LPIC-2 Practice Test 26 — 15 Questions

Question 1

An administrator is reviewing the audit rules on a Linux server. The current rules are shown in the exhibit. The administrator needs to ensure that any failed attempts to open files are logged, while also monitoring for successful outbound connections. Which of the following describes the effect of the current rules?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The first rule logs only failed openat calls, and the second rule logs all connect calls.. The first rule uses the `-F exit=-EACCES` filter, which matches only failed `openat` calls (those returning the EACCES error). The second rule uses `-S connect` without an exit filter, so it logs all `connect` syscalls regardless of success or failure. Therefore, option A correctly describes the effect: failed openat calls and all connect calls are logged.

Answer

The first rule logs only successful openat calls, and the second rule logs only failed connect calls.

Answer

The first rule logs all openat calls, and the second rule logs all connect calls.

Answer

The first rule logs only failed openat calls, and the second rule logs only failed connect calls.

Question 2

Which TWO commands can be used to connect to a Samba share from a Linux command line?

Accepted Answer

smbclient. B is correct because smbclient is a command-line tool that uses the SMB/CIFS protocol to connect to Samba shares, allowing file transfers and directory listing. D is correct because mount.cifs is a helper program that mounts a Samba share to a local directory using the CIFS filesystem type, enabling direct file access via the kernel's cifs module.

Answer

sshfs

Answer

nfsmount

Answer

ftp

Question 3

Match each RAID level to its description.

Accepted Answer

RAID 0: Striping without parity, provides improved performance but no fault tolerance.. RAID 0 offers performance without redundancy; RAID 1 offers mirroring; RAID 5 and RAID 6 offer striping with single and double parity respectively. Common confusions include swapping mirroring and striping descriptions.

Answer

RAID 5: Mirroring with parity, provides high performance and fault tolerance.

Answer

RAID 1: Striping without parity, maximizes storage capacity.

Question 4

An administrator creates a new XFS filesystem on /dev/vg/data and needs to mount it at /data with noatime and a stripe unit of 1 MiB. Which /etc/fstab entry is correct?

Accepted Answer

/dev/vg/data /data xfs defaults,noatime,sunit=2048 0 0. The `sunit` mount option specifies the stripe unit in 512-byte blocks. A stripe unit of 1 MiB equals 2048 blocks (1 MiB = 1024 KiB = 2048 * 512 bytes). The `noatime` option disables access time updates. This entry correctly mounts the XFS filesystem at /data with the required parameters.

Answer

/dev/vg/data /data xfs defaults,noatime,swidth=2048 0 0

Answer

/dev/vg/data /data xfs defaults,noatime,allocsize=1m 0 0

Answer

/dev/vg/data /data xfs defaults,noatime,sunit=1024 0 0

Question 5

Windows clients cannot see the Samba server in Network Neighborhood, but they can access shares by typing the UNC path. Which Samba daemon must be running?

Accepted Answer

nmbd. The nmbd daemon is responsible for NetBIOS name resolution and browsing, which enables Windows clients to discover Samba servers in Network Neighborhood. When nmbd is not running, clients can still connect via UNC paths because smbd handles file sharing directly, but browsing and name resolution fail.

Answer

smbd

Answer

samba

Answer

winbindd

Question 6

Arrange the steps to configure a Linux system as a PostgreSQL database server.

Accepted Answer

Install PostgreSQL, then initialize the database cluster, then start the PostgreSQL service, then create a user and database, then test the connection.. The correct order to configure a Linux system as a PostgreSQL database server is: install PostgreSQL, initialize the database cluster using initdb, start the PostgreSQL service, create a database user and database, and then test the connection. Each step depends on the previous one; for example, starting the service requires the cluster to exist, and creating users requires the service to be running.

Answer

Install PostgreSQL, then start the PostgreSQL service, then initialize the database cluster, then create a user and database, then test the connection.

Answer

Install PostgreSQL, then initialize the database cluster, then create a user and database, then start the PostgreSQL service, then test the connection.

Answer

Install PostgreSQL, then start the PostgreSQL service, then create a user and database, then initialize the database cluster, then test the connection.

Question 7

A system administrator needs to add a kernel module to the kernel at runtime without recompiling. Which command should be used?

Accepted Answer

insmod. The correct command is `insmod` because it inserts a kernel module into the running kernel without recompiling. It directly loads the specified module file (e.g., `.ko` file) into the kernel, making it available immediately. This is the standard low-level command for adding a single module at runtime.

Answer

rmmod

Answer

modprobe

Answer

depmod

Question 8

A system administrator notices that clients on the internal network can resolve the company's web server's hostname (www.example.com) using the internal DNS server (192.168.1.10), but external clients are unable to resolve it. The company uses BIND9 on an Ubuntu server. Which of the following configuration changes should be made on the DNS server to allow external resolution?

Accepted Answer

Add a 'listen-on' statement for the external IP address.. The BIND9 DNS server is likely only listening on the internal IP address (192.168.1.10) by default, so external queries never reach the server. Adding a 'listen-on' statement for the external IP address (e.g., the public IP assigned to the server's external interface) allows BIND to accept and respond to DNS queries from external clients on that address, enabling external resolution of www.example.com.

Answer

Enable recursion by setting 'recursion yes'.

Answer

Set the 'allow-query' option to 'any' in the options block.

Answer

Add an A record for www.example.com in the reverse zone.

Question 9

You are the administrator of a medium-sized company that runs its own authoritative DNS servers for the domain 'company.com'. The primary DNS server is a BIND9 master, and there are two slaves. Recently, you updated the zone file on the master to add a new subdomain 'lab.company.com' with an A record pointing to 10.0.0.10. After the update, you increased the serial number and ran 'rndc reload'. However, after several hours, some external clients report that they cannot resolve 'lab.company.com'. You check the master server and find that the zone file contains the new record. You also check the slave servers and find that they still have the old zone data. The serial number on the master is 2025011501, while the slaves show 2025011400. The master's syslog shows no errors. The slaves' syslogs show 'zone company.com/IN: Transfer started.' but no completion messages. Firewall rules allow TCP and UDP port 53 between all DNS servers. What should you do to resolve the issue?

Accepted Answer

Run 'rndc notify company.com' on the master to force sending NOTIFY messages to the slaves.. The master's syslog shows no errors and the slaves' logs indicate a transfer started but never completed, which suggests the NOTIFY messages were sent but the slaves may have missed or ignored them due to a transient issue. Running 'rndc notify company.com' forces the master to re-send NOTIFY messages to all configured slaves, prompting them to initiate a zone transfer immediately, which should update the stale zone data on the slaves.

Answer

Check the 'allow-transfer' ACL on the master; it might be restricting transfers to the slaves.

Answer

Increase the serial number again on the master to a higher value and wait for the slaves to refresh.

Answer

Restart the BIND service on the slave servers.

Question 10

An administrator wants to restrict SSH access to a server so that only users from the domain 'example.com' can connect. Which file and syntax should be used with TCP Wrappers?

Accepted Answer

Add to /etc/hosts.allow: sshd: .example.com. TCP Wrappers uses the /etc/hosts.allow file to grant access based on daemon: client patterns. The syntax 'sshd: .example.com' restricts SSH access to clients whose hostnames end with '.example.com', which matches all hosts in the 'example.com' domain. This is the standard way to allow only users from a specific domain to connect via SSH using TCP Wrappers.

Answer

Add to /etc/hosts.deny: sshd: ALL

Answer

Add to /etc/hosts.allow: ALL: .example.com

Answer

Add to /etc/hosts.allow: sshd: ALLOW .example.com

Question 11

To ensure that OpenVPN clients authenticate the server, which configuration directive should be present on the client side?

Accepted Answer

ca. The `ca` directive on the client side specifies the Certificate Authority (CA) certificate file that the client uses to verify the server's certificate during the TLS handshake. This ensures the client authenticates the server's identity, preventing man-in-the-middle attacks. Without this, the client cannot validate that it is connecting to a trusted OpenVPN server.

Answer

tls-verify

Answer

tls-auth

Answer

cert

Question 12

Which directive in dhcpd.conf sets the maximum lease time?

Accepted Answer

max-lease-time. The `max-lease-time` directive in `dhcpd.conf` explicitly sets the maximum lease time (in seconds) that the DHCP server will assign to a client, overriding any client request for a longer lease. This ensures the server enforces an upper bound on lease duration, preventing clients from monopolizing IP addresses indefinitely.

Answer

option lease-time

Answer

default-lease-time

Answer

lease-time

Question 13

An administrator configures LDAP authentication on a Linux client. After making changes to /etc/nsswitch.conf and /etc/pam.d/system-auth, users can log in but cannot execute commands like 'id username'. What is the most likely cause?

Accepted Answer

nsswitch.conf lacks 'ldap' for passwd. The 'id username' command relies on the Name Service Switch (NSS) to resolve user and group information from configured sources. If 'ldap' is not listed for the 'passwd' database in /etc/nsswitch.conf, the system will not query the LDAP server for user account details, even though PAM may have been configured to authenticate against LDAP. This mismatch allows login (via PAM) but prevents user attribute lookups (via NSS).

Answer

LDAP server is not reachable

Answer

LDAP binddn is missing

Answer

PAM configuration is incorrect

Question 14

Which two commands correctly configure SSH to disable root login? (Select two.)

Accepted Answer

echo "DenyUsers root" >> /etc/ssh/sshd_config. `DenyUsers root` in `/etc/ssh/sshd_config` explicitly prevents the root user from logging in via SSH, regardless of other authentication methods. Option E is correct because `PermitRootLogin no` directly disables all root SSH logins (password, key, or otherwise) in the SSH server configuration. Both directives require a subsequent restart or reload of the sshd service to take effect.

Answer

usermod -L root

Answer

echo "PermitRootLogin without-password" >> /etc/ssh/sshd_config

Answer

echo "PermitRootLogin yes" >> /etc/ssh/ssh_config

Question 15

Which file is used by the NetworkManager daemon to store connection profiles on a Linux system?

Accepted Answer

/etc/NetworkManager/system-connections/. NetworkManager stores per-connection profiles in the `/etc/NetworkManager/system-connections/` directory. Each profile is a keyfile (`.nmconnection` file) containing connection parameters such as SSID, security settings, and IP configuration. When NetworkManager starts or a connection is modified, it reads and writes these files to persist network configurations across reboots.

Answer

/etc/sysconfig/network-scripts/

Answer

/etc/netctl/

Answer

/etc/systemd/network/