LPIC-2 Practice Test 28 — 15 Questions

Question 1

A systems administrator is troubleshooting a server that fails to boot after a kernel upgrade. The boot process hangs at the stage where the kernel attempts to mount the root filesystem. Which of the following is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The root= parameter in the kernel command line points to a non-existent device.. When the kernel fails to mount the root filesystem during boot, the most common cause is an incorrect or missing `root=` parameter in the kernel command line. This parameter specifies the device (e.g., `/dev/sda1` or `UUID=...`) that the kernel should mount as the root filesystem; if it points to a non-existent device, the kernel cannot proceed past the mount stage, resulting in a hang or kernel panic.

Answer

The root filesystem is formatted with an unsupported filesystem type.

Answer

The initrd image is missing from the /boot partition.

Answer

The GRUB bootloader is not installed on the MBR.

Question 2

A technician is troubleshooting a system that fails to boot after adding a new SATA SSD and editing /etc/fstab. The error message is 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(8,17)'. What is the most likely issue?

Accepted Answer

The root filesystem UUID in /etc/fstab is incorrect.. The error 'unknown-block(8,17)' indicates the kernel cannot find the root filesystem. Block device 8,17 corresponds to /dev/sdb1 (major 8 for SCSI/SATA, minor 17). The most likely cause is an incorrect UUID in /etc/fstab, which prevents the system from mounting the root partition. The kernel can see the device, but the mount fails because the UUID specified does not match any available partition.

Answer

The kernel image is missing.

Answer

The kernel lacks SATA driver support.

Answer

The initramfs was not regenerated after adding the disk.

Question 3

A company has a Linux server with two network interfaces: eth0 connected to the internal 192.168.1.0/24 network, and eth1 connected to the internet via a public IP of 203.0.113.10. The server runs a web server on port 80 and needs to allow internal clients to access the internet while hiding their private IPs (MASQUERADE). Additionally, external users should be able to reach the web server using the public IP. The administrator has enabled IP forwarding and configured iptables with the following rules:

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

However, internal clients can access the internet, but external users cannot reach the web server. What should the administrator do to fix the issue?

Accepted Answer

Add a DNAT rule in the PREROUTING chain of the nat table to translate destination 203.0.113.10:80 to 192.168.1.100:80.. The current iptables rules perform SNAT/MASQUERADE for outbound traffic and allow forwarding of related/established inbound traffic, but they do not redirect incoming connections destined for the public IP (203.0.113.10:80) to the internal web server (e.g., 192.168.1.100:80). A DNAT rule in the PREROUTING chain of the nat table is required to translate the destination address and port, so that external packets are forwarded to the internal server and the response traffic is handled by the existing MASQUERADE rule.

Answer

Add a FORWARD rule to allow new connections from eth1 to eth0.

Answer

Add a rule in the INPUT chain to accept traffic on port 80.

Answer

Change the MASQUERADE rule to SNAT with the public IP.

Question 4

Refer to the exhibit. What does the output indicate about the user John Doe's access to the file report.txt?

Accepted Answer

The user has a read lock with no deny mode.. The output shows that John Doe has a read lock on report.txt with no deny mode, meaning other processes can still read the file while he holds the lock. This is indicated by the lock type 'R' (read) and the absence of a deny mode (deny mode 'NONE'). In Samba, a read lock with no deny mode allows concurrent read access but prevents write access from other clients.

Answer

The user has a lease lock.

Answer

The file is opened for writing.

Answer

The user has an exclusive write lock.

Question 5

During boot, the system displays 'unable to mount root fs on unknown-block'. What is the most likely cause?

Accepted Answer

Missing filesystem driver in initramfs. The error 'unable to mount root fs on unknown-block' indicates that the kernel cannot find a driver for the filesystem or block device containing the root filesystem. This typically occurs when the initramfs lacks the necessary kernel module (e.g., ext4, xfs, or a storage controller driver like ahci or nvme) to access the root device. The initramfs is responsible for loading essential drivers before the kernel mounts the real root filesystem; if the driver is missing, the mount fails.

Answer

Corrupted init binary

Answer

Wrong block device order

Answer

Incorrect root= parameter

Question 6

An administrator notices that clients are unable to obtain IP addresses from the DHCP server. The server logs show 'no free leases' error. What is the most likely cause?

Accepted Answer

The DHCP server's address range is exhausted.. The 'no free leases' error indicates that the DHCP server has exhausted all available IP addresses in its configured pool. This occurs when the address range defined in the dhcpd.conf file has been fully allocated to clients and no leases are available for new requests. The server logs confirm this specific condition, making address exhaustion the most likely cause.

Answer

The DHCP server's subnet declaration does not match the client's network.

Answer

The dhcpd.conf file has invalid syntax.

Answer

The DHCP relay agent is misconfigured.

Question 7

A company runs a critical database server on a Linux system. The server is subject to a strict compliance policy that requires all commands executed by the database administrator (user 'dbadmin') to be logged. Additionally, any attempt to change the system time must be logged regardless of the user. The administrator has configured auditd and added the following rules: -w /usr/bin -p x -k binary_exec, -a always,exit -F arch=b64 -S adjtimex -F key=time_change. However, during a compliance audit, it is discovered that not all commands executed by dbadmin are being logged. Which of the following is the most likely cause?

Accepted Answer

The rule -w /usr/bin -p x only monitors executables in /usr/bin, not commands in other directories or built-in shell commands.. The rule `-w /usr/bin -p x` only monitors execution of binaries located in `/usr/bin`. Commands executed from other directories (e.g., `/usr/local/bin`, `/opt`, or built-in shell commands like `cd` or `alias`) are not captured. Additionally, the rule does not log commands run via absolute paths outside `/usr/bin` or scripts executed by interpreters, leaving gaps in the audit trail for dbadmin's activities.

Answer

The auditd logs are being overwritten because the audit log file size is too small.

Answer

The auditd service is not running because the kernel was not compiled with audit support.

Answer

The adjtimex syscall rule is incorrect and prevents other rules from being processed.

Question 8

Refer to the exhibit. A system administrator has configured the above in /etc/default/grub. After running update-grub, what will be the boot menu behavior?

Accepted Answer

The menu will be displayed for 10 seconds, then the default entry boots automatically.. The configuration shown in /etc/default/grub includes GRUB_TIMEOUT=10 and GRUB_TIMEOUT_STYLE=menu (or the default style if unset). After running update-grub, the boot menu will be displayed for 10 seconds, and then the default entry (set by GRUB_DEFAULT) will boot automatically. This is the standard behavior when GRUB_TIMEOUT is set to a positive integer and the timeout style is 'menu'.

Answer

The boot menu will be hidden for 0 seconds (i.e., not hidden), and the default entry boots immediately.

Answer

The menu will be displayed but with no timeout; it will wait indefinitely for user input.

Answer

The boot menu will be hidden unless Shift is pressed, and the default entry will boot after 10 seconds.

Question 9

To create a simple bridge interface that connects two Ethernet interfaces, which of the following commands should be used?

Accepted Answer

ip link add br0 type bridge && ip link set br0 up. The `ip link add br0 type bridge` command creates a new bridge interface using the modern iproute2 suite, and `ip link set br0 up` activates it. This is the current standard method for bridge creation on Linux, replacing the older brctl tool. The bridge then connects Ethernet interfaces by enslaving them with `ip link set eth0 master br0`.

Answer

brctl addbr br0 && brctl addif br0 eth0 eth1

Answer

ifconfig br0 create && ifconfig br0 up

Answer

Both A and B work correctly

Question 10

An administrator wants to encrypt a file so that only a specific recipient can decrypt it. Which GPG command should be used?

Accepted Answer

gpg --encrypt --recipient key-id file. The `--encrypt` flag with `--recipient key-id` uses the recipient's public key to encrypt the file, ensuring that only the holder of the corresponding private key can decrypt it. This is the standard asymmetric encryption workflow in GPG for targeted confidentiality.

Answer

gpg --symmetric file

Answer

gpg --clearsign file

Answer

gpg --sign file

Question 11

A user authenticates via LDAP successfully, but 'getent passwd' only shows local users. What is the problem?

Accepted Answer

The LDAP server is not responding for passwd queries.. The user can authenticate via LDAP (which typically uses the 'auth' or 'account' NSS modules) but 'getent passwd' only shows local users, indicating that the NSS 'passwd' map is not querying the LDAP server. This means the LDAP server is either unreachable for passwd queries or the NSS configuration for the 'passwd' database is misconfigured (e.g., missing 'ldap' in /etc/nsswitch.conf for passwd). The successful authentication suggests the LDAP server is reachable for authentication purposes, but the passwd map query fails, often due to a separate LDAP server or service issue specific to user/group lookups.

Answer

The ldap entry should be before files.

Answer

The shadow map is missing LDAP.

Answer

The nscd cache needs to be cleared.

Question 12

After adding a new network interface, the system assigns it the name 'enp0s3' instead of 'eth0'. Which of the following best describes the reason for this change?

Accepted Answer

The system uses the new predictable network interface naming scheme.. The system uses the predictable network interface naming scheme (also known as Consistent Network Device Naming), introduced in systemd/udev. This scheme assigns names like 'enp0s3' based on the physical location of the device (e.g., 'en' for Ethernet, 'p0' for PCI bus 0, 's3' for slot 3), replacing the traditional 'eth0' naming that could change unpredictably across reboots or hardware additions.

Answer

The kernel assigns names randomly to avoid conflicts.

Answer

The network card is faulty, causing the kernel to rename it.

Answer

The interface is a virtual device, so it gets a non-standard name.

Question 13

A company runs a high-frequency trading application that requires extremely low latency. The system administrator has compiled a custom Linux kernel with various real-time patches and tuned kernel parameters. After deploying the new kernel, the application performance degrades significantly. The administrator suspects that kernel preemption settings are causing context switch overhead. Which of the following actions should the administrator take to diagnose and optimize the kernel preemption model?

Accepted Answer

Check /proc/sched_debug for preemption counters and adjust the kernel's preemption model by recompiling with CONFIG_PREEMPT_NONE instead of CONFIG_PREEMPT. The kernel preemption model is a compile-time configuration, not a runtime parameter. To change from CONFIG_PREEMPT (full preemption) to CONFIG_PREEMPT_NONE (no forced preemption), the administrator must recompile the kernel with the appropriate configuration. Checking /proc/sched_debug can reveal preemption-related counters and context switch statistics, helping confirm that excessive preemption is causing overhead.

Answer

Use sysctl to set 'kernel.preempt_model' to 'none'

Answer

Add 'preempt=none' to the kernel command line

Answer

Change the kernel preemption model at runtime by writing to /sys/kernel/preempt_control

Question 14

A system has multiple kernels installed. Which command shows the version of the currently booted kernel?

Accepted Answer

uname -r. The `uname -r` command specifically displays the kernel release (version) of the currently running operating system. It reads this information directly from the `/proc/sys/kernel/osrelease` virtual file, which is populated by the kernel at boot time. This makes it the most direct and reliable method to identify the active kernel version.

Answer

rpm -qa | grep kernel

Answer

cat /proc/version

Answer

ls /boot

Question 15

A Linux router is experiencing packet loss for connections that should be forwarded. The router's IP forwarding is enabled, and the routing table is correct. Which kernel parameter is most likely causing the issue?

Accepted Answer

net.ipv4.conf.all.rp_filter. The `net.ipv4.conf.all.rp_filter` parameter enables Reverse Path Filtering (RPF), which drops packets arriving on an interface if the kernel does not have a route back to the source IP via that same interface. On a router forwarding traffic between networks, strict RPF can cause packet loss when asymmetric routing is present, even though IP forwarding and the routing table are correct.

Answer

net.ipv4.conf.all.log_martians

Answer

net.ipv4.conf.all.accept_redirects

Answer

net.ipv4.ip_forward