LPIC-2 Practice Test 33 — 15 Questions

Question 1

An AppArmor profile for a database server is too restrictive and denies legitimate queries. The administrator wants to learn the required accesses by running the application in complain mode. Which command puts the profile into complain mode?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aa-complain /etc/apparmor.d/usr.sbin.mysqld. The `aa-complain` command places an AppArmor profile into complain mode, where policy violations are logged but not blocked. This allows the administrator to run the database server and observe which accesses are denied, then use the logs to update the profile with the required permissions. The correct syntax is `aa-complain /etc/apparmor.d/usr.sbin.mysqld` to target the specific profile file.

Answer

aa-disable /etc/apparmor.d/usr.sbin.mysqld

Answer

aa-enforce /etc/apparmor.d/usr.sbin.mysqld

Answer

aa-log /etc/apparmor.d/usr.sbin.mysqld

Question 2

Which THREE conditions must be met for an SSH key-based login to succeed using the default settings on a OpenSSH server? (Choose three.)

Accepted Answer

The ~/.ssh directory on the remote server has permissions 0700. OpenSSH requires the ~/.ssh directory on the remote server to have permissions 0700 (owner-only read/write/execute) to prevent other users from modifying its contents. If the directory is group- or world-writable, the server will reject key-based authentication as a security measure against unauthorized key injection.

Answer

The remote server has the host key /etc/ssh/ssh_host_rsa_key

Answer

The client has the server's public host key stored in ~/.ssh/known_hosts

Question 3

During boot, the kernel panics with 'VFS: Unable to mount root fs on unknown-block(0,0)'. Which of the following is the most likely cause?

Accepted Answer

The kernel lacks the driver for the storage controller.. The error 'VFS: Unable to mount root fs on unknown-block(0,0)' indicates the kernel cannot find a driver for the block device containing the root filesystem. This most commonly occurs when the kernel lacks the necessary storage controller driver (e.g., for SATA, NVMe, or SCSI controllers), often because the driver was built as a module and not included in the initramfs or compiled into the kernel.

Answer

The kernel image is corrupted.

Answer

The init process is missing.

Answer

The root filesystem is formatted with an unsupported filesystem.

Question 4

Which of the following is a valid NTP configuration file directive to specify a broadcast client?

Accepted Answer

broadcastclient. The `broadcastclient` directive in an NTP configuration file instructs the NTP daemon to listen for NTP broadcast messages on the local network. This is the standard way to configure a client to synchronize time from a broadcast server without specifying individual server addresses.

Answer

peer

Answer

server

Answer

broadcast

Question 5

Based on the iptables output, what is the expected behavior for incoming SSH connections on eth0?

Accepted Answer

SSH connections from any source to port 22 on eth0 are allowed if they are new.. The iptables output shows a rule on the INPUT chain for eth0 that accepts TCP packets destined for port 22 (SSH) with the state NEW. This means that any incoming SSH connection attempt (SYN packet) that is not part of an existing connection is explicitly allowed. The default policy for the INPUT chain is ACCEPT (not shown as DROP), so even without this rule, SSH would be allowed, but the rule ensures it is explicitly permitted for new connections.

Answer

SSH connections are only allowed if they are part of an established connection.

Answer

SSH connections are dropped because the default policy is DROP.

Answer

SSH connections are only allowed from the loopback interface.

Question 6

A Linux administrator notices that a newly added disk /dev/sdc is not recognized by the system. Which command should be used to rescan the SCSI bus without rebooting?

Accepted Answer

echo '- - -' > /sys/class/scsi_host/host0/scan. Writing '- - -' to /sys/class/scsi_host/host0/scan triggers a SCSI bus rescan on the specified host adapter (host0) without requiring a reboot. The three dashes represent 'channel, target, LUN' wildcards, instructing the kernel to scan all SCSI IDs on that bus to detect newly added devices like /dev/sdc.

Answer

echo 'scan' > /proc/scsi/scsi

Answer

blockdev --rereadpt /dev/sdc

Answer

service scsi restart

Question 7

An administrator wants to allow user 'john' to execute any command as root without a password. Which sudoers entry is correct?

Accepted Answer

john ALL=(ALL) NOPASSWD:ALL. The sudoers entry 'john ALL=(ALL) NOPASSWD:ALL' grants user 'john' permission to run any command as any user (including root) on any host, and the 'NOPASSWD' tag overrides the default password requirement, allowing execution without a password. The syntax follows the sudoers format: 'user host=(runas) TAG:command', where 'ALL' in each field matches any value.

Answer

john ALL=(ALL) NOPASSWD:/bin/ls

Answer

john ALL=(ALL) ALL

Answer

john ALL=(ALL) PASSWD:ALL

Question 8

The administrator wants to create a RAID 1 array using /dev/sdb1 and /dev/sdc1, then create a filesystem and mount it at /mnt/raid1. Which command sequence should be used first?

Accepted Answer

mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1. The first step in creating a RAID 1 array is to assemble the underlying block devices into a RAID device using mdadm. The command `mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/sdb1 /dev/sdc1` initializes the RAID metadata and creates the array at /dev/md0. Only after the array is created can a filesystem be built on it and then mounted.

Answer

mkfs.ext4 /dev/md0

Answer

pvcreate /dev/sdb1 /dev/sdc1

Answer

fdisk /dev/sdb && fdisk /dev/sdc

Question 9

An administrator is designing a high-availability storage solution using DRBD. The requirement is to have two nodes with synchronous replication and automatic failover in case of primary node failure. Which configuration best achieves this?

Accepted Answer

DRBD in Primary/Primary mode managed by Pacemaker cluster stack.. DRBD in Primary/Primary mode, managed by the Pacemaker cluster stack, provides synchronous replication and automatic failover. Pacemaker monitors node health and can promote the secondary node to primary automatically upon primary failure, meeting the high-availability requirement without manual intervention.

Answer

Export the DRBD block device via NFS and use a load balancer.

Answer

Primary/Secondary DRBD resource with manual failover using drbdadm.

Answer

DRBD with Heartbeat to automatically promote the secondary on primary failure.

Question 10

Which directive in ntp.conf enables the NTP server to respond to queries from clients?

Accepted Answer

restrict. The `restrict` directive in ntp.conf controls access to the NTP server, including whether it responds to client queries. By default, NTP servers restrict all access; adding a `restrict` line with the `nomodify` and `notrap` flags (or no restrictive flags) allows clients to query the server. Option C is correct because `restrict` is the directive that explicitly permits or denies NTP queries from clients.

Answer

broadcast

Answer

peer

Answer

server

Question 11

An organization runs a critical application on a Linux server that stores its data on a 500GB LVM logical volume named /dev/vg_data/lv_app. The application must remain operational with minimal disruption, so unmounting the volume is not acceptable. The administrator needs to create a full backup of the logical volume to an external 1TB USB drive attached via eSATA. The backup must capture a point-in-time consistent state of the filesystem. The logical volume is formatted with XFS. Which of the following procedures best achieves this goal while minimizing downtime?

Accepted Answer

Create an LVM snapshot volume of /dev/vg_data/lv_app, mount the snapshot to a temporary directory, and use rsync to copy the data to the USB drive.. It uses an LVM snapshot to capture a point-in-time consistent state of the XFS filesystem without unmounting the original volume. The snapshot is mounted read-only, and rsync copies the data to the USB drive, ensuring minimal disruption to the running application. This approach leverages LVM's copy-on-write mechanism to freeze the filesystem state at the snapshot creation moment.

Answer

Unmount the logical volume, use tar to create an archive on the USB drive, then remount the volume.

Answer

Use dd to clone the logical volume directly to the USB drive while the volume is mounted.

Answer

Create an LVM snapshot volume and then use cp -a to copy the snapshot volume's contents directly without mounting.

Question 12

A system administrator needs to create a RAID 10 array using four disks: /dev/sdb, /dev/sdc, /dev/sdd, /dev/sde. Which TWO commands correctly achieve this?

Accepted Answer

mdadm --create /dev/md0 --level=10 --raid-devices=4 /dev/sdb /dev/sdc /dev/sdd /dev/sde. `--level=10` is the accepted syntax for RAID 10 in mdadm, and specifying `--raid-devices=4` with all four disks creates a RAID 10 array (a stripe of mirrors) directly. Option C is also correct because `--level=raid10` is an alternative valid syntax that mdadm accepts for the same RAID level.

Answer

mdadm --create /dev/md0 --level=1 --raid-devices=4 /dev/sdb /dev/sdc /dev/sdd /dev/sde

Answer

mdadm --create /dev/md0 --level=0 --raid-devices=2 /dev/sdb /dev/sdc --add /dev/md1

Answer

mdadm --create /dev/md0 --level=10 --raid-devices=2 /dev/sdb /dev/sdc

Question 13

An administrator wants to limit the size of the kernel ring buffer to prevent memory overflow. Which kernel boot parameter should be used?

Accepted Answer

log_buf_len. `log_buf_len` is the kernel boot parameter that explicitly sets the size of the kernel ring buffer (dmesg buffer). By specifying a value (e.g., `log_buf_len=4M`), the administrator can increase or limit the buffer size to prevent memory overflow when a large volume of kernel messages is generated.

Answer

log_size

Answer

kernel.log.size

Answer

dmesg_size

Question 14

After rebooting, the bridge br0 does not forward traffic between eth0 and eth1. Which configuration is most likely missing?

Accepted Answer

bridge_fd 0. The bridge br0 is not forwarding traffic because the default bridge forward delay (bridge_fd) is too long, causing the bridge to remain in a blocking state while waiting for STP convergence. Setting bridge_fd 0 disables the forward delay, allowing the bridge to start forwarding immediately after boot. This is essential when STP is not needed or when the bridge must be operational without delay.

Answer

bridge_stp on

Answer

bridge_maxwait 10

Answer

up ip link set br0 up

Question 15

An Apache administrator is troubleshooting a slow website. Which THREE modules could be causing performance issues if misconfigured?

Accepted Answer

mod_proxy. mod_proxy can cause performance issues if misconfigured because it may create excessive backend connections, fail to reuse connections via KeepAlive, or introduce latency through improper load balancing or reverse proxy caching settings. A common misconfiguration is setting ProxyTimeout too low, causing premature connection drops and retries.

Answer

mod_status

Answer

mod_include