LPIC-2 Practice Test 34 — 15 Questions

Question 1

A filesystem created with mkfs.ext4 on /dev/sda1 has a reserved block count of 5%. How can the administrator reduce it to 1% without reformatting?

Accepted Answer

tune2fs -m 1 /dev/sda1. The `-m` option of tune2fs sets the reserved block percentage for the filesystem. Since the question asks to reduce the reserved block count from 5% to 1% without reformatting, `tune2fs -m 1 /dev/sda1` correctly adjusts the reserved blocks percentage to 1% on the existing ext4 filesystem.

Answer

tune2fs -r 1 /dev/sda1

Answer

dumpe2fs -r 1 /dev/sda1

Answer

resize2fs -r 1 /dev/sda1

Question 2

Refer to the exhibit. An administrator runs aide --check and receives a warning that /var/log/syslog has changed. Why is this expected?

Accepted Answer

The /var/log entry monitors the directory itself, not its contents; changes inside the directory are not tracked.. The AIDE configuration for /var/log typically monitors the directory entry itself (its metadata like permissions and ownership) rather than recursively tracking changes to files within it. When /var/log/syslog changes, AIDE does not detect it because the directory's inode metadata remains unchanged; only the file's content and metadata are altered. This is a common default behavior unless the configuration explicitly uses the 'R' or 'p+sha512' flags to recurse into subdirectories and hash file contents.

Answer

The SHA512 hash for /var/log is incorrect.

Answer

The /var/log entry includes permissions but not content hashes, so changes in file content are not monitored.

Answer

The +c flag checks for changes in the file's ctime, so syslog changes are detected.

Question 3

A security analyst wants to capture only TCP packets with the SYN flag set to identify connection attempts. Which tcpdump filter expression accomplishes this?

Accepted Answer

Both B and C are correct. [CORRECT]. Both B and C correctly filter TCP packets with the SYN flag set. Note that in the question stem, options B and C are incorrectly marked as '[wrong]', but they are actually valid filters. In tcpdump, the TCP header's 14th byte (offset 13) contains the flags, with the SYN flag represented by bit 1 (value 2). Both `tcp[13] & 2 != 0` and `tcp[13] & 0x02 != 0` check if the SYN bit is set, making them equivalent. Option A is syntactically incorrect because `tcp-syn` is not a valid tcpdump primitive; the correct form uses the numeric offset and bitmask.

Answer

tcp[tcpflags] & tcp-syn != 0 [wrong]

Answer

tcp[13] & 2 != 0

Answer

tcp[13] & 0x02 != 0

Question 4

Which TWO of the following actions are recommended to improve SSH server security?

Accepted Answer

PermitEmptyPasswords no. Setting `PermitEmptyPasswords no` in `/etc/ssh/sshd_config` explicitly disallows login attempts with empty passwords, closing a trivial authentication bypass vector. This directive is enforced by the SSH daemon before any PAM or password verification occurs, making it a fundamental hardening step.

Answer

AllowUsers *.example.com

Answer

PermitRootLogin yes

Answer

UsePAM yes

Question 5

Samba is integrated with Active Directory using security = ads. Which service is required for Kerberos authentication?

Accepted Answer

smbd. When Samba is integrated with Active Directory using `security = ads`, Kerberos authentication is handled by the `smbd` daemon. `smbd` is responsible for authenticating incoming SMB connections, and in an AD domain it uses the Kerberos protocol (via the GSSAPI) to validate tickets presented by clients. Without `smbd`, no Kerberos-based authentication can occur for SMB/CIFS services.

Answer

winbindd

Answer

samba

Answer

nmbd

Question 6

A company has multiple internet connections and wants to route traffic from specific subnets to specific providers. They are using policy-based routing with ip rule and ip route. After adding the rules, the administrator finds that the traffic is not matching the intended routing table. Which command should be used to verify that the rules are being matched correctly?

Accepted Answer

ip route get mark . 'ip route get' with the 'mark' option simulates a packet lookup using the specified routing mark, allowing the administrator to see which routing table would be matched by the policy rules. This directly verifies whether the ip rule conditions (e.g., fwmark, source subnet) are correctly directing traffic to the intended table.

Answer

ip route show cache

Answer

ip rule show

Answer

ip route show table all

Question 7

A company has a Samba server configured as a domain member in an Active Directory domain. The server runs Samba 4.13. Recently, Windows clients have been unable to access shares, and the domain join seems broken. The administrator runs 'net ads testjoin' and gets 'Join to domain is not valid'. The smb.conf includes: security = ads, realm = EXAMPLE.COM, workgroup = EXAMPLE. The administrator can successfully resolve the domain controller via DNS. What should the administrator do to fix the issue?

Accepted Answer

Re-run 'net ads join -U administrator' to rejoin the domain.. The 'net ads testjoin' command returned 'Join to domain is not valid', which indicates the machine account password stored in the local secrets.tdb file no longer matches the one in Active Directory. Re-running 'net ads join -U administrator' re-establishes the secure channel by resetting the machine account password and updating the Kerberos keytab, restoring the domain membership.

Answer

Restart the winbind service and run 'wbinfo -t'.

Answer

Add 'kerberos method = secrets and keytab' to smb.conf.

Answer

Increase the 'log level' to 3 and restart smbd.

Question 8

A security audit reveals that a server with PAM authentication allows users to log in even when the '/etc/nologin' file exists, contrary to policy. Which PAM module is most likely misconfigured or missing?

Accepted Answer

pam_nologin.so. The pam_nologin.so module is specifically designed to check for the existence of /etc/nologin and, if found, prevent non-root users from logging in. If users can still log in despite this file existing, the module is either missing from the PAM stack (e.g., not included in /etc/pam.d/login or /etc/pam.d/sshd) or misconfigured (e.g., placed after the authentication phase instead of the account phase).

Answer

pam_securetty.so

Answer

pam_access.so

Answer

pam_lastlog.so

Question 9

An administrator wants to restrict access to a Samba share based on client IP addresses. Which parameter in the [share] section of smb.conf should be used?

Accepted Answer

hosts allow. The `hosts allow` parameter in the `[share]` section of `smb.conf` restricts access to the Samba share based on client IP addresses or subnets. It is the correct directive for IP-based access control, allowing the administrator to specify which hosts are permitted to connect. This parameter is evaluated before authentication, blocking unauthorized IPs at the connection level.

Answer

allow hosts

Answer

browseable

Answer

valid users

Question 10

You are the security administrator for a company that runs a web application on a Linux server. The application runs under the user 'www-data' and listens on TCP port 8080. The server also runs an SSH service on port 22. Recently, an external penetration test revealed that an attacker could exploit a vulnerability in the web application to execute commands as the 'www-data' user, and from there, the attacker could escalate privileges to root due to a misconfigured sudo rule. You need to implement a defense-in-depth approach to limit the impact of such an attack. Which single action would be the most effective in preventing privilege escalation from the 'www-data' user to root, while still allowing the application to function normally?

Accepted Answer

Review and remove any sudo privileges granted to the 'www-data' user in /etc/sudoers, and ensure the application does not require sudo.. The core issue is a misconfigured sudo rule that allows the 'www-data' user to execute commands as root. By reviewing and removing any sudo privileges for 'www-data' in /etc/sudoers, you directly eliminate the privilege escalation path without affecting the web application's normal operation, as the application itself does not require sudo to function on its designated port 8080.

Answer

Change the SSH port to a non-standard port to reduce the attack surface.

Answer

Run the web application in a chroot jail to isolate it from the rest of the filesystem.

Answer

Implement mandatory access control with AppArmor profiles for the web application.

Question 11

Which TWO of the following commands are used to manage kernel modules? (Select TWO.)

Accepted Answer

insmod. B (insmod) is correct because it directly inserts a kernel module into the running kernel, though it does not resolve dependencies automatically. C (modprobe) is correct because it is the recommended tool for managing kernel modules, as it automatically loads dependencies and handles module parameters via configuration files in /etc/modprobe.d/.

Answer

lsmod

Answer

rmmod

Answer

depmod

Question 12

After creating a new partition table on /dev/sda, what command should be run to install GRUB2 to the Master Boot Record?

Accepted Answer

grub-install /dev/sda. After creating a new partition table on /dev/sda, the Master Boot Record (MBR) resides on the disk device itself, not on a partition. The `grub-install /dev/sda` command installs GRUB2's boot code into the MBR (first 440 bytes) and embeds the core image in the post-MBR gap. This makes the disk bootable by the BIOS.

Answer

grub-mkconfig -o /boot/grub/grub.cfg

Answer

update-grub

Answer

grub-install /dev/sda1

Question 13

A Linux host has a routing table entry that sends all traffic destined for the 10.0.0.0/8 network out interface eth1. A packet is sent from 192.168.1.100 to 10.0.0.5. Which interface will the packet exit?

Accepted Answer

eth1. The routing decision is made by looking up the destination address in the routing table. Since the destination is 10.0.0.5, which matches the route for 10.0.0.0/8 via eth1, the packet is sent out eth1. The source address does not affect the routing decision; the kernel selects the exit interface based solely on the destination IP and the routing table.

Answer

eth0, then eth1 after ARP

Answer

eth0

Answer

lo

Question 14

Which TWO statements about LVM thin provisioning are correct?

Accepted Answer

The filesystem on a thin volume must support the 'discard' option to free unused space.. Thin volumes allocate data blocks on demand from a thin pool. To allow the underlying physical storage to reclaim unused blocks when files are deleted, the filesystem must support the 'discard' option (or use fstrim) so that it can notify the device mapper of freed space. Without discard, the thin pool never learns that blocks are no longer in use, preventing space reclamation.

Answer

Thin pools are created using the 'pvcreate' command.

Answer

Thin provisioning requires a dm-cache device to function.

Answer

Thin volumes automatically grow when they run out of space.

Question 15

Which THREE are valid values for the 'security' parameter in smb.conf? (Choose three.)

Accepted Answer

ads. (ads) is correct because the 'security = ads' setting in smb.conf configures Samba to operate in Active Directory domain member mode, allowing it to join an Active Directory domain using Kerberos authentication and LDAP for identity resolution. This is a valid security mode for integrating Samba with Windows Active Directory environments.

Answer

auto

Answer

share