LPIC-2 Practice Test 26 — 15 Questions

Question 1

A server runs a Linux kernel that has been hardened by disabling loadable kernel module support entirely (CONFIG_MODULES=n). An administrator now needs to add support for a new network interface card. Which statement best describes the required approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The driver must be built into the kernel image itself, requiring a kernel rebuild and reinstallation.. A kernel compiled without CONFIG_MODULES has no support for loadable kernel modules at all. The module-loading syscalls are absent, and user-space tools such as modprobe, insmod, and depmod cannot function. The only way to add a new driver is to include it as a built-in component during kernel compilation, then install and boot the new kernel. Runtime insertion is impossible without recompiling the kernel with module support enabled.

Answer

The driver can be loaded dynamically if it is signed with a valid key and the kernel is booted in secure mode.

Answer

The administrator can use modprobe to load the driver after placing the .ko file in /lib/modules/$(uname -r)/.

Answer

The administrator can use insmod with the --force option to bypass the missing module support.

Question 2

An administrator manages a BIND 9 server that acts as the primary master for the zone sales.example.com. The zone file is /var/named/sales.example.com.zone and the server's named.conf contains a zone statement with type master. After editing the zone file to add a new MX record, the administrator wants the running server to reload just this zone without restarting named or reloading every other zone. Which command accomplishes this?

Accepted Answer

rndc reload sales.example.com. The rndc reload command accepts an optional zone name, allowing a single zone to be re-read from disk while named keeps running. It is the targeted, non-disruptive way to publish an edited MX record. The other commands either validate the file, reload global configuration, or act on the whole service rather than the single zone.

Answer

systemctl reload named.service sales.example.com

Answer

rndc reconfig sales.example.com

Answer

named-checkzone sales.example.com /var/named/sales.example.com.zone

Question 3

A junior administrator needs to grant a user named 'alice' the ability to run only the commands /usr/bin/systemctl restart httpd and /usr/bin/systemctl status httpd as root, without requiring a password. Which entry in the /etc/sudoers file accomplishes this?

Accepted Answer

alice ALL=(root) NOPASSWD: /usr/bin/systemctl restart httpd, /usr/bin/systemctl status httpd. The correct sudoers entry grants alice permission to run exactly the two specified systemctl commands as root without a password. It uses the NOPASSWD tag and lists only those commands, adhering to the principle of least privilege. The other options either grant too much access, omit the passwordless requirement, or include an extra command.

Answer

alice ALL=(ALL) NOPASSWD: /usr/bin/systemctl

Answer

alice ALL=(root) /usr/bin/systemctl restart httpd, /usr/bin/systemctl status httpd

Answer

alice ALL=(root) NOPASSWD: /usr/bin/systemctl restart httpd, /usr/bin/systemctl status httpd, /usr/bin/systemctl reload httpd

Question 4

A junior administrator adds a new 4 TB SATA disk as /dev/sdc and must prepare a single GPT-partitioned layout with one partition spanning the whole disk for a future filesystem. Which command should be used to create the GPT partition table and the partition?

Accepted Answer

gdisk /dev/sdc. GPT partitioning on a large disk is performed with gdisk, which writes GPT structures and supports partitions above the 2 TB MBR limit. The administrator can create one partition spanning the disk with the interactive new-partition command and then write the table. partprobe is only used afterward to make the kernel aware of the new layout.

Answer

partprobe /dev/sdc

Answer

mkfs.gpt /dev/sdc

Answer

fdisk /dev/sdc

Question 5

An administrator manages a PAM stack where password quality must be enforced centrally. Users report that weak passwords are still accepted on one host even though pam_pwquality is configured. Which action ensures pam_pwquality is actually consulted during password changes?

Accepted Answer

Add 'password requisite pam_pwquality.so retry=3' to the password stack in /etc/pam.d/common-password before pam_unix.so.. Password strength enforcement happens in the password stack, and pam_pwquality must be positioned there with a control flag that fails the operation when the new password is inadequate. Using requisite ahead of pam_unix.so blocks weak passwords before they are written. Auth, account, and session stacks are involved in other phases of authentication and do not govern password changes.

Answer

Add 'session optional pam_pwquality.so' to the session stack in /etc/pam.d/login.

Answer

Add 'account required pam_pwquality.so' to the account stack in /etc/pam.d/password-auth.

Answer

Add 'auth required pam_pwquality.so' to the auth stack in /etc/pam.d/system-auth.

Question 6

An administrator is configuring a DHCP server using ISC dhcpd on a Linux system. The server must provide different DNS server addresses to clients on two different subnets. The subnets are 10.0.1.0/24 and 10.0.2.0/24, and the DHCP server is directly connected to both. Which configuration approach correctly assigns the appropriate DNS servers per subnet?

Accepted Answer

Define a global 'option domain-name-servers' and override it within each subnet declaration.. The correct method is to define a global option domain-name-servers as a default, then override it within each subnet declaration. This allows different DNS servers for each subnet while keeping common settings centralized. ISC dhcpd evaluates options hierarchically: global, then subnet, then host. Overriding at the subnet level ensures clients on 10.0.1.0/24 and 10.0.2.0/24 receive their respective DNS servers. This is efficient and standard practice.

Answer

Configure 'option domain-name-servers' in the 'host' declarations for each client.

Answer

Use 'class' declarations with 'match if' statements to assign DNS servers based on the client's MAC address.

Answer

Define separate 'subnet' declarations and place the 'option domain-name-servers' outside any subnet block.

Question 7

A server with a custom 5.x kernel boots but the root filesystem is mounted read-only and systemd reports that remounting to read-write failed. The kernel command line includes 'root=/dev/mapper/vg-root ro'. The administrator wants the root filesystem mounted read-write as early as possible during boot. Which change is most appropriate?

Accepted Answer

Replace 'ro' with 'rw' in the kernel command line and regenerate the bootloader configuration.. The kernel command line parameters 'ro' and 'rw' control the initial mount mode of the root filesystem. When 'ro' is present, the kernel mounts root read-only, and if no initramfs or later service remounts it read-write, systemd will report failure. Replacing 'ro' with 'rw' and regenerating the bootloader configuration makes root read-write from the earliest mount, which is the correct fix for a custom kernel without an initramfs remount step.

Answer

Add 'init=/bin/bash' to the kernel command line to get a shell and then remount manually.

Answer

Add 'systemd.unit=rescue.target' to the kernel command line so systemd remounts root read-write.

Answer

Add 'rootflags=rw' to the kernel command line in addition to the existing 'ro' parameter.

Question 8

A Linux client uses NIS for user authentication. The administrator notices that users can log in, but their home directories are not automatically mounted from an NFS server. The NIS server exports an automount map named auto.home. Which file on the client must be configured to use this automount map?

Accepted Answer

/etc/auto.master. The correct file is /etc/auto.master. This file is read by autofs to determine which automount maps to use for specific mount points. To use the NIS auto.home map, an entry such as '/home yp:auto.home' must be added, which tells autofs to consult the NIS map for /home. Without this entry, autofs will not know to use the NIS map, and home directories will not be mounted automatically.

Answer

/etc/yp.conf

Answer

/etc/nsswitch.conf

Answer

/etc/auto.home

Question 9

An administrator configures a Samba share with 'valid users = @sales' and 'invalid users = dave', where dave is a member of the sales group. Dave attempts to connect to the share and is denied. Which statement best explains the outcome?

Accepted Answer

The connection is denied because invalid users takes precedence over valid users, and dave is explicitly listed as invalid.. Samba processes the invalid users list before the valid users list, so any account named in invalid users is refused even if it also qualifies through valid users. Because dave appears explicitly in invalid users, his sales group membership cannot grant him access, which explains the denial reported in the scenario.

Answer

The connection is denied because invalid users requires the username to be prefixed with the domain name.

Answer

The connection is allowed because dave is a member of the sales group and valid users grants group access.

Answer

The connection is denied because group entries in valid users cannot be combined with per-user entries in invalid users.

Question 10

A Linux server has an ext4 filesystem on /dev/mapper/vg_data-lv_home mounted at /home. The administrator notices that the filesystem is full and that 5% of blocks are reserved for root, which is wasteful on this large data volume. The administrator wants to reduce the reserved block percentage to 1% without unmounting the filesystem. Which command should the administrator run?

Accepted Answer

tune2fs -m 1 /dev/mapper/vg_data-lv_home. The tune2fs utility adjusts ext4 filesystem parameters on a mounted filesystem. The -m option sets the percentage of blocks reserved for the root user. Changing it from 5% to 1% frees additional space for regular users while retaining a small reserve, and the change takes effect without unmounting.

Answer

resize2fs -m 1 /dev/mapper/vg_data-lv_home

Answer

e2fsck -m 1 /dev/mapper/vg_data-lv_home

Answer

tune2fs -r 1 /dev/mapper/vg_data-lv_home

Question 11

A backup server stores nightly snapshots on an LVM logical volume formatted with ext4. The administrator wants to take a point-in-time copy of the volume while it remains mounted and actively written to, then mount the copy read-only on another host for verification. Which command should the administrator run to create the snapshot?

Accepted Answer

lvcreate --size 20G --snapshot --name lv_backup /dev/vg_data/lv_db. Creating a snapshot of a live, mounted ext4 volume is done with lvcreate using the --snapshot option, specifying the origin LV, a snapshot name, and a COW size. The snapshot preserves the point-in-time image while writes continue to the origin, allowing the copy to be activated and mounted read-only for verification without disrupting the backup server.

Answer

vgsnapshot --name lv_backup --origin /dev/vg_data/lv_db --size 20G

Answer

dd if=/dev/vg_data/lv_db of=/dev/vg_data/lv_backup bs=4M conv=noerror

Answer

lvconvert --snapshot /dev/vg_data/lv_db --name lv_backup --size 20G

Question 12

A DNS administrator needs to verify that a secondary BIND server is receiving zone transfers from the primary for the zone 'example.org'. The administrator wants to check the serial number and other SOA details currently held by the secondary. Which command should be used?

Accepted Answer

dig @secondary.example.org example.org SOA. Querying the secondary server directly with dig for the SOA record returns the serial number and other SOA details currently in its database. Comparing this serial with the primary's serial confirms whether zone transfers are keeping the secondary up to date. This is a standard troubleshooting step for BIND replication issues.

Answer

rndc reload example.org

Answer

dig +trace example.org SOA

Answer

nslookup -type=SOA example.org

Question 13

An administrator is troubleshooting a Linux server whose default route was added with ip route add default via 192.168.1.1 dev eth0. After a network manager restart, the default route disappeared. The administrator wants to verify which component owns persistent routing configuration on this system and where the default gateway should be defined. Which file or mechanism should the administrator inspect first on a distribution using NetworkManager with keyfile profiles?

Accepted Answer

The [ipv4] section of the connection profile in /etc/NetworkManager/system-connections/. Manually added routes via ip route are runtime-only and are removed when the network stack is restarted. On a NetworkManager-managed host using keyfile profiles, persistent IPv4 settings including the default gateway live in the [ipv4] section of the connection profile under /etc/NetworkManager/system-connections/, so that is where the gateway must be defined for it to survive restarts.

Answer

/etc/resolv.conf

Answer

/etc/network/interfaces

Answer

/etc/sysconfig/network-scripts/route-eth0

Question 14

A junior administrator needs to grant a user the ability to restart the Apache web server without a password prompt. The user should not be able to run any other commands with elevated privileges. Which sudoers entry best follows the principle of least privilege?

Accepted Answer

user ALL=(root) NOPASSWD: /usr/bin/systemctl restart apache2. The principle of least privilege requires granting only the specific command needed. Specifying the full path and arguments for systemctl restart apache2 with NOPASSWD allows the user to restart the service without a password while preventing any other privileged actions. Broader entries like allowing all systemctl commands or full sudo access would grant excessive rights.

Answer

user ALL=(ALL) NOPASSWD: ALL

Answer

user ALL=(root) /usr/bin/systemctl restart apache2

Answer

user ALL=(root) NOPASSWD: /usr/bin/systemctl

Question 15

A technician is asked to create a software RAID1 array using two new disks, /dev/sdb and /dev/sdc, and make it persistent across reboots. The array must be usable immediately. Which command creates the array with persistent metadata?

Accepted Answer

mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb /dev/sdc. Creating a new software RAID array requires mdadm in --create mode with the correct level and member devices. The --create action writes metadata superblocks to each member, enabling automatic assembly at boot. Assemble, manage, and the wrong RAID level do not produce a new persistent RAID1 array from blank disks.

Answer

mdadm --assemble /dev/md0 /dev/sdb /dev/sdc

Answer

mdadm --create /dev/md0 --level=0 --raid-devices=2 /dev/sdb /dev/sdc

Answer

mdadm --manage /dev/md0 --add /dev/sdb /dev/sdc