LPIC-2 Practice Test 27 — 15 Questions

Question 1

A company's mail server (Postfix) is rejecting incoming emails from a trusted partner with the error '550 5.7.1 Service unavailable; Client host [203.0.113.50] blocked using zen.spamhaus.org'. The partner's IP is not listed on any public DNSBL. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The partner's SMTP server does not have a valid PTR record for its IP, and Postfix has reject_unknown_client_hostname enabled.. The error message indicates a block using zen.spamhaus.org, but the partner's IP is not listed on any public DNSBL. This rules out options B and C because a DNSBL listing or greylisting would not produce this exact error. Option A (SPF misconfiguration) is unlikely because SPF failures typically produce a different error message (e.g., '550 5.7.1 SPF check failed'). The most plausible cause is option D: the partner's SMTP server lacks a valid PTR record, triggering Postfix's reject_unknown_client_hostname restriction. Postfix can be configured to display a custom rejection message, and the administrator may have set it to reference zen.spamhaus.org as a deterrent. Therefore, the missing PTR record is the most likely cause.

Answer

The partner's SPF record is misconfigured, causing Postfix to reject the email.

Answer

The partner's IP is listed on a local DNSBL that is aggregated with zen.spamhaus.org.

Answer

The mail server is using greylisting and the partner's server has not retried.

Question 2

A system administrator needs to create a new 500 MB ext4 filesystem on /dev/sdb1 and mount it persistently at /data. Which set of commands accomplishes this task?

Accepted Answer

mkfs.ext4 /dev/sdb1 && echo '/dev/sdb1 /data ext4 defaults 0 2' >> /etc/fstab && mount -a. It first creates an ext4 filesystem on /dev/sdb1 using mkfs.ext4, then appends a mount entry to /etc/fstab with the correct filesystem type (ext4) and mount point (/data), and finally runs mount -a to mount all filesystems from fstab, including the new one. This sequence ensures the filesystem is created, persistently configured, and immediately mounted.

Answer

mkfs -t ext4 /dev/sdb1 && mount /dev/sdb1 /data

Answer

blkid /dev/sdb1 && echo 'UUID=... /data ext4 defaults 0 2' >> /etc/fstab && mount -a

Answer

mkfs.xfs /dev/sdb1 && echo '/dev/sdb1 /data xfs defaults 0 2' >> /etc/fstab && mount -a

Question 3

A company runs a web application on a Linux server that uses Apache, MySQL, and PHP. The application stores sensitive user data in a MySQL database. The security team has detected that the MySQL service is listening on port 3306 on all interfaces (0.0.0.0). The application and database are on the same server, so there is no need for remote database access. The administrator must secure the MySQL service without breaking the application. Which of the following is the most appropriate course of action?

Accepted Answer

Edit the MySQL configuration file (my.cnf) and set bind-address = 127.0.0.1, then restart the MySQL service.. Setting bind-address = 127.0.0.1 in the MySQL configuration file (my.cnf) instructs the MySQL server to listen only on the loopback interface, which prevents remote connections while still allowing local applications (Apache/PHP) to connect via the local socket or TCP to 127.0.0.1. This directly addresses the security concern of exposing the database on all interfaces without breaking the application, as the application and database reside on the same server.

Answer

Change the MySQL default port to a non-standard port to avoid automated scans.

Answer

Disable the MySQL network entirely by commenting out the 'skip-networking' directive in my.cnf.

Answer

Use iptables to add a rule dropping incoming packets to port 3306 from all IPs except 127.0.0.1.

Question 4

A client mounts the export with 'mount -t nfs server:/data /mnt/data' and root on the client can write files. Which option in /etc/exports allows root to retain its privileges?

Accepted Answer

no_root_squash. (no_root_squash) is correct because it prevents the NFS server from mapping the client's root user (UID 0) to the anonymous 'nobody' user. By default, NFS exports use root_squash, which maps root to an unprivileged user for security. With no_root_squash, the client's root retains UID 0 on the server, allowing write access to files owned by root on the export.

Answer

root_squash

Answer

rw

Answer

async

Question 5

Which TWO tools can be used to configure network interfaces on a Linux system?

Accepted Answer

nmcli. A is correct because `nmcli` is the command-line tool for controlling NetworkManager, which is the standard service for managing network interfaces on modern Linux distributions. It allows you to create, modify, and activate or deactivate network connections, making it a primary tool for interface configuration.

Answer

route

Answer

ifconfig

Answer

netstat

Question 6

Which two utilities can be used to load kernel modules? (Choose two.)

Accepted Answer

modprobe. modprobe is correct because it is the primary utility for loading kernel modules, including handling module dependencies automatically by consulting the modules.dep file generated by depmod. insmod is also correct because it directly inserts a single module into the kernel, though it does not resolve dependencies automatically.

Answer

modinfo

Answer

lsmod

Answer

depmod

Question 7

A company wants to set up a Linux bridge to connect a wireless interface (wlan0) to a wired interface (eth0) to allow devices on the wired network to access the internet through the wireless uplink. The Linux server runs Debian with hostapd to create an access point on wlan0. The administrator creates a bridge br0 using brctl and adds eth0 and wlan0 as ports. They assign IP 192.168.10.1/24 to br0 and start hostapd. Clients on the wired network can access the internet, but cannot ping clients on the wireless network, and vice versa. The administrator verifies that both interfaces are enslaved to br0 (brctl show shows both). They also confirm that IP forwarding is enabled and there are no iptables rules blocking anything. Which of the following is the most likely cause?

Accepted Answer

The wireless interface wlan0 is not set to 4-address mode (WDS) to allow bridging.. A is correct because a standard wireless interface (station mode) uses 3-address frames (source, destination, BSSID) and drops frames with a fourth address, which is required for bridging. When a bridge forwards a frame from the wired side to the wireless side, it uses the MAC addresses of the original source and destination, but the wireless medium requires the fourth address (the transmitter address) to identify the bridge itself. Without enabling 4-address mode (WDS) on wlan0, the wireless driver will reject these bridged frames, preventing communication between wired and wireless clients.

Answer

The DHCP server is only listening on the bridge interface, not on the individual interfaces.

Answer

The hostapd configuration is missing the 'bridge' parameter to bind to the bridge.

Answer

The iptables firewall is blocking broadcast traffic between bridge ports.

Question 8

A server with multiple network cards needs a specific kernel module loaded before network configuration. Where should loading be configured for early boot?

Accepted Answer

/etc/modules-load.d/. Systemd-based systems use /etc/modules-load.d/ to specify kernel modules that must be loaded early in the boot process, before network configuration. Files in this directory are processed by systemd-modules-load.service, which runs before network services, ensuring the module is available when interfaces are brought up.

Answer

/boot/grub/grub.cfg

Answer

/etc/modprobe.d/

Answer

/etc/sysconfig/modules/

Question 9

To ensure LDAP communication is encrypted, an administrator configures LDAP over SSL (LDAPS) on port 636. Which configuration file on the client should be modified to specify the LDAP server with TLS?

Accepted Answer

/etc/ldap/ldap.conf. The LDAP client configuration file on Linux systems is typically located at /etc/ldap/ldap.conf (or /etc/openldap/ldap.conf on some distributions). This file is used by LDAP client libraries (e.g., libldap) to specify the LDAP server URI, including the use of TLS/SSL via the ldaps:// scheme or the TLS_REQCERT directive. Modifying this file allows the client to connect to an LDAP server over port 636 with encryption.

Answer

/etc/pam_ldap.conf

Answer

/etc/openldap/ldap.conf

Answer

/etc/nsswitch.conf

Question 10

Which TWO are true about the autofs automounter configuration? (Choose two.)

Accepted Answer

The master configuration file is /etc/auto.master.. The autofs automounter uses /etc/auto.master as its master configuration file. This file defines the base directories for automount points and references subordinate map files (e.g., /etc/auto.home) that specify the actual mount details. The automounter daemon (automount) reads this master file to determine which directories to manage and how to mount filesystems on demand.

Answer

Autofs mounts remain indefinitely once accessed.

Answer

Autofs uses /etc/fstab to define automount points.

Answer

Autofs can only be used with NFS filesystems.

Question 11

Which TWO conditions must be met for a Linux bridge to forward Ethernet frames between its ports?

Accepted Answer

The bridge must be in the 'up' state. A Linux bridge must be in the 'up' administrative state (set via `ip link set br0 up`) to forward frames. Without the 'up' state, the bridge will not process or forward any Ethernet frames between its ports, regardless of other configurations.

Answer

Traffic must be allowed by iptables FORWARD chain

Answer

The bridge must have an IP address configured

Answer

Spanning tree must be disabled

Question 12

To list all currently loaded kernel modules, which command is used?

Accepted Answer

lsmod. The correct command to list all currently loaded kernel modules is `lsmod`. It reads the `/proc/modules` file and displays the module name, size, used count, and a list of dependent modules. This is the standard and most direct method on Linux systems.

Answer

kmod -l

Answer

modlist

Answer

modules_loaded

Question 13

Which TWO commands can be used to display the current DNS resolver configuration on a Linux system? (Select TWO.)

Accepted Answer

nmcli dev show. The `nmcli dev show` command displays network device details managed by NetworkManager, including DNS configuration. The `resolvectl status` command shows the current DNS resolver state for systemd-resolved. These two commands provide the actual current resolver configuration. The `cat /etc/resolv.conf` file may be manually edited or dynamically generated and does not necessarily reflect the current resolver state on systems using systemd-resolved or NetworkManager.

Answer

dig localhost

Answer

nslookup

Answer

cat /etc/resolv.conf

Question 14

A new client with IP 10.0.1.15 tries to connect to HTTPS on the server. Based on the exhibit, what happens?

Accepted Answer

The connection is accepted because 10.0.1.15 is in 10.0.0.0/8.. The iptables rule set includes a rule that accepts traffic from the 10.0.0.0/8 subnet. The client IP 10.0.1.15 falls within this range, so the HTTPS connection matches the rule and is accepted. This occurs before any later rules that might drop or reject the traffic.

Answer

The connection is dropped by rule 5.

Answer

The connection is rejected with an ICMP error.

Answer

The connection is accepted only if state RELATED.

Question 15

An administrator wants to implement network bonding for redundancy on a Linux server running RHEL 8. The server has two physical interfaces em1 and em2. The administrator creates a bond interface bond0 with mode active-backup (mode 1) and adds the slaves em1 and em2. They assign IP address 192.168.50.10/24 to bond0 and bring up the bond. The bond appears to work initially, with one slave active. However, when they disconnect the cable from the active slave, the bond does not fail over to the other slave. The administrator checks /proc/net/bonding/bond0 and sees that the link status for both slaves shows 'up' even after the disconnection. They confirm the bonding module is loaded and the mode is correct. Which of the following is the most likely missing configuration?

Accepted Answer

The MII monitoring interval (miimon) is not configured.. In active-backup bonding mode (mode 1), the kernel bonding driver requires the MII (Media Independent Interface) monitoring interval (miimon) to be configured in order to detect link failures. Without miimon, the driver never polls the slave interfaces for link state changes, so even when a cable is disconnected, the driver continues to see the link as 'up' and does not trigger a failover. The administrator must set miimon=100 (or another value in milliseconds) in the bond configuration to enable periodic link monitoring.

Answer

The bond interface requires a specific kernel module that is missing.

Answer

The slave interfaces were not set to 'down' before enslaving.

Answer

The bond mode is set to mode 0 instead of mode 1.