LPIC-2 Practice Test 36 — 15 Questions

Question 1

A company has a fleet of servers running a custom Linux kernel version 5.4. They have developed several in-house kernel modules that interface with proprietary hardware. Due to a security vulnerability, the company decides to upgrade all servers to kernel version 5.10. After upgrading the kernel on a test server, the custom modules fail to load with the error 'Invalid module format' or 'disagrees about version magic'. The system administrator must resolve this issue for all servers. The modules are closed-source and cannot be modified easily. The administrator considers the following options. Question: What is the most effective course of action to load the custom modules on the new kernel?

Accepted Answer

Recompile the custom kernel modules against the new kernel headers and install them.. Option A is correct because the custom kernel modules were compiled against the version magic string of kernel 5.4. Kernel 5.10 has a different version magic (which includes the kernel version, SMP/preemption settings, and compiler version). Recompiling the modules against the new kernel headers regenerates the correct version magic, allowing the modules to load without error. Since the modules are closed-source, recompilation is not possible in practice, but the question states the administrator considers options; recompilation is the only technically valid method to resolve the version magic mismatch.

Answer

Use modprobe with the --force-vermagic option to bypass the version check.

Answer

Update the version magic string in the module binary by patching the file.

Answer

Use systemd-modules-load to load the modules later in the boot process.

Question 2

A Linux system administrator is tasked with upgrading the kernel on a server running a custom compiled kernel (version 4.19) with many in-house modules. The new kernel (5.10) has significant changes, including a different API for some module functions. After compiling the new kernel and the modules, the system boots but some modules fail to load with 'Unknown symbol' errors. The administrator needs to identify which symbols are missing and fix the modules. Which of the following is the most effective approach?

Accepted Answer

Run 'modprobe --dump-modversions mymodule.ko' and compare with 'cat /proc/kallsyms' to identify mismatches. Option C is correct because `modprobe --dump-modversions mymodule.ko` displays the symbol version (CRC) checksums for each symbol the module uses, and comparing these with `/proc/kallsyms` (which lists all symbols exported by the running kernel along with their CRC values) directly pinpoints which symbols have mismatched versions. This is the most efficient method to identify 'Unknown symbol' errors caused by API changes between kernel 4.19 and 5.10, as it reveals exactly which symbols need updating in the module source code.

Answer

Check dmesg for each module load error and recompile modules one by one

Answer

Rename the missing symbols in the source code to match the new kernel's exported symbols

Answer

Use 'nm mymodule.ko' to list all symbols and manually compare with the kernel's symbol table

Question 3

A company's file server uses NFS to export /data to clients. An administrator configures an NFS client by running 'mount -t nfs fileserver:/data /mnt/data'. The mount succeeds and the user can read files. However, after a network interruption, the client system becomes unresponsive when a user attempts to access /mnt/data. Which action should the administrator take to prevent this issue in the future?

Accepted Answer

Add the 'soft' option to the mount command: 'mount -t nfs -o soft fileserver:/data /mnt/data'.. Option B is correct because using a 'soft' mount causes NFS operations to return an error to the calling application after a timeout, rather than hanging indefinitely. This prevents the client system from becoming unresponsive when the NFS server is unreachable, as the kernel will not retry the request forever. The default 'hard' mount (used in the original command) will keep retrying until the server responds, which can block processes and make the system appear frozen.

Answer

Add the 'intr' mount option to allow signal interrupts.

Answer

Increase the timeout value with 'timeo=600' and keep the hard mount.

Answer

Use the 'noac' option to disable attribute caching.

Question 4

An administrator configured an autofs direct map for a remote NFS share. The master map at /etc/auto.master contains a line: '/data /etc/auto.direct'. The direct map file /etc/auto.direct has: '/projects -rw,soft fileserver:/exports/projects'. When a user tries to cd /data/projects, it hangs. The autofs service is running. What is the most likely cause?

Accepted Answer

The master map should use '/-' instead of '/data' for direct maps.. Direct maps in autofs must use the special mount point '/-' in the master map, not an actual directory path like '/data'. When '/data' is specified, autofs treats it as an indirect map key, causing it to look for a subdirectory matching the key under '/data' rather than triggering the direct mount of '/projects'. This mismatch leads to a hang when the user attempts to access '/data/projects' because autofs never attempts the NFS mount.

Answer

The NFS server fileserver is not exporting /exports/projects.

Answer

The autofs service is not started.

Answer

The 'soft' mount option is missing.

Question 5

A Linux client is configured to use PAM for authentication against an LDAP server. The /etc/pam.d/system-auth includes 'auth required pam_ldap.so'. Users can authenticate successfully. However, when a user runs 'id username', it shows 'uid=1000(username) gid=100(users) groups=100(users)' but the LDAP group membership is not shown. Which configuration file is most likely misconfigured?

Accepted Answer

The /etc/nsswitch.conf 'group' line does not include 'ldap'.. The 'id' command queries the Name Service Switch (NSS) to resolve user and group information. Even though PAM (via pam_ldap.so) successfully authenticates the user against LDAP, the group membership lookup fails because NSS is not configured to consult LDAP for group data. The /etc/nsswitch.conf file must include 'ldap' in the 'group' line (e.g., 'group: files ldap') to enable the system to retrieve LDAP group memberships.

Answer

The PAM configuration uses 'required' instead of 'sufficient' for pam_ldap.

Answer

The /etc/ldap.conf file is missing the 'nss_base_group' line.

Answer

The autofs service is not running.

Question 6

A DHCP client reports it cannot obtain an IP address. The Ethernet cable is connected and the interface is up. The administrator runs 'dhclient eth0' but gets 'No DHCPOFFERS received'. The network has a DHCP server on the same subnet. Which command should the administrator use next to diagnose the problem?

Accepted Answer

Run 'tcpdump -i eth0 port 67 or port 68' to monitor DHCP packets.. Option C is correct because the client is not receiving DHCPOFFERs, indicating a network-level issue with DHCP traffic. Using tcpdump to capture packets on ports 67 (BOOTP server) and 68 (BOOTP client) allows the administrator to see if DHCPDISCOVER packets are leaving the client and whether any DHCPOFFER packets arrive from the server. This directly isolates whether the problem is a lack of server response, packet filtering, or a misconfigured relay agent.

Answer

Run 'route -n' to see if a default route exists.

Answer

Run 'netstat -i eth0' to check packet errors.

Answer

Run 'ifconfig eth0' to check the interface status.

Question 7

A user reports that they cannot SSH to a remote server using the usual command 'ssh user@remote.example.com'. The administrator tests and gets 'Permission denied (publickey,gssapi-keyex,gssapi-with-mic)'. The user's public key is in ~/.ssh/authorized_keys on the remote server. The local client has the matching private key. Which step should the administrator take to resolve the issue?

Accepted Answer

Check /var/log/auth.log on the remote server to see why the key was rejected.. The error message indicates that the SSH server rejected all offered authentication methods, including publickey. Since the user's public key is in the remote server's authorized_keys file and the client has the matching private key, the most likely cause is a file permission or SELinux/AppArmor issue on the remote server, or a key format mismatch. Checking /var/log/auth.log on the remote server will show the exact reason for the rejection, such as 'bad permissions' or 'key not recognized', allowing targeted troubleshooting.

Answer

Generate a new RSA key pair on the client with ssh-keygen.

Answer

Run 'ssh-add' to add the private key to the SSH agent.

Answer

Restart the sshd service on the client.

Question 8

A company runs a database server on Linux with a 4-disk RAID 10 array using mdadm. The server recently experienced a power outage. After reboot, the array is not assembling automatically. The administrator runs `mdadm --assemble --scan` and it fails with a message: 'mdadm: /dev/md0 has been found but is not a valid md superblock.' The administrator checks /proc/mdstat and sees no arrays. The disks /dev/sda, /dev/sdb, /dev/sdc, /dev/sdd are present. Running `mdadm --examine /dev/sda` shows no md superblock, but the disk contains data partitions. The administrator suspects that the superblock may be corrupted or that the disks were accidentally overwritten. The administrator has documentation that the array was created with the following parameters: RAID level 10, 4 disks, chunk size 512 KiB, metadata 1.2. What is the best course of action to recover the array?

Accepted Answer

Use `mdadm --create --level=10 --raid-devices=4 --chunk=512 --metadata=1.2 --assume-clean /dev/md0 /dev/sda /dev/sdb /dev/sdc /dev/sdd` and then mount.. Option D is correct because when the md superblock is missing or corrupted on all disks (as confirmed by `mdadm --examine` showing no superblock), the only way to recover the array is to recreate it with `--assume-clean`. This tells mdadm to trust that the data on the disks is already in a consistent RAID 10 layout without performing an initial resync, which would overwrite the existing data. The parameters must exactly match the original creation (RAID 10, 4 disks, chunk 512 KiB, metadata 1.2) to reconstruct the correct data mapping.

Answer

Use `mdadm --create --level=10 --raid-devices=4 --chunk=512 --metadata=1.2 /dev/md0 /dev/sda /dev/sdb /dev/sdc /dev/sdd` without --assume-clean and then run fsck.

Answer

Run `mdadm --examine --scan` to probe for superblocks on all disks, then attempt recovery with --super-minor or --uuid.

Answer

Use `dd` to backup each disk's first few sectors, then use a data recovery tool.

Question 9

Your company runs a web application on a Linux server that uses Apache HTTPD with mod_ssl for HTTPS. Recently, after a security audit, it was discovered that the server is vulnerable to the POODLE attack on SSLv3. The server is running RHEL 8 with Apache 2.4. The SSL configuration file /etc/httpd/conf.d/ssl.conf currently has the line 'SSLProtocol all -SSLv2'. You need to disable SSLv3 and also disable all versions of TLS below 1.2, while still allowing TLS 1.2 and 1.3. The server must remain available immediately. Which action should you take?

Accepted Answer

Change 'SSLProtocol all -SSLv2' to 'SSLProtocol TLSv1.2 TLSv1.3'. Option C is correct. Changing 'SSLProtocol all -SSLv2' to 'SSLProtocol TLSv1.2 TLSv1.3' disables SSLv3 and older TLS versions. Option A would disable more than needed (TLSv1 and TLSv1.1 are included in 'all -SSLv2 -SSLv3'), but it doesn't explicitly allow TLS 1.2/1.3; however, 'all' includes TLS 1.2, but removing SSLv3 still allows TLS 1.0 and 1.1? Actually 'all' includes TLS 1.0,1.1,1.2, so 'all -SSLv2 -SSLv3' would allow TLS 1.0 and 1.1, which are too old. Option B only adds -SSLv3 but does not disable TLS 1.0/1.1. Option D removes SSLv2 and SSLv3 but still allows TLS 1.0/1.1 via 'all'. Only option C explicitly sets only the desired protocols.

Answer

Change 'SSLProtocol all -SSLv2' to 'SSLProtocol all -SSLv2 -SSLv3'

Answer

Add 'SSLProtocol -SSLv3' after the existing line

Answer

Change the line to 'SSLProtocol TLSv1.2 TLSv1.3 -SSLv2 -SSLv3'

Question 10

A financial institution uses a Linux server with a custom application that runs as the 'appuser' and writes logs to /var/log/app/. The security team recently detected that the application is vulnerable to a local privilege escalation via log injection. To mitigate, they decide to implement mandatory access control (MAC) using SELinux. The system is CentOS 7 with SELinux in enforcing mode. The current context of /var/log/app is 'unconfined_u:object_r:var_log_t:s0'. The application should only be allowed to write to logs in that directory, and no other processes should modify them. Which SELinux policy change should be made?

Accepted Answer

Create a custom SELinux policy module that defines a new type for the log directory and transitions for the application domain.. Option D is correct. Creating a custom policy allows defining rules for the application's domain, restricting it to only the necessary operations. Option A (chcon) is temporary and not persistent across relabeling. Option B (semanage permissive) would allow the application to break out without restriction, defeating the purpose. Option C (audit2allow) generates allow rules from denials, but the application might still have unwanted access; it's better to craft a targeted policy.

Answer

Use 'semanage permissive -a app_t' to put the application domain in permissive mode.

Answer

Run 'chcon -t var_log_t /var/log/app' to set the correct context.

Answer

Use 'audit2allow' to create a local policy module based on current denials.

Question 11

A small business has a single Linux server that serves as both a file server (Samba) and a web server (Apache). The server is directly connected to the internet. Recently, there have been numerous brute-force SSH login attempts. The administrator wants to implement a simple solution to block IP addresses that have more than 5 failed SSH attempts in 10 minutes. The server runs Ubuntu 20.04. Which tool should the administrator use to achieve this with minimal configuration?

Accepted Answer

Install and configure Fail2ban to monitor /var/log/auth.log.. Option B is correct. Fail2ban is designed to monitor logs and ban IPs with excessive failures. Option A (TCP Wrappers) only controls access based on hostname/IP but does not handle dynamic banning based on failures. Option C (UFW) is a frontend to iptables but does not have built-in failure tracking. Option D (knockd) implements port knocking, which is a different concept.

Answer

Enable UFW and set default deny incoming, allow SSH from specific IPs.

Answer

Set up TCP wrappers with /etc/hosts.deny for SSH.

Answer

Use port knocking to hide SSH port until a specific sequence is sent.

Question 12

A government agency runs a classified application on a Linux server with strict auditing requirements. The application writes sensitive data to a MySQL database. The auditor requires that all SQL queries executed by the application be logged with timestamps, user, and the full query text. Additionally, the audit logs must be immutable (cannot be altered by the application or any user except a designated auditor account). The database runs on the same server. Which combination of tools and configurations should the administrator deploy?

Accepted Answer

Enable MySQL's general query log, direct it to a file on a separate filesystem mounted with the 'noexec' and 'append' options, and set the file immutable with chattr +a.. Option D is correct. MySQL's general query log logs all queries, and using a separate filesystem with mount options like 'ro' for the auditor (or using append-only via chattr) can ensure immutability. Option A (auditd) can log system calls but not SQL queries directly. Option B (rsyslog) with MySQL audit plugin is possible but the audit plugin logs to a table, which may not be immutable. Option C (tcpdump) captures network traffic but not local connections via socket.

Answer

Enable auditd to monitor the MySQL process and log all system calls.

Answer

Enable the MySQL audit log plugin and configure rsyslog to forward logs to a remote log server.

Answer

Use tcpdump to capture all network traffic to port 3306 and save to a file with packet captures.

Question 13

You are the administrator for a small office network with 20 Linux workstations and 5 Windows 10 clients. The company uses a Samba server (version 4.15) running on Ubuntu 22.04 to share a central directory /data with user-level security. Each user has a home directory on the server, and all users are in the 'staff' group. Recently, users have complained that they can access the /data share from Windows but cannot modify any files, even though they could before. The Samba configuration for the share is:

[data]
   path = /data
   browseable = yes
   read only = no
   valid users = @staff
   create mask = 0660
   directory mask = 0770
   force group = staff

You check the filesystem permissions on /data and find it is owned by root:staff with permissions 775. Files inside are owned by individual users and group staff with permissions 664. You also check smbstatus and see that users are connected as 'guest' rather than their actual username. What is the most likely cause of the problem?

Accepted Answer

The global 'map to guest = Bad User' setting is causing users who mistype their password to be mapped to the guest account, losing write permissions.. The 'map to guest = Bad User' global setting in Samba causes any user who fails authentication (e.g., due to a typo or incorrect password) to be mapped to the guest account. Since the share does not define a 'guest ok' or 'guest only' setting, and the guest account typically has no write permissions on the /data directory, users connected as guest cannot modify files. The smbstatus output confirming users are connected as 'guest' directly points to this misconfiguration.

Answer

The 'valid users = @staff' directive excludes root, so users cannot write because the share is owned by root.

Answer

The 'force group = staff' parameter overrides file ownership and prevents writes because the files are owned by root.

Answer

The 'create mask = 0660' is too restrictive and prevents users from writing to existing files.

Question 14

A Linux administrator is managing a database server running on CentOS 7 that uses ext4 filesystems on LVM. The server has three physical volumes: /dev/sda (200GB), /dev/sdb (200GB), and /dev/sdc (200GB) all in volume group 'vg_db'. The logical volume 'lv_data' (400GB) is used for database files. Recently, the DBA reports that database writes are slower than expected. Iostat shows high average wait times (>100ms) on /dev/sdc but normal on /dev/sda and /dev/sdb. The LVM stripes data across all three PVs with a stripe size of 64KB. Which action should the administrator take to improve performance?

Accepted Answer

Replace /dev/sdc with a new disk and restore the mirror or restripe.. The high average wait time on /dev/sdc indicates that this specific physical volume is a performance bottleneck, likely due to hardware failure or degradation. Since the logical volume 'lv_data' stripes data across all three PVs, the overall write performance is limited by the slowest device in the stripe set. Replacing /dev/sdc with a new disk and restoring the stripe (e.g., using pvmove to relocate extents and then replacing the device) eliminates the bottleneck and restores balanced I/O across all PVs.

Answer

Convert lv_data to linear mapping on /dev/sda and /dev/sdb only.

Answer

Increase the stripe size to 256KB to reduce I/O overhead.

Answer

Remove /dev/sdc from the volume group and reduce the stripe count to 2.

Question 15

A company has a Linux server with two network interfaces: eth0 connected to the internal 192.168.1.0/24 network, and eth1 connected to the internet via a public IP of 203.0.113.10. The server runs a web server on port 80 and needs to allow internal clients to access the internet while hiding their private IPs (MASQUERADE). Additionally, external users should be able to reach the web server using the public IP. The administrator has enabled IP forwarding and configured iptables with the following rules:

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

However, internal clients can access the internet, but external users cannot reach the web server. What should the administrator do to fix the issue?

Accepted Answer

Add a DNAT rule in the PREROUTING chain of the nat table to translate destination 203.0.113.10:80 to 192.168.1.100:80.. The current iptables rules perform SNAT/MASQUERADE for outbound traffic and allow forwarding of related/established inbound traffic, but they do not redirect incoming connections destined for the public IP (203.0.113.10:80) to the internal web server (e.g., 192.168.1.100:80). A DNAT rule in the PREROUTING chain of the nat table is required to translate the destination address and port, so that external packets are forwarded to the internal server and the response traffic is handled by the existing MASQUERADE rule.

Answer

Add a FORWARD rule to allow new connections from eth1 to eth0.

Answer

Add a rule in the INPUT chain to accept traffic on port 80.

Answer

Change the MASQUERADE rule to SNAT with the public IP.