LPIC-2 Practice Test 37 — 15 Questions

Question 1

An organization uses LDAP for centralized authentication. The /etc/nsswitch.conf contains 'passwd: files ldap' and 'shadow: files ldap'. The /etc/pam.d/system-auth includes 'auth requisite pam_ldap.so' and 'account required pam_ldap.so'. However, users can log in using local accounts but not LDAP accounts. The ldapsearch command works correctly against the LDAP server. Logs show 'pam_ldap: error trying to bind as user (No such object)'. Which configuration change is most likely needed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure /etc/ldap.conf contains a valid 'binddn' and 'bindpw' for the search user.. The error 'pam_ldap: error trying to bind as user (No such object)' indicates that PAM LDAP cannot find the user entry in the LDAP directory. This typically occurs because the binddn (the search user) specified in /etc/ldap.conf is incorrect or missing, preventing PAM from performing the initial search to locate the user's DN. Since ldapsearch works manually, the LDAP server is reachable, but the PAM module lacks the credentials to bind and search for users.

Answer

Open TCP port 389 on the client firewall.

Answer

Add 'uri ldaps://ldap.example.com' to /etc/ldap.conf.

Answer

Restart the nscd service.

Question 2

An administrator wants to use /dev/sdb for a new ext4 filesystem. Which step must be performed first?

Accepted Answer

Create a partition table on /dev/sdb using fdisk.. Before creating a filesystem on a new disk, a partition table must be created to define the disk's layout. The correct answer is D because /dev/sdb represents the whole disk, and mkfs.ext4 expects a partition (e.g., /dev/sdb1) rather than the raw disk. Using fdisk to create a partition table and at least one partition is the mandatory first step.

Answer

Mount /dev/sdb to a directory using mount.

Answer

Create the ext4 filesystem directly on /dev/sdb using mkfs.ext4.

Answer

Run partprobe /dev/sdb to update the kernel partition table.

Question 3

A company requires link aggregation between a Linux server and a switch to increase throughput and provide redundancy. The switch supports only standard 802.3ad (LACP). Which bonding mode should be configured on the Linux server?

Accepted Answer

mode=4 (802.3ad). Mode=4 (802.3ad) implements the IEEE 802.3ad standard for Link Aggregation Control Protocol (LACP). This mode requires the switch to support LACP, which the scenario states, and provides both increased throughput through load balancing and redundancy through automatic failover if a link fails.

Answer

mode=2 (balance-xor)

Answer

mode=1 (active-backup)

Answer

mode=3 (broadcast)

Answer

mode=0 (balance-rr)

Question 4

An administrator needs to configure Samba to allow guest access to a share. Which two parameters must be set?

Accepted Answer

guest ok = yes in the share definition. Setting `guest ok = yes` in the share definition explicitly allows guest (anonymous) access to that specific Samba share. Without this parameter, the share will require authentication even if other guest-related settings are configured globally.

Answer

security = share

Answer

guest account = nobody

Question 5

A developer compiled a custom kernel version 5.15.10 and ran 'make modules_install' followed by 'make install' on a system using GRUB 2. After rebooting, the system still boots the old kernel. Which of the following is the most likely cause?

Accepted Answer

The boot loader configuration was not updated. After running 'make install', the GRUB 2 bootloader configuration file (usually /boot/grub/grub.cfg) is not automatically regenerated. The 'make install' target copies the kernel image and System.map to /boot, but it does not run update-grub or grub-mkconfig to add the new kernel entry. Without an updated bootloader configuration, GRUB 2 continues to boot the old kernel entry, even though the new kernel files are present.

Answer

The kernel version string is too long for GRUB 2

Answer

The kernel image was not copied to /boot because the disk was full

Answer

The initramfs was not created for the new kernel

Question 6

A system administrator configures a Linux client to authenticate users via an LDAP directory directory for user login. The LDAP server is located on a remote network across a WAN link with moderate latency. Authentication succeeds, but user logins take 10-15 seconds to complete, causing delays. The LDAP server logs show low CPU usage and minimal queries per second. The client has not yet implemented any local caching services. The administrator wants to reduce the login delay without compromising security. What should the administrator do?

Accepted Answer

Enable nscd (Name Service Cache Daemon) to cache passwd, group, and services lookups.. Nscd caches the results of name service lookups (passwd, group, hosts, services) in memory, eliminating repeated LDAP queries for the same user or group information. Since the client has no local caching, each login triggers multiple LDAP lookups (e.g., for user entry, group membership, and service resolution), and the WAN latency multiplies the delay. By caching these lookups, nscd reduces the number of round trips over the slow link, cutting login time from 10–15 seconds to near-instant without affecting LDAP TLS security or server configuration.

Answer

Disable LDAP TLS encryption to reduce cryptographic overhead.

Answer

Change the file ownership of /etc/pam.d/common-auth to root to force direct LDAP reads.

Answer

Increase the number of LDAP server threads to handle concurrent requests faster.

Question 7

A system administrator needs to include a custom kernel module in the initramfs to support a root filesystem on a USB device. Which command should be used to rebuild the initramfs with the updated kernel?

Accepted Answer

dracut. Dracut is the correct tool for rebuilding the initramfs on modern Red Hat-based distributions (e.g., RHEL, CentOS, Fedora). It automatically detects and includes kernel modules required for the root filesystem, including those for USB storage devices, and regenerates the initramfs image with the updated kernel module.

Answer

update-initramfs

Answer

mkinitrd

Answer

grub-mkconfig

Question 8

A Linux server is configured as a DNS resolver with BIND. Users report that they cannot resolve external hostnames. The server can resolve internal names. Which of the following is the most likely cause?

Accepted Answer

The firewall is blocking UDP port 53 outgoing from the server.. The server can resolve internal names, indicating that the local BIND service is functioning correctly for authoritative zones. However, external resolution fails, which typically means the server cannot reach upstream DNS servers. Outgoing UDP port 53 is required for DNS queries to external resolvers; if the firewall blocks this traffic, the server cannot forward queries to the internet, while internal queries (often served from local zones) remain unaffected.

Answer

The server's /etc/resolv.conf points to itself.

Answer

The forwarders directive is missing from named.conf.

Answer

The named daemon is not running.

Question 9

The DHCP client lease file shows a lease for 192.168.1.100. If the client fails to contact the original DHCP server by the rebind time (12:00), what will occur?

Accepted Answer

The client will attempt to contact any DHCP server to extend the lease.. When a DHCP client reaches the rebind time (T2, default 87.5% of lease duration) without contacting the original server, it enters the REBINDING state. In this state, the client broadcasts a DHCPREQUEST to any available DHCP server to extend the lease. Option D correctly describes this behavior, as defined in RFC 2131.

Answer

The client will continue to use the address until the expire time without any further attempts.

Answer

The client will immediately release the address.

Answer

The client will rebind with a new IP address from any server.

Question 10

A BIND9 nameserver is configured with 'allow-transfer { none; };' but a secondary nameserver needs to receive zone transfers. What change must be made on the master?

Accepted Answer

Set 'allow-transfer' to the secondary's IP.. The 'allow-transfer' directive on the master nameserver controls which hosts are permitted to request zone transfers (AXFR/IXFR). Setting it to 'none;' blocks all transfers, so to allow a secondary to receive the zone, you must explicitly list the secondary's IP address in the 'allow-transfer' statement on the master. This is the direct and necessary change to enable zone transfers to that specific slave.

Answer

Add a 'masters' statement in the slave's configuration.

Answer

Set 'notify' to yes.

Answer

Set 'also-notify' to the secondary IP.

Question 11

An administrator is setting up a Samba share for a project team. The team members are in different UNIX groups. Which three options can be used to restrict access to specific users or groups? (Choose three.)

Accepted Answer

read list. (read list) is correct because it explicitly restricts read-only access to a list of users or groups, allowing the administrator to control which users can only read files in the Samba share. This is a direct Samba parameter that limits access to specific users or groups, even if they are in different UNIX groups.

Answer

write list

Answer

force group

Question 12

A DHCP server is configured to serve multiple subnets but only clients on one subnet receive IP addresses. The server is connected to a router that does not forward DHCP broadcasts. What should be configured to support the other subnets?

Accepted Answer

Set up a DHCP relay agent on the other subnets. The router does not forward DHCP broadcasts, so clients on other subnets cannot reach the DHCP server. A DHCP relay agent (e.g., `dhcrelay` or `ip helper-address`) intercepts broadcast requests on those subnets and forwards them as unicast to the DHCP server, allowing the server to assign addresses from the appropriate subnet pools. This is the standard solution per RFC 1542 when routers do not support BOOTP forwarding.

Answer

Add more subnet declarations to the DHCP server

Answer

Add 'shared-network' declarations

Answer

Configure the router to act as a DHCP server

Question 13

Which file on a Linux client determines the order in which different name resolution methods (e.g., hosts file, DNS, LDAP) are consulted?

Accepted Answer

/etc/nsswitch.conf. /etc/nsswitch.conf (Name Service Switch) controls the order and sources for system databases like 'hosts', 'passwd', and 'group'. For hostname resolution, the 'hosts' line specifies the lookup order (e.g., 'files dns ldap'), meaning the system checks /etc/hosts first, then DNS, then LDAP. This file is the central configuration for name resolution order on Linux systems.

Answer

/etc/host.conf

Answer

/etc/resolv.conf

Answer

/etc/named.conf

Question 14

A Linux client is unable to resolve hostnames for external domains but can ping internal hosts by IP. The /etc/resolv.conf file is correctly configured with a valid DNS server. What is the most likely cause?

Accepted Answer

The search domain in /etc/resolv.conf is incorrect, causing the resolver to append an inappropriate domain to queries.. When a search domain is incorrectly configured in /etc/resolv.conf, the resolver appends that domain to single-label hostnames before querying the DNS server. For external fully qualified domain names (FQDNs), this can cause the resolver to send queries like 'externaldomain.com.incorrect.domain' instead of the intended domain, leading to resolution failures. Since internal IPs are reachable (bypassing DNS) and the DNS server itself is valid, the issue is most likely the resolver's domain search behavior.

Answer

The /etc/hosts file contains an entry that overrides the DNS resolution for external domains.

Answer

The nmblookup service is not running.

Answer

The /etc/nsswitch.conf file is missing the 'dns' service in the 'hosts' line.

Question 15

A user in group staff (but not admin) tries to write to the share. What is the most likely error?

Accepted Answer

Connection successful but cannot write. The user is in group 'staff' but not 'admin', and the Samba share configuration likely has 'write list = @admin' or similar, restricting write access to the admin group. The connection succeeds (the share is visible and readable), but the write operation fails silently or returns a permission error at the filesystem level, not a network-level error. This matches the scenario where authentication passes but authorization for writing fails.

Answer

NT_STATUS_BAD_NETWORK_NAME

Answer

NT_STATUS_ACCESS_DENIED

Answer

NT_STATUS_OBJECT_NAME_NOT_FOUND