LPIC-2 Practice Test 35 — 15 Questions

Question 1

An administrator observes that only one path is shown as active for mpathb. What is the most likely cause?

Accepted Answer

The blacklist rule excludes the other path.. When only one path is active for a multipath device (mpathb), the most likely cause is that the other path is being excluded by a blacklist rule in the multipath configuration. The blacklist can filter out devices based on WWID, device name, or vendor/product, preventing them from being aggregated into the multipath map. This results in the path being visible to the system but not used by multipathd.

Answer

The find_multipaths setting is incorrect.

Answer

The SCSI devices are not properly connected.

Answer

The multipathd service is not running.

Question 2

A system administrator has compiled a custom Linux kernel (version 5.15.19) with ext4 filesystem support built as a module. The administrator installed the kernel to /boot and built an initramfs using dracut with default options. After rebooting, the system fails with a kernel panic: 'VFS: Unable to mount root fs on unknown-block(0,0)'. The administrator confirms that the root partition is /dev/sda1 formatted as ext4 and that the kernel configuration includes the ext4 module. The kernel command line includes 'root=/dev/sda1' and 'rd.auto'. The administrator also notices that the initramfs file is only 5 MB in size, which seems smaller than expected. Which of the following is the most likely cause and best solution?

Accepted Answer

The initramfs is missing the ext4 module because dracut did not include it. The administrator should run 'dracut --force --add-drivers ext4 /boot/initramfs-5.15.19.img 5.15.19' to regenerate the initramfs including the ext4 module.. The small initramfs size (5 MB) suggests it does not contain the ext4 module. Dracut should have included it automatically, but may have failed. Rebuilding with --force and explicitly adding the ext4 driver ensures the module is included. Compiling ext4 into the kernel would work but is not the most efficient solution; changing the root parameter would not help because the device is correct; rd.shell would allow debugging but not fix the underlying issue.

Answer

The kernel command line needs the 'rd.shell' parameter to allow interactive debugging. The administrator should add 'rd.shell' to the kernel parameter and boot again to investigate.

Answer

The root filesystem label or UUID is incorrect. The administrator should change the kernel command line to use 'root=LABEL=root' or 'root=UUID=...'.

Answer

The kernel is missing the ext4 module because it was not compiled. The administrator should recompile the kernel with ext4 compiled directly into the kernel (y) instead of as a module.

Question 3

A system administrator configures a Linux client to authenticate users via an LDAP directory directory for user login. The LDAP server is located on a remote network across a WAN link with moderate latency. Authentication succeeds, but user logins take 10-15 seconds to complete, causing delays. The LDAP server logs show low CPU usage and minimal queries per second. The client has not yet implemented any local caching services. The administrator wants to reduce the login delay without compromising security. What should the administrator do?

Accepted Answer

Enable nscd (Name Service Cache Daemon) to cache passwd, group, and services lookups.. Enabling nscd caches user and group information, which reduces the number of LDAP queries and significantly speeds up logins. Other options are less effective or introduce security risks. Increasing server threads does not address client-side delays. Disabling TLS is a security risk. Changing file ownership is irrelevant.

Answer

Disable LDAP TLS encryption to reduce cryptographic overhead.

Answer

Change the file ownership of /etc/pam.d/common-auth to root to force direct LDAP reads.

Answer

Increase the number of LDAP server threads to handle concurrent requests faster.

Question 4

A company runs an Apache web server (port 80) and an SSH server (port 22) for remote administration. The system administrator notices that the server has become sluggish and network traffic has increased significantly. Checking /var/log/auth.log reveals hundreds of failed SSH authentication attempts per minute from diverse IP addresses targeting the 'admin' user. The administrator wants to mitigate this brute-force attack with minimal impact on legitimate users. Which course of action is most effective?

Accepted Answer

Install and configure fail2ban to block IP addresses after 5 failed SSH attempts within 10 minutes.. Install fail2ban to automatically block IPs after repeated failures, preventing brute-force without disrupting legitimate users who might retry.

Answer

Change the SSH port to a non-standard port number.

Answer

Disable password authentication for SSH and use key-based authentication only.

Answer

Add the offending IP addresses to /etc/hosts.deny manually.

Question 5

A company runs a DNS server using BIND9 on a Linux server. The server is configured with two network interfaces: one internal (192.168.1.10) and one external (203.0.113.10). The server is configured to be authoritative for example.com. Internal clients can resolve example.com, but external clients receive "SERVFAIL" responses. The host command from an external client returns "Host not found". The administrator checks the named configuration and finds the following in /etc/bind/named.conf.options:

options {
  directory "/var/cache/bind";
  listen-on { 127.0.0.1; 192.168.1.10; 203.0.113.10; };
  allow-query { 192.168.1.0/24; };
  recursion no;
  dnssec-validation auto;
};

The zone configuration for example.com has proper allow-transfer and allow-update settings. What change should be made to resolve external queries?

Accepted Answer

Change 'allow-query' to '{ any; };'. The 'allow-query' directive restricts which clients can send queries to the server. With 'allow-query { 192.168.1.0/24; };', only internal clients on that subnet are permitted to query, causing external clients to receive SERVFAIL. Changing it to '{ any; };' allows all clients to query the server, resolving the issue while still keeping recursion disabled for security.

Answer

Add 'recursion yes;' to the options block.

Answer

Add 'listen-on port 53 { 203.0.113.10; };' to the options block.

Answer

Change 'listen-on' to '{ any; };'

Question 6

A systems administrator is configuring a Postfix mail server to use Dovecot for SASL authentication. The authentication method is set to PLAIN in Dovecot, and Postfix has smtpd_sasl_auth_enable=yes and smtpd_sasl_type=dovecot. Dovecot's auth socket is at /var/run/dovecot/auth-client. The mail logs show repeated "SASL authentication failed" errors for known good credentials. The administrator checks that the socket exists and that Dovecot is running. What is the most likely cause?

Accepted Answer

The postfix user does not have read permission on the Dovecot auth socket.. The most likely cause is that the Postfix user (typically 'postfix' or the mail queue owner) lacks read permission on the Dovecot auth socket at /var/run/dovecot/auth-client. Dovecot's SASL authentication via a Unix socket requires the connecting process (Postfix) to have read/write access to that socket file. Even though the socket exists and Dovecot is running, if the permissions are too restrictive (e.g., owned by 'dovecot' with mode 0600), Postfix cannot communicate with Dovecot's auth service, resulting in repeated 'SASL authentication failed' errors despite valid credentials.

Answer

The smtpd_recipient_restrictions does not include permit_sasl_authenticated.

Answer

The Dovecot service is not listening on TCP port 143 for IMAP.

Answer

The mynetworks parameter in Postfix is set incorrectly.

Question 7

A Linux server with two NICs bonded in mode 1 (active-backup) was working correctly until a switch was replaced. Now, although both interfaces are up, the bond always shows only one active slave, and if that slave fails, traffic does not fail over. The bonding configuration uses miimon=100 and neither arp_interval nor arp_ip_target is set. You run 'cat /proc/net/bonding/bond0' and see that the MII status of both slaves is 'up' but the link failures count is 0 for the backup slave. What is the most likely cause, and which parameter should be adjusted?

Accepted Answer

Configure arp_interval and arp_ip_target to enable ARP monitoring.. Option D is correct because without ARP monitoring (arp_interval and arp_ip_target), the bond relies solely on MII status to detect link failures. MII monitoring only detects physical link loss at the NIC level, not upstream switch failures or misconfigurations. In this scenario, the switch replacement likely caused a layer-2 or layer-3 issue that does not bring the NIC link down, so MII reports 'up' but traffic cannot pass. Enabling ARP monitoring forces the bond to verify reachability of a target IP, triggering failover when ARP replies are lost.

Answer

Change bonding mode to mode 4 (802.3ad) with LACP.

Answer

Use ifenslave to manually reassign the backup slave.

Answer

Decrease miimon to 50 for faster detection.

Question 8

A web administrator has installed Apache httpd 2.4 on a Linux server. The default configuration serves files from /var/www/html. When accessing http://server/, the browser shows a directory listing of /var/www/html instead of the index.html file that exists in that directory. The administrator confirms that the user has read permissions on the file and that the file is named index.html. Which directive is most likely missing from the Apache configuration?

Accepted Answer

DirectoryIndex index.html. The DirectoryIndex directive specifies which file Apache should serve when a client requests a directory (e.g., /). Without it, or if it does not list index.html, Apache falls back to generating a directory listing (if Options +Indexes is enabled) or returns a 403 Forbidden. Since the default configuration for Apache 2.4 includes Options +Indexes and DirectoryIndex index.html, the most likely cause is that the DirectoryIndex directive was removed or overridden in a context (e.g., a <Directory> block) and no longer includes index.html, causing Apache to ignore the file and show the directory listing instead.

Answer

IndexOptions FancyIndexing

Answer

Options -Indexes

Answer

Require all granted

Question 9

A small office uses a Samba server for file sharing. The server is running Samba 4.9 on Ubuntu 18.04. Recently, the administrator added a new user 'john' to the system and added him to the 'staff' group. However, when John tries to access the share 'docs' from his Windows laptop, he gets an 'Access Denied' error. The share configuration is:
[docs]
    path = /srv/docs
    valid users = @staff
    read only = No
    create mask = 0644
    directory mask = 0755

The administrator verifies that John is a member of the staff group by running 'groups john' which shows staff. Other users in staff can access the share. What is the most likely cause?

Accepted Answer

John's Windows credentials are cached from a previous failed attempt.. Option C is correct because Samba caches user credentials and group memberships at the time of the initial connection. When John first attempted to access the share, Samba cached his credentials (including group membership) before he was added to the staff group. Even though the system now shows John as a member of staff, Samba continues to use the cached credentials, resulting in 'Access Denied'. Clearing the cached credentials on the Windows client (e.g., via 'net use * /delete' or Credential Manager) forces a fresh authentication and group lookup.

Answer

The create mask is too restrictive for John's files.

Answer

The valid users parameter requires the group to be listed with a plus sign for domain groups.

Answer

The Samba service needs to be restarted to reload the group membership.

Question 10

A small office uses a Linux server running Samba to share documents. The share is accessible but very slow, especially when writing large files. The network is 1 Gbps, and disk performance is fine. The smb.conf has default settings. Which change is most likely to improve write performance?

Accepted Answer

Set 'write cache size = 262144'.. The 'write cache size' option enables a per-file write cache in Samba that buffers write operations before committing them to disk. With default settings, Samba may perform synchronous writes for each chunk, causing severe slowdowns on large file transfers. Setting a write cache size (e.g., 262144 bytes) allows Samba to aggregate writes, dramatically improving throughput on a fast network with adequate disk performance.

Answer

Set 'strict sync = yes'.

Answer

Set 'use sendfile = yes'.

Answer

Set 'socket options = TCP_NODELAY IPTOS_LOWDELAY'.

Question 11

A company runs a mixed environment with Linux and Windows clients. The Samba server is configured as a domain member for authentication. Users authenticate via Active Directory using winbind. Recently, the IT department implemented a new password policy that requires all users to change passwords every 90 days. After the policy took effect, several users report that they cannot access Samba shares from their Linux clients (using smbclient) even though they can log into their Windows desktops with the same credentials. The error message on Linux is 'session setup failed: NT_STATUS_LOGON_FAILURE'. The administrator runs 'wbinfo -a username%password' and it succeeds. What is the most likely cause?

Accepted Answer

The Samba server's cached credentials for these users have expired and not been refreshed.. Option C is correct because when a Samba server is a domain member using winbind, it caches user credentials to reduce authentication traffic to the domain controller. After the new 90-day password policy, users changed their passwords on Windows, but the cached credentials on the Samba server were not refreshed. The `wbinfo -a` command succeeds because it contacts the domain controller directly, bypassing the cache, while `smbclient` fails because it uses the stale cached credentials, resulting in NT_STATUS_LOGON_FAILURE.

Answer

The Samba server's krb5.conf is misconfigured for the new password policy.

Answer

The users' passwords contain characters that are not being encoded correctly by smbclient.

Answer

The Linux clients are using an older version of Samba that does not support the new password policy.

Question 12

An enterprise environment uses Samba as an Active Directory domain controller using Samba 4.11. The administrator needs to configure a read-only domain controller (RODC) for a remote branch office. Which of the following steps is correct?

Accepted Answer

On the existing DC, run 'samba-tool domain rodc create rodc-name' and then on the RODC server join with 'samba-tool domain join EXAMPLE.COM RODC'.. Option C is correct because Samba 4.11 requires the RODC computer account to be pre-created on the existing DC using 'samba-tool domain rodc create', which sets up the necessary krbtgt account and replication metadata. The RODC server then joins the domain as a read-only domain controller with 'samba-tool domain join EXAMPLE.COM RODC', which authenticates against the pre-created account and configures the local Samba instance as a read-only replica.

Answer

On the RODC server, run 'samba-tool domain join EXAMPLE.COM member' and then promote to RODC.

Answer

Install Samba on the RODC server, then run 'samba-tool domain provision --domain=EXAMPLE --adminpass=Pa$$w0rd' on the RODC.

Answer

Install Samba on the RODC server, then run 'samba-tool domain join EXAMPLE.COM RODC -UAdministrator'.

Question 13

A company has a Samba server configured as a domain member in an Active Directory domain. The server runs Samba 4.13. Recently, Windows clients have been unable to access shares, and the domain join seems broken. The administrator runs 'net ads testjoin' and gets 'Join to domain is not valid'. The smb.conf includes: security = ads, realm = EXAMPLE.COM, workgroup = EXAMPLE. The administrator can successfully resolve the domain controller via DNS. What should the administrator do to fix the issue?

Accepted Answer

Re-run 'net ads join -U administrator' to rejoin the domain.. The 'net ads testjoin' command returned 'Join to domain is not valid', which indicates the machine account password stored in the local secrets.tdb file no longer matches the one in Active Directory. Re-running 'net ads join -U administrator' re-establishes the secure channel by resetting the machine account password and updating the Kerberos keytab, restoring the domain membership.

Answer

Restart the winbind service and run 'wbinfo -t'.

Answer

Add 'kerberos method = secrets and keytab' to smb.conf.

Answer

Increase the 'log level' to 3 and restart smbd.

Question 14

A company develops a custom PCIe device driver as a kernel module. After installing a new kernel version 5.10.50 via a distribution update, the existing driver module fails to load with the error: 'insmod: ERROR: could not insert module mydriver.ko: Invalid module format'. The administrator checks the kernel version and sees that the module was compiled against a previous kernel version 5.10.45. The driver source code is available in /usr/src/mydriver. The administrator needs to get the driver working with the new kernel. Which of the following is the correct course of action?

Accepted Answer

Recompile the module using 'make -C /lib/modules/$(uname -r)/build M=/usr/src/mydriver modules'. Option C is correct because the kernel module was compiled against a different kernel version (5.10.45) and the new kernel (5.10.50) has a different vermagic string, which includes the kernel version and other build parameters. The module must be recompiled against the new kernel's build tree located at /lib/modules/$(uname -r)/build to match the vermagic and ensure symbol compatibility. The command 'make -C /lib/modules/$(uname -r)/build M=/usr/src/mydriver modules' uses the kernel build system to compile the module against the running kernel's configuration and headers.

Answer

Copy the compiled .ko file to /lib/modules/5.10.50/kernel/drivers/misc/ and run 'depmod -a'

Answer

Edit the module's Makefile to change the version string to match the new kernel

Answer

Use 'modprobe --force mydriver' to bypass the version check

Question 15

A data center administrator is troubleshooting a server that hangs during boot after a kernel update. The server uses UEFI and GRUB 2. The administrator observes that the server displays the GRUB menu, selects the new kernel entry, but then the screen goes blank and the system does not respond. The administrator can boot the previous kernel from the GRUB menu successfully. Which of the following is the most likely cause of this issue?

Accepted Answer

The new kernel includes a graphics driver that conflicts with the hardware, causing the display to blank. Option D is correct because the blank screen after selecting the new kernel, while the old kernel works, strongly indicates a graphics driver conflict. In GRUB 2 with UEFI, the kernel may switch from the UEFI framebuffer to a native graphics driver (e.g., nouveau, i915, amdgpu) that fails to initialize on the specific hardware, causing the display to go blank. The system is not truly hung; it continues booting without console output, which is a known issue with incompatible or buggy kernel graphics drivers.

Answer

The initramfs for the new kernel was not generated

Answer

Secure Boot is enabled and the new kernel is not signed

Answer

The new kernel's root= parameter points to an invalid device

LPIC-2 Practice Test 35 — 15 Questions

Exhibit

LPIC-2 Practice Test 35 — 15 Questions

Exhibit