LPIC-2 Practice Test 2 — 30 Questions

Question 1

A security policy requires that all users must change their passwords every 90 days. Which command enforces maximum password age for an existing user 'jdoe'?

Accepted Answer

chage -M 90 jdoe. The `chage -M 90 jdoe` command sets the maximum number of days a password is valid for user 'jdoe' to 90 days, enforcing the security policy. The `-M` option directly controls the password aging parameter that defines when the password must be changed, as stored in `/etc/shadow`.

Answer

passwd -f jdoe

Answer

usermod -e 90 jdoe

Answer

chage -E 90 jdoe

Question 2

Which TWO daemons are commonly used by DHCP clients on Linux to obtain an IP address? (Choose two.)

Accepted Answer

dhclient. dhclient (A) is the classic ISC DHCP client daemon that sends DHCPDISCOVER/DHCPREQUEST messages to obtain a lease and configure the interface, making it a correct answer. dhcpcd (B) is another widely used DHCP client daemon (common on many distros and embedded systems) that performs the same client-side lease acquisition, so it is also correct. dhcrelay (C) is a DHCP relay agent that forwards DHCP messages between clients and servers on different subnets, not a client. dhcpd (D) is the ISC DHCP server daemon that assigns addresses, not a client. tcpdump (E) is a packet capture tool, not a DHCP client daemon.

Answer

dhcrelay

Answer

dhcpd

Answer

tcpdump

Question 3

After modifying /etc/samba/smb.conf, which command should be used to verify the syntax before restarting the Samba service?

Accepted Answer

testparm. The `testparm` command is specifically designed to parse and validate the syntax of the Samba configuration file `/etc/samba/smb.conf`. It checks for errors such as misspelled parameters, invalid values, or structural issues without requiring the Samba services to be running. This makes it the correct tool to verify syntax before restarting Samba.

Answer

nmblookup

Answer

smbclient

Answer

smbstatus

Question 4

A database server uses LVM with an XFS filesystem on /dev/vg_data/lv_db, mounted at /var/lib/mysql. The LV is at 95% capacity. A new 50GB disk /dev/sdd has been added and initialized as a physical volume, then added to the volume group vg_data. The database is running and cannot be stopped. The administrator must extend the LV and filesystem. What is the correct course of action?

Accepted Answer

Run `lvextend -L +50G /dev/vg_data/lv_db` followed by `xfs_growfs /var/lib/mysql`.. XFS filesystems must be grown while mounted using `xfs_growfs` with the mount point as the argument, not the block device. Since the database cannot be stopped, the LV can be extended online with `lvextend`, and then `xfs_growfs /var/lib/mysql` resizes the filesystem to fill the expanded LV without requiring unmounting or downtime.

Answer

Run `lvextend -L +50G /dev/vg_data/lv_db` followed by `resize2fs /dev/vg_data/lv_db`.

Answer

Unmount /var/lib/mysql, run `lvextend -L +50G /dev/vg_data/lv_db`, run `resize2fs /dev/vg_data/lv_db`, then remount.

Answer

Run `lvresize -L +50G /dev/vg_data/lv_db`.

Question 5

A Linux client is configured with two network interfaces: eth0 (connected to the internet) and eth1 (connected to a private LAN). The default route is set to eth0. The client can access the internet but cannot access hosts on the private LAN. What is the most likely cause?

Accepted Answer

There is no route to the private subnet via eth1.. Without a route to the private subnet via eth1, the client has no way to forward packets destined for the private LAN out of eth1. The default route via eth0 only handles traffic for destinations not explicitly matched by other routes; if the private subnet is not in the routing table, packets to that subnet will be sent to the default gateway (internet) and fail. The `ip route` command would show the missing entry, and adding a static route (e.g., `ip route add 192.168.1.0/24 dev eth1`) resolves the issue.

Answer

A firewall on the client is blocking ICMP packets on eth1.

Answer

The eth1 interface is not configured with an IP address.

Answer

The eth1 interface is not receiving a DHCP lease.

Question 6

Which Samba component provides NetBIOS name resolution and browsing services?

Accepted Answer

nmbd. The nmbd daemon is the Samba component responsible for NetBIOS name resolution and browsing services. It listens for NetBIOS name service requests (port 137/UDP) and datagram distribution (port 138/UDP), enabling Windows clients to resolve NetBIOS names to IP addresses and participate in network browsing (e.g., listing shares in Network Neighborhood). Without nmbd, Samba cannot provide legacy NetBIOS-based name resolution or browse lists, though modern Samba can also use DNS-based discovery.

Answer

swat

Answer

smbd

Answer

winbind

Question 7

Order the steps to configure a Linux system as a router using iptables.

Accepted Answer

Enable IP forwarding, set default iptables policies, add NAT and FORWARD rules, then save the iptables configuration.. When configuring a Linux system as a router using iptables, the proper order is: first enable IP forwarding (via sysctl), then set default iptables policies (e.g., DROP for FORWARD), then add NAT (e.g., MASQUERADE) and FORWARD rules, and finally save the iptables configuration to make it persistent. This sequence ensures the kernel is prepared for routing, policies are in place to control traffic flow, rules are applied correctly, and changes are saved.

Answer

Set default iptables policies, enable IP forwarding, add NAT and FORWARD rules, then save the iptables configuration.

Answer

Save the iptables configuration, enable IP forwarding, set default iptables policies, then add NAT and FORWARD rules.

Answer

Add NAT and FORWARD rules, enable IP forwarding, set default iptables policies, then save the iptables configuration.

Question 8

Which TWO files are commonly used by Samba for configuration and user authentication? (Choose two.)

Accepted Answer

/etc/samba/smbpasswd. Option E, /etc/samba/smb.conf, is correct because it is Samba's primary configuration file, defining global server settings and per-share parameters such as workgroup, security mode, and share paths. Option C, /etc/samba/smbpasswd, is correct because it is the traditional Samba file storing SMB/CIFS user account credentials (NT/LM password hashes) used for authenticating clients, managed via smbpasswd. Option A, /etc/samba/smbusers, is not correct because it only maps local Linux usernames to SMB aliases and does not store authentication credentials or main configuration. Option B, /etc/passwd, is not correct because it is the system's local account database, not Samba's authentication store, though Samba may reference system accounts. Option D, /etc/hosts.allow, is not correct because it is a TCP wrapper access-control file, not a Samba configuration or authentication file.

Answer

/etc/samba/smbusers

Answer

/etc/passwd

Answer

/etc/hosts.allow

Question 9

Which TWO statements about the DHCP client on Linux are correct?

Accepted Answer

The dhclient command can be used to release and renew a DHCP lease.. Option A is correct because dhclient supports the -r flag to release the current lease and the -n/-1 or simply re-running it to renew, making it the standard ISC DHCP client tool for managing leases on Linux. Option B is correct because /etc/dhcp/dhclient.conf accepts the 'send host-name "name";' directive, which controls the hostname the client transmits to the DHCP server in its DHCPDISCOVER/DHCPREQUEST messages. Option C is wrong because dhclient-script is invoked by dhclient to configure the interface (IP address, routes, DNS) based on the lease, not to parse /etc/resolv.conf; the script writes resolv.conf rather than parsing it. Option D is wrong because dhcpcd is one of several clients (alongside dhclient, NetworkManager's internal client, and systemd-networkd) and is not the standard on all distributions. Option E is wrong because /etc/dhcpd.conf configures the DHCP server daemon (dhcpd), not the client; the client configuration file is /etc/dhcp/dhclient.conf.

Answer

The dhclient-script is used to parse the /etc/resolv.conf file.

Answer

The dhcpcd daemon is the standard DHCP client on all Linux distributions.

Answer

The /etc/dhcpd.conf file configures the DHCP client.

Question 10

Which TWO statements are true regarding BIND DNS server security? (Choose two.)

Accepted Answer

The 'allow-recursion' ACL can be used to restrict which clients can use the server's recursive lookup feature.. Option B is correct because in BIND, the 'allow-recursion' ACL specifically controls which client addresses are permitted to use the server's recursive resolution capability, so only trusted clients perform recursion while others are limited to authoritative answers. Option E is correct because the 'allow-query' ACL defines which clients are allowed to send any DNS queries to the server, effectively restricting query access by source address. Option A is incorrect because 'allow-transfer' governs zone transfers (AXFR/IXFR) to secondary servers, not recursive query permissions. Option C is incorrect because the 'blackhole' ACL lists addresses the server will not answer or query at all; it does not prevent cache poisoning, which is mitigated by source-port randomization, DNSSEC, and bailiwick checking. Option D is incorrect because 'forwarders' specifies servers to which queries are forwarded, and recursion is disabled with 'recursion no', not with 'forwarders'.

Answer

The 'allow-transfer' ACL is used to restrict which clients can perform recursive queries.

Answer

The 'blackhole' ACL can be used to prevent cache poisoning attacks.

Answer

The 'forwarders' option can be used to disable recursion entirely.

Question 11

A system administrator needs to find out which kernel parameters were passed at boot time. Which command displays the kernel boot parameters?

Accepted Answer

cat /proc/cmdline. The correct command is `cat /proc/cmdline` because the Linux kernel stores the boot parameters (also known as the kernel command line) passed by the bootloader (e.g., GRUB) in the virtual file `/proc/cmdline`. Reading this file directly displays the exact parameters used during boot, such as `root=`, `quiet`, or `splash`.

Answer

dmesg

Answer

lsmod

Answer

cat /proc/version

Question 12

A DHCP server is configured to serve multiple subnets but only clients on one subnet receive IP addresses. The server is connected to a router that does not forward DHCP broadcasts. What should be configured to support the other subnets?

Accepted Answer

Set up a DHCP relay agent on the other subnets. The router does not forward DHCP broadcasts, so clients on other subnets cannot reach the DHCP server. A DHCP relay agent (e.g., `dhcrelay` or `ip helper-address`) intercepts broadcast requests on those subnets and forwards them as unicast to the DHCP server, allowing the server to assign addresses from the appropriate subnet pools. This is the standard solution per RFC 1542 when routers do not support BOOTP forwarding.

Answer

Add more subnet declarations to the DHCP server

Answer

Add 'shared-network' declarations

Answer

Configure the router to act as a DHCP server

Question 13

An administrator wants to disable the graphical splash screen during boot. What change should be made in /etc/default/grub?

Accepted Answer

Remove 'splash' from GRUB_CMDLINE_LINUX_DEFAULT. The graphical splash screen during boot is controlled by the 'splash' kernel parameter. Removing 'splash' from GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub disables the splash screen, allowing verbose boot messages to be displayed. This parameter is passed to the kernel via the bootloader, and its absence prevents the plymouth or similar splash service from activating.

Answer

Set GRUB_CMDLINE_LINUX="nosplash"

Answer

Remove 'quiet' from GRUB_CMDLINE_LINUX_DEFAULT

Answer

Set GRUB_TIMEOUT=0

Question 14

A system administrator notices that the SSH service on a Linux server is failing to start. The log shows: 'sshd: error: Could not load host key: /etc/ssh/ssh_host_rsa_key'. What is the most likely cause and solution?

Accepted Answer

The host key file is missing or corrupt. Run 'ssh-keygen -A' to regenerate all missing host keys.. The error message indicates that the SSH daemon cannot load the RSA host key file. Host keys are generated during package installation or manually via ssh-keygen. Option D is correct because running 'ssh-keygen -A' automatically generates all missing host key types (RSA, ECDSA, Ed25519) that are configured for use, resolving the missing or corrupt key issue without manual intervention.

Answer

The sshd_config file has a syntax error. Run 'sshd -t' to check it.

Answer

The SSH service is managed by xinetd and the configuration is missing. Edit /etc/xinetd.d/ssh.

Answer

The /etc/ssh/sshd_config file has incorrect permissions. Change them to 600.

Question 15

An administrator wants to configure Samba to allow only specific users to access a share. Which TWO configuration parameters in smb.conf can be used to restrict access based on usernames?

Accepted Answer

invalid users. Option B, invalid users, is correct because it explicitly denies the listed usernames from accessing the share, so any account named there is blocked regardless of other permissions. Option D, valid users, is correct because it defines an allow-list of usernames (or groups) that are permitted to log in and access the share, restricting access to only those accounts. Together they provide username-based access control in smb.conf. Option A, hosts allow, is incorrect because it filters by client IP address or network, not by username. Option C, write list, is incorrect because it grants write permission to listed users but does not restrict who may access the share. Option E, read list, is incorrect because it grants read-only access to listed users rather than limiting share access by username.

Answer

hosts allow

Answer

write list

Answer

read list

Question 16

A Samba share is configured with 'force user = jane'. A user 'bob' accesses the share. With what effective user ID will file operations be performed?

Accepted Answer

jane. The 'force user' directive in Samba overrides the authenticated user's identity for all file operations on the share. When 'force user = jane' is set, any user accessing the share, including 'bob', will have their effective user ID changed to 'jane' for all file reads, writes, and ownership checks. This ensures that files created or modified on the share are owned by 'jane', regardless of who actually connects.

Answer

root

Answer

nobody

Answer

bob

Question 17

An administrator needs to create a Samba share that allows all users in the 'staff' group read/write access, but denies access to everyone else. Which configuration achieves this?

Accepted Answer

[share]
   path = /data
   valid users = @staff
   read only = no. It uses `valid users = @staff` to restrict access exclusively to members of the 'staff' group, and `read only = no` grants read/write permissions to those valid users. The `@` prefix in Samba denotes a group, ensuring only group members can connect, while `read only = no` overrides the default read-only behavior to allow writes.

Answer

[share]
   path = /data
   read list = staff
   read only = yes

Answer

[share]
   path = /data
   valid users = staff
   read only = yes

Answer

[share]
   path = /data
   write list = @staff
   browseable = yes

Question 18

Which TWO of the following tools are used to capture and analyze network packets on a Linux system?

Accepted Answer

tcpdump. tcpdump is a command-line packet analyzer that captures raw network packets from the wire by placing the network interface into promiscuous mode and using libpcap to read packets. It allows filtering based on protocols, ports, and hosts using BPF (Berkeley Packet Filter) syntax, making it a fundamental tool for network troubleshooting and security analysis.

Answer

iptables

Answer

netstat

Answer

nmap

Question 19

A company wants to host multiple websites on a single Apache server with different domain names. Which approach is most appropriate?

Accepted Answer

Name-based virtual hosting. Name-based virtual hosting allows a single Apache server to serve multiple websites using the same IP address and port by relying on the HTTP Host header sent by the client. This is the most efficient and commonly used method for hosting multiple domains on one server, as it conserves IP addresses and requires minimal configuration via the `<VirtualHost *:80>` directive.

Answer

IP-based virtual hosting

Answer

Port-based virtual hosting

Answer

Using mod_rewrite for each domain

Question 20

A system fails to boot due to a corrupted initramfs. Which TWO methods can be used to recover? (Choose two.)

Accepted Answer

Use the rescue mode of the installation media (e.g., RHEL rescue, Ubuntu recovery). Booting from installation media (e.g., RHEL rescue or Ubuntu recovery) provides a minimal environment that can mount the root filesystem, chroot into it, and then rebuild the initramfs using the system's own kernel and modules. This method does not require a working initramfs on the disk, as the rescue environment supplies its own kernel and initial RAM disk.

Answer

Edit GRUB command line to add 'init=/bin/bash' and then rebuild initramfs from that shell

Answer

Reinstall the kernel package from the GRUB command line using a network boot

Answer

Use kexec to boot a different kernel