LPIC-2 Practice Test 5 — 25 Questions

Question 1

Refer to the exhibit. Which module is currently in use by another module?

Accepted Answer

kvm. The `lsmod` command shows that `kvm` has a 'Used by' count of 1, indicating another module is currently using it. The 'Used by' column lists the modules that depend on the given module, so `kvm` is in use by another module (likely `kvm_intel` or `kvm_amd`). This is the correct interpretation because the question asks which module is currently in use by another module, and `kvm` is the one with a non-zero 'Used by' value.

Answer

usb_storage

Answer

kvm_intel

Answer

aesni_intel

Question 2

A new network card driver module is not being loaded at boot. The administrator wants to ensure the module is loaded automatically without modifying the kernel command line. Which file should be used?

Accepted Answer

/etc/modules-load.d/.conf. /etc/modules-load.d/.conf is the standard configuration directory used by systemd-modules-load.service to load kernel modules at boot without modifying the kernel command line. Files in this directory list module names (one per line) that are loaded automatically during early boot, making it the proper mechanism for ensuring a network card driver module is loaded.

Answer

/lib/modules/$(uname -r)/modules.builtin

Answer

/etc/modprobe.d/<name>.conf

Answer

/etc/rc.local

Question 3

A web server is running in enforcing mode under SELinux. The administrator wants to allow Apache to connect to a remote database server. Which SELinux boolean needs to be set to allow httpd to make network connections?

Accepted Answer

httpd_can_network_connect_db. The SELinux boolean `httpd_can_network_connect_db` is specifically designed to allow the httpd process to connect to remote database servers. This boolean is more targeted than the generic `httpd_can_network_connect`, which permits all outbound TCP connections. Since the question explicitly mentions a remote database server, the specific boolean is the most appropriate choice.

Answer

httpd_enable_homedirs

Answer

httpd_can_network_connect

Answer

httpd_unified

Question 4

A new user has been added to the LDAP directory, but the user cannot log in. The admin confirms the LDAP server is reachable and the user entry exists. Which of the following is the most likely missing configuration?

Accepted Answer

The PAM configuration does not include pam_ldap.. D is correct because even if the LDAP server is reachable and the user entry exists, the system must be configured to use LDAP for authentication. PAM (Pluggable Authentication Modules) controls how authentication is performed; without pam_ldap (or pam_ldap.so) in the PAM stack, the system will not consult the LDAP server during login, so authentication fails regardless of the LDAP directory contents.

Answer

The LDAP server does not have the correct schema for the user.

Answer

The nscd cache is stale and needs to be cleared.

Answer

The nsswitch.conf file should have 'ldap' before 'files' for passwd.

Question 5

A storage administrator sees the following output from multipath -ll: 'dm-3 (3600605b0038f1f0019f1f7e00000000) size=10G features='0' hwhandler='0' wp=rw' but the paths are all 'failed'. The scsi devices are listed in /proc/scsi/scsi. What is the most likely cause?

Accepted Answer

The SAN fiber cables are disconnected. The output from multipath -ll shows the multipath device dm-3 with its WWID and size, but all paths are 'failed'. Since /proc/scsi/scsi lists the SCSI devices, the host bus adapters (HBAs) and drivers are functioning at the OS level. The most common cause for all paths to fail simultaneously is a physical connectivity issue, such as disconnected SAN fiber cables, which prevents the initiator from reaching the target LUNs.

Answer

The device mapper is not configured

Answer

The multipathd daemon is not running

Answer

The multipath configuration uses user_friendly_names but the bindings file is missing

Question 6

Which THREE of the following are correct about RAID 1 in mdadm? (Select THREE)

Accepted Answer

It can have a hot spare.. RAID 1 in mdadm provides mirroring, where data is written identically to two or more disks. A hot spare is supported: if a disk fails, mdadm automatically rebuilds the mirror onto the spare. This requires at least 2 disks to form the mirror.

Answer

It provides striping.

Answer

It uses a bitmap for resync.

Question 7

After upgrading the kernel on a Red Hat Enterprise Linux system, the system fails to boot because the initramfs is missing. Which command can be used to regenerate the initramfs?

Accepted Answer

dracut -f. On Red Hat Enterprise Linux (RHEL) systems, the `dracut` utility is the standard tool for creating and regenerating initial RAM filesystem images (initramfs). The `-f` (force) option overwrites an existing initramfs file, which is necessary after a kernel upgrade to ensure the new kernel has the correct drivers and modules to mount the root filesystem during boot. Without a valid initramfs, the kernel cannot access the root filesystem, causing a boot failure.

Answer

mkinitrd -f

Answer

grub2-mkconfig -o /boot/grub2/grub.cfg

Answer

mkinitramfs -o /boot/initrd.img

Question 8

A Linux client is experiencing slow name resolution. The /etc/nsswitch.conf file has the line 'hosts: files dns'. The /etc/hosts file contains many entries. What is the most effective way to improve resolution speed?

Accepted Answer

Change the nsswitch.conf line to 'hosts: dns files'. The current order 'hosts: files dns' causes the resolver to check the entire /etc/hosts file first for every query, which is slow when the file contains many entries. Reversing the order to 'hosts: dns files' makes the resolver query DNS first, which is typically faster for most lookups, and only falls back to the local file if DNS fails. This directly addresses the bottleneck without requiring additional services or data removal.

Answer

Increase the DNS timeout in /etc/resolv.conf

Answer

Install and configure nscd (Name Service Cache Daemon)

Answer

Remove all entries from /etc/hosts except localhost

Question 9

An administrator observes that only one path is shown as active for mpathb. What is the most likely cause?

Accepted Answer

The blacklist rule excludes the other path.. When only one path is active for a multipath device (mpathb), the most likely cause is that the other path is being excluded by a blacklist rule in the multipath configuration. The blacklist can filter out devices based on WWID, device name, or vendor/product, preventing them from being aggregated into the multipath map. This results in the path being visible to the system but not used by multipathd.

Answer

The find_multipaths setting is incorrect.

Answer

The SCSI devices are not properly connected.

Answer

The multipathd service is not running.

Question 10

Which TWO options in dhcpd.conf are used to define the subnet and the address range for dynamic allocation? (Select two.)

Accepted Answer

range 192.168.1.10 192.168.1.100;. The `range` directive in `dhcpd.conf` explicitly defines the pool of IP addresses available for dynamic (DHCP) allocation. Option E is correct because the `subnet` declaration specifies the network segment and netmask, creating the context in which the `range` statement must be nested to function. Together, they define both the subnet boundary and the dynamic address pool.

Answer

option subnet-mask 255.255.255.0;

Answer

pool { ... }

Answer

host fixed-address 192.168.1.200;

Question 11

To protect against SSH brute-force attacks, a system administrator installs fail2ban. Which configuration file should be modified to enable the SSH jail with default settings?

Accepted Answer

/etc/fail2ban/jail.local. Fail2ban uses jail.local to override default settings from jail.conf without modifying the package-managed file. The SSH jail is defined in jail.conf but enabling it with default settings requires creating or editing jail.local, which takes precedence over jail.conf. This ensures that customizations survive package updates.

Answer

/etc/fail2ban/fail2ban.conf

Answer

/etc/ssh/sshd_config

Answer

/etc/fail2ban/jail.conf

Question 12

Which legacy SMB protocol version should be disabled for security best practices on a modern Samba server?

Accepted Answer

SMB1. SMB1 (also known as CIFS) is a legacy protocol that lacks modern security features such as pre-authentication integrity, encryption, and secure dialect negotiation. It is notoriously vulnerable to attacks like EternalBlue and SMB relay, and disabling it is a fundamental security best practice on any modern Samba server. Samba allows disabling SMB1 via the 'server min protocol = SMB2' or 'ntlm auth = no' directives in smb.conf.

Answer

SMB2_02

Answer

SMB3

Answer

SMB2

Question 13

In a PAM configuration file, which control flag is used for modules that are not required but can provide additional functionality?

Accepted Answer

optional. In PAM (Pluggable Authentication Modules) configuration files, the 'optional' control flag indicates that the module's success or failure is not critical to the overall authentication result. It is used for modules that provide additional functionality, such as logging or session recording, without affecting whether access is granted or denied. This allows administrators to add supplementary checks without breaking existing authentication flows.

Answer

required

Answer

sufficient

Answer

requisite

Question 14

An organization runs a Samba server in standalone mode. They want to allow anonymous (guest) access to a public share. Which configuration option enables guest access for a share?

Accepted Answer

map to guest = Bad User and guest ok = yes. Samba requires both `map to guest = Bad User` (which tells Samba to treat any connection attempt with an invalid username as a guest connection) and `guest ok = yes` (which explicitly permits guest access to the share). Without both, anonymous access will be denied. The `map to guest` directive can also be set to `Bad Password` or `Never`, but `Bad User` is the typical choice for public shares.

Answer

anonymous = yes

Answer

security = share

Answer

guest account = nobody

Question 15

Which systemd target is equivalent to the traditional SysV runlevel 3 (multi-user text mode)?

Accepted Answer

multi-user.target. In systemd, multi-user.target is the direct equivalent of SysV runlevel 3, which provides a multi-user text-mode environment without a graphical desktop. This target starts all essential system services and network support but does not launch a display manager, making it the standard for headless servers and maintenance.

Answer

rescue.target

Answer

graphical.target

Answer

emergency.target

Question 16

Which two of the following are valid methods to pass kernel parameters during the boot process? (Choose two.)

Accepted Answer

Edit /boot/grub/grub.cfg and append parameters to the 'linux' line. Editing /boot/grub/grub.cfg to append parameters to the 'linux' line directly modifies the kernel command line that GRUB 2 passes to the Linux kernel at boot. This is a standard method for permanently adding kernel parameters like 'quiet' or 'nomodeset'.

Answer

Use the 'initrd' command in GRUB

Answer

Write the parameter directly to /proc/cmdline

Answer

Set the parameter in /etc/sysctl.conf

Question 17

A company runs a DNS server using BIND9 on a Linux server. The server is configured with two network interfaces: one internal (192.168.1.10) and one external (203.0.113.10). The server is configured to be authoritative for example.com. Internal clients can resolve example.com, but external clients receive "SERVFAIL" responses. The host command from an external client returns "Host not found". The administrator checks the named configuration and finds the following in /etc/bind/named.conf.options:

options {
  directory "/var/cache/bind";
  listen-on { 127.0.0.1; 192.168.1.10; 203.0.113.10; };
  allow-query { 192.168.1.0/24; };
  recursion no;
  dnssec-validation auto;
};

The zone configuration for example.com has proper allow-transfer and allow-update settings. What change should be made to resolve external queries?

Accepted Answer

Change 'allow-query' to '{ any; };'. The 'allow-query' directive restricts which clients can send queries to the server. With 'allow-query { 192.168.1.0/24; };', only internal clients on that subnet are permitted to query, causing external clients to receive SERVFAIL. Changing it to '{ any; };' allows all clients to query the server, resolving the issue while still keeping recursion disabled for security.

Answer

Add 'recursion yes;' to the options block.

Answer

Add 'listen-on port 53 { 203.0.113.10; };' to the options block.

Answer

Change 'listen-on' to '{ any; };'

Question 18

A Linux client is configured to use PAM for authentication against an LDAP server. The /etc/pam.d/system-auth includes 'auth required pam_ldap.so'. Users can authenticate successfully. However, when a user runs 'id username', it shows 'uid=1000(username) gid=100(users) groups=100(users)' but the LDAP group membership is not shown. Which configuration file is most likely misconfigured?

Accepted Answer

The /etc/nsswitch.conf 'group' line does not include 'ldap'.. The 'id' command queries the Name Service Switch (NSS) to resolve user and group information. Even though PAM (via pam_ldap.so) successfully authenticates the user against LDAP, the group membership lookup fails because NSS is not configured to consult LDAP for group data. The /etc/nsswitch.conf file must include 'ldap' in the 'group' line (e.g., 'group: files ldap') to enable the system to retrieve LDAP group memberships.

Answer

The PAM configuration uses 'required' instead of 'sufficient' for pam_ldap.

Answer

The /etc/ldap.conf file is missing the 'nss_base_group' line.

Answer

The autofs service is not running.

Question 19

A company runs a mixed environment with Linux and Windows clients. The Samba server is configured as a domain member for authentication. Users authenticate via Active Directory using winbind. Recently, the IT department implemented a new password policy that requires all users to change passwords every 90 days. After the policy took effect, several users report that they cannot access Samba shares from their Linux clients (using smbclient) even though they can log into their Windows desktops with the same credentials. The error message on Linux is 'session setup failed: NT_STATUS_LOGON_FAILURE'. The administrator runs 'wbinfo -a username%password' and it succeeds. What is the most likely cause?

Accepted Answer

The Samba server's cached credentials for these users have expired and not been refreshed.. When a Samba server is a domain member using winbind, it caches user credentials to reduce authentication traffic to the domain controller. After the new 90-day password policy, users changed their passwords on Windows, but the cached credentials on the Samba server were not refreshed. The `wbinfo -a` command succeeds because it contacts the domain controller directly, bypassing the cache, while `smbclient` fails because it uses the stale cached credentials, resulting in NT_STATUS_LOGON_FAILURE.

Answer

The Samba server's krb5.conf is misconfigured for the new password policy.

Answer

The users' passwords contain characters that are not being encoded correctly by smbclient.

Answer

The Linux clients are using an older version of Samba that does not support the new password policy.

Question 20

You are the administrator for a small office network with 20 Linux workstations and 5 Windows 10 clients. The company uses a Samba server (version 4.15) running on Ubuntu 22.04 to share a central directory /data with user-level security. Each user has a home directory on the server, and all users are in the 'staff' group. Recently, users have complained that they can access the /data share from Windows but cannot modify any files, even though they could before. The Samba configuration for the share is:

[data]
   path = /data
   browseable = yes
   read only = no
   valid users = @staff
   create mask = 0660
   directory mask = 0770
   force group = staff

You check the filesystem permissions on /data and find it is owned by root:staff with permissions 775. Files inside are owned by individual users and group staff with permissions 664. You also check smbstatus and see that users are connected as 'guest' rather than their actual username. What is the most likely cause of the problem?

Accepted Answer

The global 'map to guest = Bad User' setting is causing users who mistype their password to be mapped to the guest account, losing write permissions.. The 'map to guest = Bad User' global setting in Samba causes any user who fails authentication (e.g., due to a typo or incorrect password) to be mapped to the guest account. Since the share does not define a 'guest ok' or 'guest only' setting, and the guest account typically has no write permissions on the /data directory, users connected as guest cannot modify files. The smbstatus output confirming users are connected as 'guest' directly points to this misconfiguration.

Answer

The 'valid users = @staff' directive excludes root, so users cannot write because the share is owned by root.

Answer

The 'force group = staff' parameter overrides file ownership and prevents writes because the files are owned by root.

Answer

The 'create mask = 0660' is too restrictive and prevents users from writing to existing files.