LPIC-2 Practice Test 37 — 15 Questions

Question 1

You are the administrator of a medium-sized company that runs its own authoritative DNS servers for the domain 'company.com'. The primary DNS server is a BIND9 master, and there are two slaves. Recently, you updated the zone file on the master to add a new subdomain 'lab.company.com' with an A record pointing to 10.0.0.10. After the update, you increased the serial number and ran 'rndc reload'. However, after several hours, some external clients report that they cannot resolve 'lab.company.com'. You check the master server and find that the zone file contains the new record. You also check the slave servers and find that they still have the old zone data. The serial number on the master is 2025011501, while the slaves show 2025011400. The master's syslog shows no errors. The slaves' syslogs show 'zone company.com/IN: Transfer started.' but no completion messages. Firewall rules allow TCP and UDP port 53 between all DNS servers. What should you do to resolve the issue?

Accepted Answer

Run 'rndc notify company.com' on the master to force sending NOTIFY messages to the slaves.. Option D is correct because the master's syslog shows no errors and the slaves' logs indicate a transfer started but never completed, which suggests the NOTIFY messages were sent but the slaves may have missed or ignored them due to a transient issue. Running 'rndc notify company.com' forces the master to re-send NOTIFY messages to all configured slaves, prompting them to initiate a zone transfer immediately, which should update the stale zone data on the slaves.

Answer

Check the 'allow-transfer' ACL on the master; it might be restricting transfers to the slaves.

Answer

Increase the serial number again on the master to a higher value and wait for the slaves to refresh.

Answer

Restart the BIND service on the slave servers.

Question 2

You are troubleshooting a Linux client that is unable to connect to the internet. The client is configured to use DHCP on interface eth0. The output of 'ip addr show eth0' shows that the interface has an IP address 192.168.1.100/24, but there is no default gateway. The output of 'ip route show' shows only the local subnet route. The DHCP server is at 192.168.1.1 and is functioning correctly. You have verified that the DHCP client (dhclient) is running, and the lease file /var/lib/dhclient/dhclient-eth0.leases exists and contains option routers 192.168.1.1. Which of the following commands should you run to resolve the issue?

Accepted Answer

dhclient -r eth0 && dhclient eth0. Option C is correct because the DHCP client has already obtained a lease with the correct gateway (192.168.1.1), but the default route was not applied. Running `dhclient -r eth0` releases the current lease, and `dhclient eth0` renews it, forcing the client to re-apply all options from the lease, including the default gateway route. This is the standard way to reinitialize the interface's network configuration from the DHCP server without restarting the entire networking service.

Answer

systemctl restart networking

Answer

ip route del default

Answer

ip route add default via 192.168.1.1

Question 3

A company runs a mixed Linux/Windows environment. The Samba server (version 4.15) is configured as a domain member using 'security = ADS'. Recently, the IT team enabled 'winbind use default domain = yes' to simplify logins. After the change, users report that they can no longer access Samba shares when authenticating with just their username (e.g., 'jdoe') instead of 'DOMAIN\jdoe'. However, authentication using the full domain-qualified name still works. The smb.conf includes:

[global]
security = ADS
workgroup = MYDOM
realm = MYDOM.LOCAL
winbind use default domain = yes
winbind separator = /

Users are in the 'Domain Users' group and the share configuration is:
[share]
path = /srv/share
valid users = @"MYDOM\domain users"

Which of the following is the most likely cause and solution?

Accepted Answer

Change 'winbind separator' to backslash or remove it to default to backslash. Option A is correct because when 'winbind use default domain = yes' is set, Samba expects the winbind separator to be a backslash (\), not a forward slash (/). With a forward slash separator, the username 'jdoe' is not correctly mapped to 'MYDOM\jdoe' during authentication, causing access failures. Changing the separator to backslash (or removing it to default to backslash) resolves the issue by aligning with Samba's internal handling of default domain usernames.

Answer

Disable 'winbind use default domain' to force full domain qualification

Answer

The valid users line uses quotes around the group name; remove the quotes

Answer

Enable 'winbind offline logon' to allow cached credentials

Question 4

An organization uses a Samba server as a standalone file server. The share 'Projects' is configured with browseable = yes and guest ok = no. Users authenticate with local Samba accounts. A new employee needs access but cannot authenticate. The administrator added the user with 'smbpasswd -a newuser' and set a password. When the user tries to connect, they get 'NT_STATUS_LOGON_FAILURE'. The administrator verifies the username and password are correct. smb.conf includes: security = user, passdb backend = tdbsam. What is the most likely cause?

Accepted Answer

The user account is not in the system's /etc/passwd.. The correct answer is D because Samba with `passdb backend = tdbsam` stores user credentials in its own TDB database, but it still requires the user to exist as a local system account in `/etc/passwd` (or equivalent) for authentication to succeed. The `smbpasswd -a` command only adds the user to the Samba password database; if the user is not present in `/etc/passwd`, the authentication attempt fails with `NT_STATUS_LOGON_FAILURE` because Samba cannot map the session to a valid Unix UID.

Answer

The 'null passwords' parameter is set to 'yes'.

Answer

The 'map to guest' parameter is set to 'Bad User'.

Answer

The 'encrypt passwords' parameter is set to 'no'.

Question 5

A company runs Samba on a Linux server to provide file shares to Windows clients. The server is also a BIND DNS server. After a recent OS upgrade, the Samba service fails to start with the error: 'Failed to create a listening socket for port 445: Permission denied'. The administrator checks that no other service is using port 445. smbd is configured to start as root. What is the most likely cause?

Accepted Answer

SELinux is blocking the Samba port.. Option C is correct because SELinux, when enforcing, can block Samba from binding to privileged ports like 445 even when the service runs as root. The error 'Permission denied' on port 445, despite no other service using it and the firewall being open, strongly indicates SELinux is denying the bind. The SELinux boolean 'samba_port_t' or the specific port context must be enabled or relabeled for Samba to bind to port 445.

Answer

The firewall is blocking the port even though it's internal.

Answer

The 'socket address' parameter is set to an invalid IP.

Answer

The Samba netbios name is too long.

Question 6

A company runs a high-frequency trading application that requires extremely low latency. The system administrator has compiled a custom Linux kernel with various real-time patches and tuned kernel parameters. After deploying the new kernel, the application performance degrades significantly. The administrator suspects that kernel preemption settings are causing context switch overhead. Which of the following actions should the administrator take to diagnose and optimize the kernel preemption model?

Accepted Answer

Check /proc/sched_debug for preemption counters and adjust the kernel's preemption model by recompiling with CONFIG_PREEMPT_NONE instead of CONFIG_PREEMPT. Option C is correct because the kernel preemption model is a compile-time configuration, not a runtime parameter. To change from CONFIG_PREEMPT (full preemption) to CONFIG_PREEMPT_NONE (no forced preemption), the administrator must recompile the kernel with the appropriate configuration. Checking /proc/sched_debug can reveal preemption-related counters and context switch statistics, helping confirm that excessive preemption is causing overhead.

Answer

Use sysctl to set 'kernel.preempt_model' to 'none'

Answer

Add 'preempt=none' to the kernel command line

Answer

Change the kernel preemption model at runtime by writing to /sys/kernel/preempt_control

Question 7

A server running Linux with an ext4 filesystem on /dev/sda1 has experienced an unexpected power loss due to a faulty power supply. After replacing the power supply and rebooting, the system fails to mount /dev/sda1 with an error message indicating 'wrong superblock magic number' or 'superblock corrupted'. The administrator recalls that ext4 filesystems have backup superblocks created during mkfs. Using the command 'dumpe2fs /dev/sda1 | grep -i backup' is not possible because the device is not mountable. However, the administrator remembers that for this specific filesystem, a backup superblock is located at block offset 32768 based on the output of 'mke2fs -n' from the original creation. What is the correct course of action to recover the filesystem and mount it?

Accepted Answer

Run `fsck.ext4 -b 32768 /dev/sda1` to restore the superblock, then mount the filesystem.. Option A is correct because fsck.ext4 with the -b option specifies the backup superblock location, allowing the filesystem to be repaired and mounted. Option B destroys the superblock and data. Option C adds a journal but does not recover the superblock. Option D attempts to use the default superblock, which is corrupted, and will likely fail.

Answer

Run `e2fsck -fy /dev/sda1` to force a filesystem check.

Answer

Run `dd if=/dev/zero of=/dev/sda1 bs=4k count=1` to zero the superblock, then create a new filesystem with mkfs.ext4.

Answer

Run `tune2fs -j /dev/sda1` to add a journal to the filesystem.

Question 8

An organization runs a critical application on a Linux server that stores its data on a 500GB LVM logical volume named /dev/vg_data/lv_app. The application must remain operational with minimal disruption, so unmounting the volume is not acceptable. The administrator needs to create a full backup of the logical volume to an external 1TB USB drive attached via eSATA. The backup must capture a point-in-time consistent state of the filesystem. The logical volume is formatted with XFS. Which of the following procedures best achieves this goal while minimizing downtime?

Accepted Answer

Create an LVM snapshot volume of /dev/vg_data/lv_app, mount the snapshot to a temporary directory, and use rsync to copy the data to the USB drive.. Option C is correct because creating an LVM snapshot provides a point-in-time consistent view of the volume, mounting the snapshot avoids downtime, and rsync is a reliable tool for copying data while preserving metadata. Option A (dd) risks inconsistency because the volume is mounted. Option B requires unmounting, causing unacceptable downtime. Option D (cp) is less reliable for preserving all attributes and does not leverage the snapshot's benefits properly.

Answer

Unmount the logical volume, use tar to create an archive on the USB drive, then remount the volume.

Answer

Use dd to clone the logical volume directly to the USB drive while the volume is mounted.

Answer

Create an LVM snapshot volume and then use cp -a to copy the snapshot volume's contents directly without mounting.

Question 9

A DevOps team manages a Kubernetes cluster on premises. The security team requires that all communication between pods be encrypted. The team decides to use mutual TLS (mTLS). They are using a Linux-based control plane with etcd and kube-apiserver. The current setup uses self-signed certificates for the API server, but the team wants to implement a proper PKI with automated certificate renewal. They have a small budget and prefer open-source tools. Which solution should they implement?

Accepted Answer

Install cert-manager in the cluster and configure an Issuer to sign certificates with automatic renewal.. Option C is correct. cert-manager is a Kubernetes-native tool that automates certificate management and integrates with Let's Encrypt or internal CAs. Option A (OpenSSL manual scripts) is non-automated and error-prone. Option B (Hashicorp Vault) is powerful but complex and has a learning curve, though it's also valid; however, cert-manager is more lightweight for Kubernetes. Option D (Cloudflare's cfssl) is an alternative but not as integrated with Kubernetes; cert-manager is the standard.

Answer

Generate certificates using OpenSSL on the control plane and distribute them via Kubernetes secrets manually.

Answer

Use Cloudflare's cfssl tool to set up a custom CA and push certificates to nodes via Ansible.

Answer

Deploy Hashicorp Vault with PKI backend and use the Vault agent sidecar.

Question 10

A Linux server in a DMZ hosts a custom web application that listens on TCP port 8080. The server is also configured with SSH on port 22 for remote administration. Recently, the security team noticed an increase in brute-force attacks against SSH from various external IPs. The server runs Fedora with firewalld as the firewall service. The current firewalld default zone is 'public', and the SSH service is allowed in the 'public' zone. The administrator wants to mitigate the brute-force attacks without blocking legitimate users. Additionally, the administrator wants to ensure that only specific administrative IP addresses can initiate SSH connections, and that SSH connections are rate-limited to prevent flooding. The administrator also needs to keep the web application accessible from any external IP. Which course of action best meets these requirements?

Accepted Answer

Add a firewalld rich rule to allow SSH only from specific source IPs, and add a rich rule to limit connection rate for SSH. Keep the web application in the same zone with the appropriate service.. Option C is correct because it uses firewalld's rich rules to create a whitelist for SSH and a rate limit. This directly meets the requirements without changing zones. Option A is wrong because changing the default zone to drop would also block HTTP (web app). Option B is wrong because iptables commands are outside firewalld and may conflict; also fail2ban does not whitelist IPs easily. Option D is wrong because moving SSH to another port does not prevent brute-force, just changes the target.

Answer

Move SSH to a non-standard port (e.g., 2222) and update the firewalld service definition accordingly.

Answer

Use iptables to create a whitelist for SSH, and install fail2ban to rate-limit after 3 failures.

Answer

Change the default zone to 'drop', then add a rich rule to allow SSH only from the administrative network.

Question 11

You are a systems administrator for a company that runs a critical web server on a Linux system. The server has been running stably for months, but after a recent kernel update from version 5.10.0-8 to 5.10.0-9, the server fails to boot. The boot process starts, but after the kernel loads, the system hangs with no output on the console. You have physical access to the server and can interrupt the boot process. The server uses GRUB 2 as the bootloader and the root filesystem is on an LVM logical volume. The previous kernel (5.10.0-8) is still present in /boot. Which of the following is the best course of action to restore the server to a working state?

Accepted Answer

Interrupt the boot process at GRUB, select the advanced options, and boot the old kernel 5.10.0-8.. The server fails to boot after a kernel update, but the previous kernel is still present in /boot. By interrupting GRUB 2 at boot, selecting 'Advanced options for Ubuntu' (or similar), and booting the old kernel 5.10.0-8, you bypass the problematic new kernel without modifying the bootloader or filesystem. This is the fastest, least invasive recovery method because GRUB 2 automatically detects and lists all installed kernels in /boot, including the previous one.

Answer

Reinstall GRUB from a live CD to fix the bootloader configuration.

Answer

Boot from a live CD, chroot into the system, and reinstall the new kernel package.

Answer

Boot from a live CD, chroot into the system, and rebuild the initrd for the new kernel.

Question 12

You are the security administrator for a company that runs a web application on a Linux server. The application runs under the user 'www-data' and listens on TCP port 8080. The server also runs an SSH service on port 22. Recently, an external penetration test revealed that an attacker could exploit a vulnerability in the web application to execute commands as the 'www-data' user, and from there, the attacker could escalate privileges to root due to a misconfigured sudo rule. You need to implement a defense-in-depth approach to limit the impact of such an attack. Which single action would be the most effective in preventing privilege escalation from the 'www-data' user to root, while still allowing the application to function normally?

Accepted Answer

Review and remove any sudo privileges granted to the 'www-data' user in /etc/sudoers, and ensure the application does not require sudo.. Option A is correct because the core issue is a misconfigured sudo rule that allows the 'www-data' user to execute commands as root. By reviewing and removing any sudo privileges for 'www-data' in /etc/sudoers, you directly eliminate the privilege escalation path without affecting the web application's normal operation, as the application itself does not require sudo to function on its designated port 8080.

Answer

Change the SSH port to a non-standard port to reduce the attack surface.

Answer

Run the web application in a chroot jail to isolate it from the rest of the filesystem.

Answer

Implement mandatory access control with AppArmor profiles for the web application.

Question 13

A company runs a critical database server on a Linux system. The server is subject to a strict compliance policy that requires all commands executed by the database administrator (user 'dbadmin') to be logged. Additionally, any attempt to change the system time must be logged regardless of the user. The administrator has configured auditd and added the following rules: -w /usr/bin -p x -k binary_exec, -a always,exit -F arch=b64 -S adjtimex -F key=time_change. However, during a compliance audit, it is discovered that not all commands executed by dbadmin are being logged. Which of the following is the most likely cause?

Accepted Answer

The rule -w /usr/bin -p x only monitors executables in /usr/bin, not commands in other directories or built-in shell commands.. Option D is correct because the rule `-w /usr/bin -p x` only monitors execution of binaries located in `/usr/bin`. Commands executed from other directories (e.g., `/usr/local/bin`, `/opt`, or built-in shell commands like `cd` or `alias`) are not captured. Additionally, the rule does not log commands run via absolute paths outside `/usr/bin` or scripts executed by interpreters, leaving gaps in the audit trail for dbadmin's activities.

Answer

The auditd logs are being overwritten because the audit log file size is too small.

Answer

The auditd service is not running because the kernel was not compiled with audit support.

Answer

The adjtimex syscall rule is incorrect and prevents other rules from being processed.

Question 14

A small company runs a LAMP stack web server with Postfix mail server on a single Ubuntu 22.04 instance. The web server hosts a PHP application that sends password reset emails via the local mail server using PHP's mail() function. Recently, users report that password reset emails are not arriving. The administrator checks the mail log and finds that messages are being accepted by Postfix but are not being delivered. The mail queue shows messages with the status 'deferred'. There are no obvious errors in the mail log. The server has sufficient disk space and memory. The administrator suspects a DNS resolution issue. Which of the following is the most likely cause of the deferred mail?

Accepted Answer

The DNS resolver on the server is unable to resolve the MX records for the recipient domains.. Postfix accepts the messages but defers delivery when it cannot resolve the recipient domain's MX record. The mail log shows no errors because the deferral is a normal queue action, not a failure. DNS resolution failure for MX records is a common cause of deferred mail, as Postfix cannot determine where to deliver the message.

Answer

The server's firewall is blocking outbound connections on port 25, causing connection timeouts.

Answer

The SPF record for the sender domain is missing, causing the recipient's mail server to reject the email.

Answer

The server's IP address has no PTR record, causing the recipient's mail server to reject the connection.

Question 15

You are a system administrator at a small company. The network uses DHCP to assign IP addresses to clients. Recently, some users reported intermittent network connectivity issues. Upon investigation, you notice that the DHCP server is running on a Linux server with the ISC DHCP daemon. The server log shows many 'DHCPREQUEST' messages from a particular MAC address with frequent changes in requested IP addresses. Users with that MAC address are experiencing IP address conflicts and connectivity drops. What is the most likely cause and the best corrective action?

Accepted Answer

Identify the device with that MAC address and replace its network interface card.. The frequent DHCPREQUEST messages from the same MAC address requesting different IP addresses indicate a faulty network interface card (NIC) that is generating random or corrupted DHCP requests, likely due to hardware malfunction. Replacing the NIC eliminates the root cause by stopping the spurious traffic, whereas other options only mask symptoms or fail to address the hardware fault.

Answer

Increase the DHCP lease time to reduce the frequency of renewals.

Answer

Add a static DHCP mapping for the problematic MAC address to a reserved IP.

Answer

Restart the DHCP daemon to clear the lease database.