LPIC-2 Practice Test 30 — 15 Questions

Question 1

Which three steps are required to build a kernel module from source located outside the kernel tree? (Choose three.)

Accepted Answer

Run 'make modules_install'.. 'make modules_install' copies the compiled kernel module (.ko file) to the appropriate directory under /lib/modules/$(uname -r)/, making it available for loading. This step is essential after building a module from external source to ensure it is installed in the correct location for the running kernel.

Answer

Edit the kernel configuration.

Answer

Use the kernel's top-level Makefile.

Question 2

A system administrator wants to allow the user 'jdoe' to run the '/usr/bin/systemctl restart httpd' command on a specific server without a password prompt. Which sudoers entry achieves this?

Accepted Answer

jdoe ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart httpd. The NOPASSWD tag in the sudoers entry explicitly allows user 'jdoe' to execute the specified command '/usr/bin/systemctl restart httpd' without being prompted for a password. The syntax 'jdoe ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart httpd' grants passwordless execution for that exact command on any host, which matches the requirement.

Answer

jdoe ALL=(ALL) /usr/bin/systemctl restart httpd

Answer

user ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart httpd

Answer

jdoe ALL=(ALL) ALL

Question 3

Which THREE factors can cause a kernel panic during boot? (Select THREE.)

Accepted Answer

Corrupted kernel image. A corrupted kernel image (Option B) is a direct cause of kernel panic during boot because the bootloader (e.g., GRUB) loads the kernel into memory, and if the binary is damaged (e.g., due to disk errors or incomplete update), the CPU will attempt to execute invalid instructions, triggering a fatal kernel panic. The kernel performs integrity checks early in startup, and any mismatch between expected and actual code will halt the system with a panic message.

Answer

Too many kernel modules loaded

Answer

Filesystem errors on the root partition

Question 4

A web server running Apache httpd is experiencing high load. The administrator suspects that many requests are for non-existent virtual hosts. Which configuration change would reduce the load caused by these requests?

Accepted Answer

Define a default virtual host that returns a 403 Forbidden status code.. Defining a default virtual host that returns a 403 Forbidden status code immediately rejects requests for non-existent hostnames, preventing Apache from wasting resources on processing these requests. This directly reduces server load.

Answer

Enable logging for all virtual hosts to identify the source of requests.

Answer

Increase the MaxClients directive to allow more concurrent connections.

Answer

Disable KeepAlive to reduce the number of requests per connection.

Question 5

Which iptables command is necessary to allow incoming SSH connections (port 22) from the subnet 192.168.1.0/24 while dropping all other incoming traffic? Assume the INPUT chain has a default policy of DROP.

Accepted Answer

iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT. It explicitly allows SSH traffic from the specified subnet before the default DROP policy drops everything else. Option B is not necessary because the INPUT chain already has a default policy of DROP, which drops all unmatched packets. Adding an explicit DROP rule at the end is redundant and not required by the question, which asks for the 'necessary' command.

Answer

iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j DROP

Answer

iptables -A INPUT -j DROP

Answer

iptables -A INPUT -j ACCEPT

Answer

iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

Question 6

A security policy requires that all users must change their passwords every 90 days. Which command enforces maximum password age for an existing user 'jdoe'?

Accepted Answer

chage -M 90 jdoe. The `chage -M 90 jdoe` command sets the maximum number of days a password is valid for user 'jdoe' to 90 days, enforcing the security policy. The `-M` option directly controls the password aging parameter that defines when the password must be changed, as stored in `/etc/shadow`.

Answer

passwd -f jdoe

Answer

usermod -e 90 jdoe

Answer

chage -E 90 jdoe

Question 7

A Linux client is configured with two network interfaces: eth0 (connected to the internet) and eth1 (connected to a private LAN). The default route is set to eth0. The client can access the internet but cannot access hosts on the private LAN. What is the most likely cause?

Accepted Answer

There is no route to the private subnet via eth1.. Without a route to the private subnet via eth1, the client has no way to forward packets destined for the private LAN out of eth1. The default route via eth0 only handles traffic for destinations not explicitly matched by other routes; if the private subnet is not in the routing table, packets to that subnet will be sent to the default gateway (internet) and fail. The `ip route` command would show the missing entry, and adding a static route (e.g., `ip route add 192.168.1.0/24 dev eth1`) resolves the issue.

Answer

A firewall on the client is blocking ICMP packets on eth1.

Answer

The eth1 interface is not configured with an IP address.

Answer

The eth1 interface is not receiving a DHCP lease.

Question 8

Refer to the exhibit. The administrator wants to mount /dev/sdb1 at /data using its UUID. Which /etc/fstab entry is correct?

Accepted Answer

UUID=ijkl-9012 /data ext4 defaults 0 0. The administrator wants to mount /dev/sdb1 using its UUID, and the exhibit (not shown) indicates that the UUID of /dev/sdb1 is 'ijkl-9012'. The correct /etc/fstab syntax uses the 'UUID=' prefix followed by the actual UUID value, the mount point, filesystem type, options, dump, and pass fields. This ensures the filesystem is identified by its universally unique identifier, which remains stable even if the device name changes.

Answer

/dev/sdb1 /data ext4 defaults 0 0

Answer

PARTUUID=ijkl-9012 /data ext4 defaults 0 0

Answer

UUID=12345678-01 /data ext4 defaults 0 0

Question 9

Which TWO network diagnostic steps should be performed to isolate a problem where a Linux server (IP 10.0.0.10/24) cannot reach a remote server (IP 192.168.1.50/24) while other hosts on the same subnet can reach it? Assume routing is properly configured.

Accepted Answer

Check iptables rules for any OUTPUT chain that might be dropping packets.. If the affected server can reach the remote server via other hosts on the same subnet, the issue is likely local to the affected server itself. Checking iptables rules on the OUTPUT chain can reveal whether a firewall rule is specifically dropping outbound packets destined for 192.168.1.50, which would not affect other hosts on the same subnet. This is a common cause of asymmetric connectivity problems where routing is otherwise properly configured.

Answer

Check the routing table on the remote server.

Answer

Ping the remote server from another host on the same subnet to verify connectivity.

Answer

Traceroute to the remote server from the affected server.

Question 10

A user wants to mount a Samba share on a Linux client using the command line. Which utility is used for that purpose?

Accepted Answer

mount.cifs. The correct utility is mount.cifs, which is part of the cifs-utils package. It mounts Samba (SMB/CIFS) shares on Linux clients by using the Common Internet File System (CIFS) protocol, the modern implementation of SMB. The mount command with -t cifs internally calls mount.cifs, making it the standard tool for this purpose.

Answer

mount.smb

Answer

mount -t smbfs

Answer

smbclient

Question 11

Match each kernel parameter to its effect.

Accepted Answer

vm.swappiness: Controls how aggressively the kernel swaps memory pages. The correct matches are: vm.swappiness controls swapping behavior, net.ipv4.ip_forward enables routing. Common confusions: confusing kernel.shmmax with fs.file-max.

Answer

kernel.shmmax: Sets the maximum number of file handles

Answer

fs.file-max: Controls the maximum amount of shared memory

Question 12

Refer to the exhibit. An administrator has applied these iptables rules. Users can still SSH into the server from any IP address, which is unexpected because the administrator intended to restrict SSH to only a specific subnet. What is the most likely reason the restriction is not working?

Accepted Answer

The SSH rule does not specify a source IP, so it accepts connections from any IP.. The SSH ACCEPT rule does not include a source IP specification, so by default iptables matches any source address. The administrator intended to restrict SSH to a specific subnet, but without a `-s` parameter, the rule accepts all incoming SSH connections regardless of origin. The DROP rule for other subnets is never reached because the ACCEPT rule matches first for all SSH traffic.

Answer

The default policy is ACCEPT, so the DROP rule is ignored.

Answer

The conntrack module is not loaded, so the state matching fails.

Answer

The rules are in the wrong order; the DROP rule should be before the SSH rule.

Question 13

Match each network service to its purpose.

Accepted Answer

DNS: Translates domain names to IP addresses. DNS translates domain names to IP addresses; DHCP assigns IP configurations; HTTP serves web pages; NFS shares files. Common confusions involve swapping these roles.

Answer

DNS: Provides network file sharing

Answer

HTTP: Translates domain names to IP addresses

Question 14

Match each Linux boot component to its role.

Accepted Answer

GRUB: Bootloader that loads the kernel and initramfs.. The correct matches are: GRUB loads kernel and initramfs; initramfs is a temporary root filesystem; kernel manages hardware and processes; init/systemd is the first process. Common confusions include MBR being mistaken for a kernel loader and initramfs for GRUB config storage.

Answer

MBR: Loads the Linux kernel.

Answer

initramfs: Contains the GRUB configuration.

Question 15

Match each security tool to its function.

Accepted Answer

iptables: A firewall tool used to set up, maintain, and inspect the tables of IP packet filter rules.. Correct matches: iptables is a firewall, nmap is a network scanner, tcpdump is a packet analyzer. Common confusions include misattributing file integrity checking to iptables, IP banning to nmap, and port scanning to tcpdump.

Answer

iptables: A tool for monitoring file system integrity.

Answer

nmap: A tool for banning IPs after failed login attempts.

Answer

tcpdump: A tool for scanning open ports.