LPIC-2 Practice Test 35 — 15 Questions

Question 1

An administrator wants to check the ARP cache for a specific IP address 192.168.1.1. Which command will display the ARP entry for that address?

Accepted Answer

arp -n | grep 192.168.1.1. `arp -n` displays the ARP cache in numeric format, and piping it through `grep 192.168.1.1` filters the output to show only the entry for that specific IP address. The `-n` flag prevents reverse DNS lookups, ensuring the output contains raw IP addresses, which is essential for reliable filtering.

Answer

ip neigh show 192.168.1.1

Answer

arp -a 192.168.1.1

Answer

route -n

Question 2

Which THREE files are commonly involved in configuring a Linux client for LDAP authentication?

Accepted Answer

/etc/pam.d/system-auth. /etc/pam.d/system-auth (or its equivalent, such as /etc/pam.d/common-auth on Debian-based systems) is the central PAM configuration file that defines authentication modules. For LDAP authentication, the pam_ldap module is typically stacked here to allow LDAP-based user credential verification, making it essential for integrating LDAP into the system's authentication flow.

Answer

/etc/hosts

Answer

/etc/resolv.conf

Question 3

A Postfix administrator wants to restrict which clients can relay mail through the server. Which three smtpd restriction lists are typically used for this purpose? (Choose three.)

Accepted Answer

smtpd_helo_restrictions. A is correct because `smtpd_helo_restrictions` allows the administrator to enforce checks based on the HELO/EHLO hostname presented by the client during the SMTP greeting. By using restrictions like `reject_invalid_helo_hostname` or `reject_non_fqdn_helo_hostname`, the server can block clients that provide suspicious or non-compliant HELO names, which is a common tactic to prevent unauthorized relay attempts.

Answer

smtpd_data_restrictions

Answer

smtpd_sender_restrictions

Question 4

A company's network has a single switch connecting all devices. The IT manager wants to isolate the development team's traffic from the rest of the network without buying new hardware. Which configuration should the administrator implement on the switch ports connected to the development team's computers?

Accepted Answer

Set the ports to access mode and assign them to VLAN 10.. VLANs (Virtual Local Area Networks) logically segment a network at Layer 2, isolating traffic between groups without requiring additional hardware. Setting the switch ports to access mode and assigning them to VLAN 10 places the development team's computers into a separate broadcast domain, preventing their traffic from being visible to devices in other VLANs. This is the standard method for implementing port-based VLAN membership on a managed switch.

Answer

Enable port security with a maximum MAC address count.

Answer

Configure the switch ports as part of a bridge group.

Answer

Set the ports to trunk mode.

Question 5

A system administrator notices that a new iSCSI target is not appearing as a block device after running iscsiadm. The target is known to be online and reachable. What is the most likely cause?

Accepted Answer

The iSCSI service (iscsid) is not running.. The iSCSI initiator requires the `iscsid` daemon to be running in order to process discovery and login requests from `iscsiadm`. Even if the target is online and reachable, without the `iscsid` service, the kernel's iSCSI layer cannot establish a session or create the corresponding block device (e.g., /dev/sdX). This is the most likely cause because the administrator has confirmed network connectivity and target availability, leaving the service state as the primary suspect.

Answer

The iSCSI initiator name is not set.

Answer

The target IQN is not specified correctly.

Answer

The network interface is down.

Question 6

An organization's Postfix mail server is being used as an open relay. The administrator wants to restrict relaying to only authenticated users from the internal network. Which combination of settings is correct?

Accepted Answer

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination. It enforces relaying restrictions in the correct order: first permit mail from trusted internal networks (permit_mynetworks), then permit authenticated users (permit_sasl_authenticated), and finally reject all other unauthorized destinations (reject_unauth_destination). This ensures that only authenticated users or hosts in mynetworks can relay, while blocking open relay attempts from external unauthenticated sources.

Answer

smtpd_helo_restrictions = permit_sasl_authenticated, reject_unauth_destination

Answer

smtpd_recipient_restrictions = reject_unauth_destination, permit_mynetworks, permit_sasl_authenticated

Answer

smtpd_client_restrictions = permit_mynetworks, reject_unauth_destination

Question 7

Which THREE of the following are valid methods to restrict access to the su command on a Linux system?

Accepted Answer

Set the SU_WHEEL_ONLY variable in /etc/login.defs.. Options A, D, and E are all valid methods to restrict access to the su command. Option A is correct: setting SU_WHEEL_ONLY to 'yes' in /etc/login.defs restricts su to members of the wheel group. Option D is correct because /etc/suauth allows specifying allowed users or groups. Option E is correct because pam_wheel.so in /etc/pam.d/su restricts access to wheel group members. Options B and C are incorrect: /etc/shells controls allowed shells for chsh, not su, and configuring sudoers allows running su via sudo but does not restrict the su command itself.

Answer

Modify /etc/shells to include only approved shells.

Answer

Configure sudoers to allow only specific users to run su.

Question 8

Your company runs a web application on a Linux server that uses Apache HTTPD with mod_ssl for HTTPS. Recently, after a security audit, it was discovered that the server is vulnerable to the POODLE attack on SSLv3. The server is running RHEL 8 with Apache 2.4. The SSL configuration file /etc/httpd/conf.d/ssl.conf currently has the line 'SSLProtocol all -SSLv2'. You need to disable SSLv3 and also disable all versions of TLS below 1.2, while still allowing TLS 1.2 and 1.3. The server must remain available immediately. Which action should you take?

Accepted Answer

Change 'SSLProtocol all -SSLv2' to 'SSLProtocol TLSv1.2 TLSv1.3'. The directive 'SSLProtocol TLSv1.2 TLSv1.3' explicitly enables only TLS 1.2 and TLS 1.3, thereby disabling SSLv3 and all TLS versions below 1.2 (i.e., TLS 1.0 and TLS 1.1). This directly addresses the POODLE vulnerability (which exploits SSLv3) and enforces the required minimum TLS version, while keeping the server immediately available without restarting Apache (a graceful reload is sufficient).

Answer

Change 'SSLProtocol all -SSLv2' to 'SSLProtocol all -SSLv2 -SSLv3'

Answer

Add 'SSLProtocol -SSLv3' after the existing line

Answer

Change the line to 'SSLProtocol TLSv1.2 TLSv1.3 -SSLv2 -SSLv3'

Question 9

A Samba server is configured to store NT ACLs on a Linux filesystem that does not support them natively. Which VFS module should be used to map NT ACLs to POSIX ACLs?

Accepted Answer

vfs objects = acl_xattr. The `acl_xattr` VFS module is specifically designed to store NT ACLs in extended attributes on a Linux filesystem that lacks native NT ACL support. When Samba is configured with `vfs objects = acl_xattr`, it maps Windows NT ACLs to POSIX ACLs by serializing the NT ACL into the `user.NTACL` extended attribute, allowing Samba to enforce Windows-style permissions even on filesystems like ext4 or XFS that only support POSIX ACLs natively.

Answer

vfs objects = recycle

Answer

vfs objects = full_audit

Answer

vfs objects = streams_xattr

Question 10

A Samba server is configured as a domain member in an Active Directory environment. Users report that after changing their password on a Windows client, they cannot authenticate to Samba shares. The Samba server is using winbind and the 'idmap_ad' backend. What is the most likely cause?

Accepted Answer

Password changes are not replicated to the domain controller that Samba authenticates against. In an Active Directory domain member configuration, Samba authenticates against a specific domain controller (DC). When a user changes their password on a Windows client, the new password is initially written to the DC that processed the change. If the Samba server's winbind service is authenticating against a different DC that has not yet received the replicated password update, authentication will fail. This is the most likely cause because password replication in AD is not instantaneous and depends on replication latency.

Answer

The 'winbind offline logon' option is not enabled

Answer

The winbind cache is outdated and needs to be cleared

Answer

The 'idmap backend' must be set to 'rid' instead of 'ad'

Question 11

A company runs a mixed Linux/Windows environment. The Samba server (version 4.15) is configured as a domain member using 'security = ADS'. Recently, the IT team enabled 'winbind use default domain = yes' to simplify logins. After the change, users report that they can no longer access Samba shares when authenticating with just their username (e.g., 'jdoe') instead of 'DOMAIN\jdoe'. However, authentication using the full domain-qualified name still works. The smb.conf includes:

[global]
security = ADS
workgroup = MYDOM
realm = MYDOM.LOCAL
winbind use default domain = yes
winbind separator = /

Users are in the 'Domain Users' group and the share configuration is:
[share]
path = /srv/share
valid users = @"MYDOM\domain users"

Which of the following is the most likely cause and solution?

Accepted Answer

Change 'winbind separator' to backslash or remove it to default to backslash. When 'winbind use default domain = yes' is set, Samba expects the winbind separator to be a backslash (\), not a forward slash (/). With a forward slash separator, the username 'jdoe' is not correctly mapped to 'MYDOM\jdoe' during authentication, causing access failures. Changing the separator to backslash (or removing it to default to backslash) resolves the issue by aligning with Samba's internal handling of default domain usernames.

Answer

Disable 'winbind use default domain' to force full domain qualification

Answer

The valid users line uses quotes around the group name; remove the quotes

Answer

Enable 'winbind offline logon' to allow cached credentials

Question 12

A developer compiled a custom kernel, installed it, but the system hangs before init starts. The previous kernel works. Which step was most likely missed?

Accepted Answer

Not rebuilding initramfs. When a custom kernel is compiled and installed, the initramfs must be rebuilt to include the necessary kernel modules for mounting the root filesystem at boot. If the initramfs is not regenerated, the kernel may lack critical drivers (e.g., for storage controllers or filesystems), causing the system to hang before init starts because it cannot access the root device. The previous kernel works because its initramfs was built with the correct modules for that kernel version.

Answer

Not updating GRUB configuration

Answer

Not running depmod

Answer

Not setting the correct root filesystem

Question 13

To implement 802.1X port-based authentication on a Linux network interface, which combination of software components is typically required when the Linux system acts as the supplicant?

Accepted Answer

wpa_supplicant and hostapd. To implement 802.1X port-based authentication as a Linux supplicant, only wpa_supplicant is required. hostapd is an authenticator (AP/switch side) and is not needed on the client. The other options include unnecessary components (hostapd, freeradius, sssd). Therefore none of the given combinations is correct.

Answer

hostapd and freeradius

Answer

wpa_supplicant and sssd

Answer

freeradius and wpa_supplicant

Question 14

A client on the internet sends a TCP SYN packet to 10.0.1.10:8080. The router receives it on eth0. According to the exhibit, what will happen to the packet?

Accepted Answer

The packet is forwarded to 10.0.2.5:80 via eth1, with source IP unchanged.. The router performs destination NAT (DNAT) on the packet, changing the destination from 10.0.1.10:8080 to 10.0.2.5:80, and forwards it out eth1 with the source IP unchanged. Therefore, option D is correct. Option A is incorrect because the packet is not dropped. Option B is incorrect because the packet is not simply forwarded to the default gateway; the DNAT rule overrides the destination. Option C is incorrect because no source NAT (SNAT) is performed, so the source IP remains the same.

Answer

The packet is dropped because the destination IP is not directly connected.

Answer

The packet is forwarded to 10.0.1.1 because it is the default gateway.

Answer

The packet is forwarded to 10.0.2.5:80 via eth1, with source IP changed to 10.0.2.20.

Question 15

Which TWO commands can be used to query a DHCP server's lease database on a Linux server running ISC DHCP? (Assume default paths.) (Select two.)

Accepted Answer

cat /var/lib/dhcp/dhcpd.leases. The ISC DHCP server stores its lease database in a plain-text file at `/var/lib/dhcp/dhcpd.leases` by default. Reading this file with `cat` directly displays all active and expired leases, including IP addresses, MAC addresses, and lease durations. Option C is correct because `dhcp-lease-list` is a utility that parses the same lease file and presents the data in a formatted, human-readable table.

Answer

dhcpd -t

Answer

less /etc/dhcp/dhcpd.conf

Answer

dhcpd -p