LPIC-2 Practice Test 29 — 15 Questions

Question 1

A system administrator needs to ensure that a custom kernel module loads automatically at boot. The module is named 'my_driver' and is built for the current kernel. Which configuration file should be modified to ensure the module loads automatically?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a configuration file in /etc/modules-load.d/. Systemd-based Linux distributions use /etc/modules-load.d/ to specify kernel modules that should be loaded automatically at boot. Placing a configuration file (e.g., my_driver.conf) containing the module name 'my_driver' in this directory instructs systemd-modules-load.service to load the module during early boot. This is the modern, distribution-agnostic method for ensuring a custom kernel module loads automatically.

Answer

Add the insmod command in /etc/rc.local

Answer

Add the module name to /etc/modules.conf

Answer

Add a configuration file in /etc/modprobe.d/

Question 2

A server with IP 10.0.0.1 needs to forward packets from network 192.168.1.0/24 to 10.0.0.0/24. The administrator runs: 'iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j MASQUERADE'. However, traffic from 192.168.1.0/24 cannot reach 10.0.0.0/24. What is the most likely missing configuration?

Accepted Answer

The FORWARD chain in the filter table must have a rule to allow traffic.. The MASQUERADE rule in the POSTROUTING chain handles source NAT, but it does not automatically allow forwarding of packets. By default, the FORWARD chain in the filter table has a policy of DROP or lacks an explicit ACCEPT rule. Without a rule like `iptables -A FORWARD -s 192.168.1.0/24 -d 10.0.0.0/24 -j ACCEPT`, the kernel's netfilter will drop the forwarded packets, preventing traffic from reaching the destination.

Answer

A DNAT rule is also needed to translate the destination address.

Answer

A route must be added on the 10.0.0.0/24 network pointing back to 10.0.0.1.

Answer

The IP address 10.0.0.1 is not configured on the external interface.

Question 3

A system administrator notices that the default gateway is missing after a reboot. The network configuration uses ifup/ifdown scripts. Which file should be modified to ensure the default gateway is persistent?

Accepted Answer

/etc/network/interfaces. On Debian-based systems using ifup/ifdown scripts, persistent network configuration—including the default gateway—is defined in /etc/network/interfaces. The gateway is set with the 'gateway' directive under the appropriate interface stanza, ensuring it is applied automatically on boot. This file is the central configuration source for the ifupdown suite.

Answer

/etc/resolv.conf

Answer

/etc/network/routes

Answer

/etc/sysconfig/network

Question 4

A system fails to boot with the error shown. Which kernel parameter should be added to the kernel command line to resolve the issue?

Accepted Answer

rootdelay=10. The error indicates that the system cannot find the root filesystem, often because the storage device is not ready when the kernel attempts to mount it. Adding `rootdelay=10` instructs the kernel to wait 10 seconds before attempting to mount the root device, giving USB, SCSI, or other slow-to-probe controllers time to initialize. This is a common fix for boot failures on systems with external or hot-pluggable storage.

Answer

root=/dev/sda1

Answer

noprompt

Answer

rootfstype=ext4

Answer

single

Question 5

A Samba administrator notices that Windows clients cannot access a shared directory. The share is defined in smb.conf as follows:

[shared]
path = /srv/samba/shared
valid users = @staff
browseable = yes
read only = no

The /srv/samba/shared directory has permissions 755 and is owned by root:staff. Which is the most likely cause of the access issue?

Accepted Answer

The 'staff' group lacks write permission on the directory. The 'staff' group lacks write permission on the directory because the directory has permissions 755, which grants write access only to the owner (root). Even though the share is defined as 'read only = no', Samba enforces filesystem-level permissions. Since the 'valid users = @staff' restricts access to members of the staff group, they need write permission on the directory to create or modify files. The group 'staff' has only read and execute permissions (r-x), so write operations fail.

Answer

The 'valid users' parameter is misspelled

Answer

The share is defined as browseable but not listed

Answer

SELinux is blocking access and must be disabled

Question 6

After modifying smb.conf, which command should be used to verify the configuration syntax before restarting Samba?

Accepted Answer

testparm. The correct command is `testparm`, which is specifically designed to parse and validate the syntax of the Samba configuration file `smb.conf`. It checks for errors such as misspelled parameters, invalid values, or structural issues without requiring the Samba services to be restarted. This ensures that any syntax problems are caught before applying changes to the running Samba daemons (smbd, nmbd, winbindd).

Answer

net conf

Answer

smbpasswd

Answer

smbcontrol

Question 7

A packet destined to 192.168.1.100 is sent from this router. Which interface will be used to forward it?

Accepted Answer

The packet will be dropped. Without a routing table or interface IP configuration provided, we cannot assume any interface is on the 192.168.1.0/24 network. By default, if a router has no route to a destination, it will drop the packet. Therefore, the packet will be dropped.

Answer

eth0

Answer

lo

Answer

eth1

Question 8

You are a network administrator for a medium-sized company. The company has a Linux server acting as a router/firewall with three network interfaces: eth0 (public, 203.0.113.2/24, gateway 203.0.113.1), eth1 (DMZ, 10.0.1.1/24), and eth2 (internal, 192.168.1.1/24). The DMZ hosts a web server with IP 10.0.1.100, and the internal network has client machines. The firewall rules are currently set to default DROP on INPUT and FORWARD, ACCEPT on OUTPUT. The administrator wants to allow internal clients (192.168.1.0/24) to access the web server (10.0.1.100) on port 80. Additionally, the administrator wants to allow external users (from the internet) to access the web server's public IP (203.0.113.2) on port 80, which should be DNATed to 10.0.1.100. The administrator has enabled IP forwarding and added the following rules:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.0.1.100:80
iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp --sport 80 -j ACCEPT

Internal clients cannot access the web server. External users are able to access the web server successfully. What is the most likely reason internal clients cannot access the web server?

Accepted Answer

The DNAT rule does not apply to traffic coming from the internal network because it is not received on eth0.. The DNAT rule is placed in the PREROUTING chain of the nat table, which only processes packets arriving on the specified interface (eth0). Internal clients (192.168.1.0/24) sending traffic to the web server (10.0.1.100) do not enter via eth0; they are routed through eth2. Therefore, the DNAT rule never matches their packets, and the destination remains 10.0.1.100, which is directly reachable without NAT. However, the FORWARD rules only allow traffic from eth0 to eth1 and back, so internal client traffic from eth2 to eth1 is implicitly dropped by the default FORWARD policy, causing the failure.

Answer

The web server cannot route back to the internal clients because it is in the DMZ.

Answer

The FORWARD rule for return traffic does not match because the destination is the client.

Answer

IP forwarding is not enabled for the internal interface.

Question 9

An administrator wants to enhance the security of a web server running Apache. Which TWO of the following actions are recommended best practices?

Accepted Answer

Disable directory listing in the Apache configuration using Options -Indexes.. Disabling directory listing with `Options -Indexes` prevents Apache from generating a list of files in directories that lack an index file (e.g., index.html). This is a fundamental security hardening step that reduces information disclosure about the web server's file structure, which could be leveraged by an attacker to find sensitive files or configuration details. Option D is correct because running Apache worker processes as a non-root user (e.g., www-data) minimizes the impact of a potential security breach. If an attacker compromises a worker process, they will not have root privileges, limiting the damage. This is a principle of least privilege and a standard security best practice.

Answer

Enable the mod_info module to monitor server configuration.

Answer

Enable .htaccess files to allow per-directory configuration changes.

Answer

Enable the HTTP TRACE method for debugging purposes.

Question 10

Which TWO of the following are valid ways to map a Windows user to a Linux account in Samba?

Accepted Answer

Using a 'username map' file specified by the 'username map' parameter. The 'username map' parameter in smb.conf specifies a file (e.g., /etc/samba/smbusers) that maps Windows usernames to Linux usernames, allowing Samba to translate incoming Windows user credentials to a corresponding Linux account. Option B is correct because 'force user' in a share definition forces all connections to that share to run as a specific Linux user, effectively mapping any Windows user to that Linux account for file operations. Both are valid ways to map Windows users to Linux accounts in Samba.

Answer

Using the 'map user' command in smbpasswd

Answer

Setting 'winbind use default domain = yes'

Answer

Using the 'valid users' directive in smb.conf

Question 11

Which file contains the filesystem table that is read during system boot to mount filesystems?

Accepted Answer

/etc/fstab. /etc/fstab is the filesystem table file that is read by the system during boot (via mount -a or systemd-fstab-generator) to automatically mount filesystems. It contains entries specifying devices, mount points, filesystem types, mount options, dump and pass fields, and is the standard configuration file for static filesystem mounting.

Answer

/etc/mtab

Answer

/proc/mounts

Answer

/etc/mounts

Question 12

A company is migrating from Apache HTTPD 2.2 to 2.4 and needs to configure SSL for a virtual host. The administrator wants to use modern security practices. Which of the following configurations is the most secure and recommended for Apache 2.4?

Accepted Answer

SSLEngine on; SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1; SSLCipherSuite HIGH:!aNULL:!MD5. It explicitly enables only TLS 1.2 and TLS 1.3 (by disabling SSLv3, TLSv1.0, and TLSv1.1) and uses the HIGH cipher suite with exclusion of aNULL (anonymous NULL ciphers) and MD5 (weak hash). This aligns with modern security standards (e.g., PCI DSS, NIST) and Apache 2.4's recommended hardening practices, avoiding deprecated protocols and weak ciphers.

Answer

SSLEngine on; SSLProtocol -SSLv2 -SSLv3; SSLCipherSuite MEDIUM:!aNULL

Answer

SSLEngine on; SSLProtocol TLSv1.2 TLSv1.3; SSLCipherSuite ECDHE+AESGCM

Answer

SSLEngine on; SSLProtocol all; SSLCipherSuite DEFAULT

Question 13

Which command can be used to trace the delegation path of a DNS domain?

Accepted Answer

dig +trace. The `dig +trace` command performs a full iterative DNS resolution from the root nameservers down to the authoritative nameservers for the queried domain, showing each delegation step. The `host -C` command is not a delegation tracing tool; it only queries SOA records from authoritative servers and does not follow the delegation chain. Therefore, only `dig +trace` is correct.

Answer

nslookup -type=any

Answer

host -C

Answer

dig -x

Answer

whois

Question 14

A Linux server provides file sharing to Windows clients via Samba. The administrator notices that Windows clients are unable to resolve the NetBIOS name of the server. Which two services are essential for NetBIOS name resolution? (Choose two.)

Accepted Answer

nmbd. NetBIOS name resolution is handled by the nmbd daemon, which listens for and responds to NetBIOS name queries on UDP ports 137 and 138. Without nmbd, Windows clients cannot resolve the server's NetBIOS name. The smbd daemon provides file sharing services but does not participate in NetBIOS name resolution.

Answer

DNS

Answer

DHCP

Answer

winbindd

Answer

smbd

Question 15

An administrator needs to extend an ext4 filesystem on logical volume 'home' by 5 GB. The volume group 'vg' has free extents. Which sequence of commands is correct?

Accepted Answer

lvresize -L +5G /dev/vg/home; e2fsck -f /dev/vg/home; resize2fs /dev/vg/home. The correct sequence is to first extend the logical volume by the required size using `lvresize -L +5G` (or `lvextend`), optionally check the filesystem with `e2fsck -f`, and then resize the filesystem with `resize2fs`. This ensures the filesystem can utilize the newly allocated space. Option A is incorrect because it extends by all free extents, not exactly 5 GB. Option B reverses the order, which fails because `resize2fs` cannot extend beyond the current block device. Option C uses `mount -o remount`, which does not resize the filesystem.

Answer

lvextend -l +100%FREE /dev/vg/home; resize2fs /dev/vg/home

Answer

resize2fs /dev/vg/home; lvextend -L +5G /dev/vg/home

Answer

lvextend -L +5G /dev/vg/home; mount -o remount /dev/vg/home