernel modules loaded) is not a direct cause of panic; module count alone does not break boot, and modules load after the kernel is already running. Option D (Filesystem errors on the root partition) typically cause a mount failure or drop to a recovery shell rather than a kernel panic, since the kernel itself can still run and report the error.

Answer

Too many kernel modules loaded

Answer

Filesystem errors on the root partition

Question 11

Which THREE commands can be used to display routing information?

Accepted Answer

route -n. The `route -n` command displays the kernel's IPv4 routing table with numeric addresses, avoiding DNS lookups. It is a standard tool for viewing routing information on Linux systems, making option B correct.

Answer

ping -R

Answer

traceroute

Question 12

Which file is used by GRUB2 to load the kernel and initramfs?

Accepted Answer

/boot/grub/grub.cfg. GRUB2 uses /boot/grub/grub.cfg as its main configuration file, which contains the menu entries, kernel paths, and initramfs locations. This file is generated by update-grub (or grub-mkconfig) based on scripts in /etc/grub.d/ and settings in /etc/default/grub, and it is read directly by the GRUB2 bootloader at boot time to load the kernel and initramfs.

Answer

/etc/lilo.conf

Answer

/etc/default/grub

Answer

/boot/grub/menu.lst

Question 13

An administrator wants to implement network bonding for redundancy on a Linux server running RHEL 8. The server has two physical interfaces em1 and em2. The administrator creates a bond interface bond0 with mode active-backup (mode 1) and adds the slaves em1 and em2. They assign IP address 192.168.50.10/24 to bond0 and bring up the bond. The bond appears to work initially, with one slave active. However, when they disconnect the cable from the active slave, the bond does not fail over to the other slave. The administrator checks /proc/net/bonding/bond0 and sees that the link status for both slaves shows 'up' even after the disconnection. They confirm the bonding module is loaded and the mode is correct. Which of the following is the most likely missing configuration?

Accepted Answer

The MII monitoring interval (miimon) is not configured.. In active-backup bonding mode (mode 1), the kernel bonding driver requires the MII (Media Independent Interface) monitoring interval (miimon) to be configured in order to detect link failures. Without miimon, the driver never polls the slave interfaces for link state changes, so even when a cable is disconnected, the driver continues to see the link as 'up' and does not trigger a failover. The administrator must set miimon=100 (or another value in milliseconds) in the bond configuration to enable periodic link monitoring.

Answer

The bond interface requires a specific kernel module that is missing.

Answer

The slave interfaces were not set to 'down' before enslaving.

Answer

The bond mode is set to mode 0 instead of mode 1.

Question 14

A system administrator is responsible for a production server running a custom-compiled Linux kernel version 5.15. After a routine update of the kernel source and recompilation, the server fails to boot. The error message on the console is: 'Kernel panic - not syncing: No working init found. Try passing init= option to kernel.' The administrator verifies that the root filesystem is intact by booting from a live USB and mounting the root partition. The filesystem contains the usual /sbin/init (symlinked to systemd). The administrator also checks the boot loader configuration and sees that the kernel command line includes 'root=/dev/sda1 ro'. The init binary exists and is executable. Which of the following is the most likely cause of this boot failure?

Accepted Answer

The boot loader's 'initrd' directive is missing or points to a non-existent file. The error 'No working init found' indicates the kernel successfully mounted the root filesystem but could not execute the init binary. Since the administrator confirmed the init binary exists and is executable on the root partition, the most likely cause is that the kernel did not have access to the necessary drivers or modules to properly access the root filesystem at boot time. The missing or misconfigured initrd (initial RAM disk) directive means the kernel lacks the temporary root filesystem containing essential modules (e.g., storage controller drivers) needed to mount the real root filesystem, leading to the kernel falling back to a failed init search.

Answer

The kernel was compiled without support for the ext4 filesystem

Answer

The init binary is missing or corrupted

Answer

The root filesystem is corrupted and cannot be mounted properly

Question 15

In Samba 4, what is the default security mode when no 'security' parameter is set in the [global] section?

Accepted Answer

user. In Samba 4, when no 'security' parameter is explicitly set in the [global] section, the default security mode is 'user'. This means clients must authenticate with a valid username and password, and Samba validates credentials against the local passdb backend (e.g., tdbsam or LDAP). This default has been consistent since Samba 3.x and ensures that each connection is tied to a specific user identity.

Answer

ads

Answer

share

Answer

domain

Question 16

A host on 192.168.2.100 tries to SSH to the firewall's IP address (192.168.1.1). The firewall's input chain policy is drop. Will the SSH connection be allowed?

Accepted Answer

No, because the input chain drops all packets that don't match rules.. The stem provides no specific firewall rule. With the input chain policy set to 'drop', all packets not matching any rule are dropped. Since no rule is stated to permit SSH, the connection from 192.168.2.100 to 192.168.1.1 will be blocked. Therefore, the correct answer is 'No' (Option A). Options B and C are incorrect because they either misidentify the traffic type or reference a non‑existent forward rule. Option D is incorrect because the stem does not mention any rule accepting SSH from the 192.168.2.0/24 subnet; such a rule is not provided.

Answer

No, because SSH to firewall is considered forwarded traffic.

Answer

Yes, because the forward chain accepts SSH.

Answer

Yes, because there is a rule accepting SSH from 192.168.2.0/24.

Question 17

An administrator needs to configure a Linux client to automatically obtain an IP address from a DHCP server but also ensure that the client uses a specific static DNS server (8.8.8.8) regardless of the DHCP-provided DNS. Which configuration should be applied?

Accepted Answer

Add 'supersede domain-name-servers 8.8.8.8;' to /etc/dhcp/dhclient.conf. The `supersede` directive in `/etc/dhcp/dhclient.conf` forces the DHCP client to replace any DNS server addresses received from the DHCP server with the specified value (8.8.8.8). This ensures the client uses the static DNS server regardless of what the DHCP server offers, while still obtaining its IP address dynamically.

Answer

Add 'append domain-name-servers 8.8.8.8;' to /etc/dhcp/dhclient.conf

Answer

Edit /etc/sysconfig/network-scripts/ifcfg-eth0 and set PEERDNS=no and DNS1=8.8.8.8

Answer

Add 'prepend domain-name-servers 8.8.8.8;' to /etc/dhcp/dhclient.conf

Question 18

Which THREE statements about PAM configuration are correct? (Select three.)

Accepted Answer

The order of modules in a stack affects the outcome.. Option C is correct because PAM processes each module type's stack in the order listed in the configuration file, and the sequence determines which modules run and how their results combine, so reordering can change the final outcome. Option D is correct because the 'requisite' control flag requires the module to succeed, and on failure it returns immediately without invoking any remaining modules in that stack. Option E is correct because 'sufficient' means that if the module succeeds and no prior required/requisite module has failed, PAM grants success immediately and skips the rest of the stack. Option A is not correct as stated because 'required' failure does not halt processing immediately; PAM continues evaluating the remaining modules and only fails after the stack completes. Option B is not correct because 'auth' performs authentication (verifying identity, e.g., password), whereas account management is handled by the 'account' module type.

Answer

The control flag 'required' means the module must succeed; if it fails, authentication fails immediately.

Answer

The module type 'auth' is used for account management.

Question 19

A server with IP 10.0.0.1 needs to forward packets from network 192.168.1.0/24 to 10.0.0.0/24. The administrator runs: 'iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j MASQUERADE'. However, traffic from 192.168.1.0/24 cannot reach 10.0.0.0/24. What is the most likely missing configuration?

Accepted Answer

The FORWARD chain in the filter table must have a rule to allow traffic.. The MASQUERADE rule in the POSTROUTING chain handles source NAT, but it does not automatically allow forwarding of packets. By default, the FORWARD chain in the filter table has a policy of DROP or lacks an explicit ACCEPT rule. Without a rule like `iptables -A FORWARD -s 192.168.1.0/24 -d 10.0.0.0/24 -j ACCEPT`, the kernel's netfilter will drop the forwarded packets, preventing traffic from reaching the destination.

Answer

A DNAT rule is also needed to translate the destination address.

Answer

A route must be added on the 10.0.0.0/24 network pointing back to 10.0.0.1.

Answer

The IP address 10.0.0.1 is not configured on the external interface.

Question 20

Which THREE of the following are valid bonding modes in Linux?

Accepted Answer

mode 2 (balance-xor). (mode 2, balance-xor) is a valid bonding mode that uses a hash policy (typically based on MAC addresses) to select a slave interface for outgoing traffic, providing both load balancing and fault tolerance. It is one of the seven standard bonding modes defined in the Linux kernel bonding driver (modes 0 through 6).

Answer

mode 8

Answer

mode 7