LPIC-2 Practice Test 32 — 15 Questions

Question 1

A Linux administrator is setting up an IPsec VPN between two sites using strongSwan. The VPN established successfully, but traffic between the sites is not being encrypted. What is the most probable cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The IPsec policies are not configured to match the traffic.. The most probable cause for traffic not being encrypted after a successful IPsec tunnel establishment is that the IPsec policies (e.g., strongSwan's `ipsec.conf` `conn` section with `leftsubnet`/`rightsubnet`) do not match the actual traffic flows. Even if the IKE/SA is up, strongSwan only applies encryption to packets that match the configured selectors; mismatched subnets or protocols result in cleartext traffic bypassing the tunnel.

Answer

The firewall is blocking UDP port 500.

Answer

The kernel does not support IPsec (net.ipv4.ip_forward=0).

Answer

The IPsec daemon is not started.

Question 2

A network administrator wants to improve network performance by bonding two gigabit Ethernet interfaces (eth0 and eth1) on a Linux server. The switch supports IEEE 802.3ad (LACP). Which bonding mode should be used to provide both load balancing and fault tolerance?

Accepted Answer

802.3ad (mode 4). (802.3ad mode 4) is correct because it uses the IEEE 802.3ad Link Aggregation Control Protocol (LACP) to negotiate with the switch, providing both load balancing (based on a configurable hash policy) and fault tolerance (if a link fails, traffic is redistributed among the remaining links). This mode is specifically designed for switches that support LACP, as stated in the question.

Answer

active-backup (mode 1)

Answer

balance-xor (mode 2)

Answer

balance-rr (mode 0)

Answer

balance-tlb (mode 5)

Question 3

An administrator needs to configure a BIND DNS server to allow dynamic updates from a specific subnet (192.168.1.0/24) for the zone 'example.com'. The administrator must also ensure that the zone file is updated immediately after a dynamic update. Which configuration accomplishes this?

Accepted Answer

zone "example.com" { type master; file "db.example.com"; allow-update { 192.168.1.0/24; }; };. The `allow-update` statement in BIND explicitly permits dynamic DNS updates (RFC 2136) from specified sources, such as the subnet 192.168.1.0/24. Dynamic updates are written to the zone file immediately by default when using a master zone, ensuring the file is updated in real time.

Answer

zone "example.com" { type master; file "db.example.com"; update-policy { grant 192.168.1.0/24 zonesub ANY; }; };

Answer

zone "example.com" { type master; file "db.example.com"; allow-transfer { 192.168.1.0/24; }; };

Answer

zone "example.com" { type master; file "db.example.com"; also-notify { 192.168.1.0/24; }; };

Question 4

An administrator needs to disable IPv6 on a running system without rebooting and make the change permanent across reboots. Which set of commands should be used?

Accepted Answer

echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6 && edit /etc/sysctl.conf to add net.ipv6.conf.all.disable_ipv6=1. It combines a runtime sysctl command to immediately disable IPv6 on the running system without a reboot, and a persistent configuration in /etc/sysctl.conf to ensure the setting survives reboots. The /proc/sys/net/ipv6/conf/all/disable_ipv6 file controls the IPv6 stack at runtime, and sysctl.conf applies the kernel parameter at boot time.

Answer

modprobe -r ipv6

Answer

Edit /boot/grub/grub.cfg to add ipv6.disable=1

Answer

sysctl -w net.ipv6.conf.all.disable_ipv6=1

Question 5

Refer to the exhibit. Which kernel parameter is responsible for reducing the amount of kernel messages displayed on the console?

Accepted Answer

quiet. The `quiet` kernel parameter suppresses most kernel log messages from being printed to the console during boot, reducing console output to only critical or error-level messages. This is controlled by the kernel's console log level, which `quiet` effectively lowers to KERN_WARNING (4) or higher, filtering out informational and debug messages.

Answer

ro

Answer

splash

Answer

BOOT_IMAGE

Question 6

Based on the exhibit, which command would change the DNS server to 1.1.1.1 for the connection MyConnection?

Accepted Answer

nmcli con mod MyConnection ipv4.dns 1.1.1.1. The `nmcli con mod` command modifies an existing connection profile, and the `ipv4.dns` property sets the DNS server for IPv4. The property name is case-sensitive and must be lowercase `ipv4.dns` as per NetworkManager's D-Bus API. This command replaces any existing DNS servers with the specified value.

Answer

nmcli con mod MyConnection IP4.DNS 1.1.1.1

Answer

nmcli dev mod eth0 ipv4.dns 1.1.1.1

Answer

nmcli con mod MyConnection +ipv4.dns 1.1.1.1

Question 7

During boot, the kernel outputs a message indicating that a required device driver is not found. Which command can be used to rebuild the initramfs to include the missing driver?

Accepted Answer

dracut. Dracut is the standard tool for building initramfs images on modern Red Hat-based distributions (RHEL, CentOS, Fedora). When a required kernel driver is missing during boot, you can use `dracut --force` to rebuild the initramfs, which will automatically include the currently loaded kernel modules and any specified in configuration files. This ensures the missing driver is available early in the boot process.

Answer

mkinitrd

Answer

grub-mkconfig

Answer

mkinitcpio

Question 8

A small business has a single Linux server that serves as both a file server (Samba) and a web server (Apache). The server is directly connected to the internet. Recently, there have been numerous brute-force SSH login attempts. The administrator wants to implement a simple solution to block IP addresses that have more than 5 failed SSH attempts in 10 minutes. The server runs Ubuntu 20.04. Which tool should the administrator use to achieve this with minimal configuration?

Accepted Answer

Install and configure Fail2ban to monitor /var/log/auth.log.. Fail2ban is the correct tool because it is specifically designed to monitor log files (e.g., /var/log/auth.log) for repeated failed authentication attempts and dynamically update firewall rules (via iptables or nftables) to block offending IP addresses. It requires minimal configuration: a default SSH jail is provided out-of-the-box, and the administrator only needs to adjust the `maxretry` and `findtime` parameters to match the requirement of 5 failures in 10 minutes.

Answer

Enable UFW and set default deny incoming, allow SSH from specific IPs.

Answer

Set up TCP wrappers with /etc/hosts.deny for SSH.

Answer

Use port knocking to hide SSH port until a specific sequence is sent.

Question 9

A Samba server is configured with 'vfs objects = recycle' to implement a recycle bin. After some time, users notice that deleted files are not appearing in the recycle bin. Which parameter is likely misconfigured?

Accepted Answer

recycle:repository. The `vfs objects = recycle` module requires the `recycle:repository` parameter to specify the directory where deleted files should be moved. If this parameter is missing or misconfigured, the recycle bin will not function, and deleted files will be permanently removed instead of being stored in the recycle repository.

Answer

recycle:maxsize

Answer

recycle:keeptree

Answer

recycle:versions

Question 10

An administrator wants to restrict access to a service using PAM. Which file order determines the authentication flow for a service?

Accepted Answer

/etc/pam.d/<service-name>. PAM (Pluggable Authentication Modules) uses per-service configuration files located in /etc/pam.d/ to define the authentication flow. When a service (e.g., sshd, login) calls PAM, it reads the file named after the service (e.g., /etc/pam.d/sshd) to determine the order of modules (auth, account, password, session) and their control flags (required, requisite, sufficient, optional). This file-based approach allows fine-grained, service-specific authentication policies.

Answer

/etc/nsswitch.conf

Answer

/etc/security/access.conf

Answer

/etc/pam.conf

Question 11

A new user needs access to a Samba share. The administrator adds the user to the system with `adduser alice` and then sets up a Samba password. Which command is used to set the Samba password?

Accepted Answer

smbpasswd -a alice. The correct command is `smbpasswd -a alice`. This command adds a new user to the Samba password database and sets their initial Samba password. The `-a` flag specifically indicates that the user should be added to the local Samba user database (smbpasswd file or tdbsam), which is required before the user can authenticate to Samba shares.

Answer

passwd -a alice

Answer

pdbedit -a -u alice

Answer

net ads user add alice

Question 12

A company's security policy requires that all members of the 'developers' group be able to run the command 'systemctl restart httpd' as root using sudo, without being prompted for a password. Which sudoers entry achieves this?

Accepted Answer

%developers ALL=(root) NOPASSWD: /usr/bin/systemctl restart httpd. It uses the %group syntax to specify the 'developers' group, includes the NOPASSWD: tag to suppress password prompting, and specifies the exact command path and arguments (/usr/bin/systemctl restart httpd) as required by the sudoers policy. This matches the security requirement precisely.

Answer

%developers ALL=(root) /usr/bin/systemctl restart httpd

Answer

developers ALL=(root) NOPASSWD: /usr/bin/systemctl restart httpd

Answer

%developers ALL=(root) NOPASSWD: {/usr/bin/systemctl restart httpd}

Answer

%developers ALL=(0) NOPASSWD: /usr/bin/systemctl restart httpd

Question 13

An application running under AppArmor is failing to write to its log directory. The AppArmor profile for the application includes the line '/var/log/myapp/ r,' but not '/var/log/myapp/** rw,'. What is the most likely issue?

Accepted Answer

The 'r' permission only allows read, but write is required.. The AppArmor profile line '/var/log/myapp/ r,' grants only read permission on the directory itself, not write access to files within it. To allow writing to files in the directory, the profile must include a rule like '/var/log/myapp/** rw,' which grants read and write permissions recursively. Without write permission, the application cannot create or modify log files, causing the failure.

Answer

The directory itself is not created, and AppArmor prevents creation.

Answer

The AppArmor service is not running, so the profile is not enforced.

Answer

The profile needs 'ix' instead of 'r' for execute rights.

Question 14

Which two of the following are valid methods to authenticate with OpenVPN? (Select two.)

Accepted Answer

Static key. OpenVPN supports static key authentication (option D) as a simple pre-shared secret method where both client and server use the same key to encrypt and authenticate traffic. This is valid but less secure than certificate-based methods, as it lacks perfect forward secrecy and individual revocation capabilities.

Answer

LDAP

Answer

RADIUS

Answer

NIS

Question 15

What is the purpose of the 'idmap config * : backend = tdb2' line?

Accepted Answer

It sets the default identity mapping backend to tdb2.. The 'idmap config * : backend = tdb2' line in Samba's smb.conf configures the default identity mapping backend for all domains not explicitly specified. The asterisk (*) acts as a wildcard representing any domain, and 'tdb2' is a high-performance, clustered-aware database backend that stores mappings between Windows SIDs and Unix UIDs/GIDs. This ensures that when a user or group from an unspecified domain is encountered, Samba uses tdb2 to manage the ID mapping, making option A correct.

Answer

It specifies the security mode as user.

Answer

It defines the default domain for Samba.

Answer

It enables the winbind cache.