LPIC-2 Practice Test 4 — 10 Questions

Question 1

A security policy requires that all users must change their passwords every 90 days. Which command enforces maximum password age for an existing user 'jdoe'?

Accepted Answer

chage -M 90 jdoe. The `chage -M 90 jdoe` command sets the maximum number of days a password is valid for user 'jdoe' to 90 days, enforcing the security policy. The `-M` option directly controls the password aging parameter that defines when the password must be changed, as stored in `/etc/shadow`.

Answer

passwd -f jdoe

Answer

usermod -e 90 jdoe

Answer

chage -E 90 jdoe

Question 2

Which TWO daemons are commonly used by DHCP clients on Linux to obtain an IP address? (Choose two.)

Accepted Answer

dhclient. dhclient (A) is the classic ISC DHCP client daemon that sends DHCPDISCOVER/DHCPREQUEST messages to obtain a lease and configure the interface, making it a correct answer. dhcpcd (B) is another widely used DHCP client daemon (common on many distros and embedded systems) that performs the same client-side lease acquisition, so it is also correct. dhcrelay (C) is a DHCP relay agent that forwards DHCP messages between clients and servers on different subnets, not a client. dhcpd (D) is the ISC DHCP server daemon that assigns addresses, not a client. tcpdump (E) is a packet capture tool, not a DHCP client daemon.

Answer

dhcrelay

Answer

dhcpd

Answer

tcpdump

Question 3

After modifying /etc/samba/smb.conf, which command should be used to verify the syntax before restarting the Samba service?

Accepted Answer

testparm. The `testparm` command is specifically designed to parse and validate the syntax of the Samba configuration file `/etc/samba/smb.conf`. It checks for errors such as misspelled parameters, invalid values, or structural issues without requiring the Samba services to be running. This makes it the correct tool to verify syntax before restarting Samba.

Answer

nmblookup

Answer

smbclient

Answer

smbstatus

Question 4

A database server uses LVM with an XFS filesystem on /dev/vg_data/lv_db, mounted at /var/lib/mysql. The LV is at 95% capacity. A new 50GB disk /dev/sdd has been added and initialized as a physical volume, then added to the volume group vg_data. The database is running and cannot be stopped. The administrator must extend the LV and filesystem. What is the correct course of action?

Accepted Answer

Run `lvextend -L +50G /dev/vg_data/lv_db` followed by `xfs_growfs /var/lib/mysql`.. XFS filesystems must be grown while mounted using `xfs_growfs` with the mount point as the argument, not the block device. Since the database cannot be stopped, the LV can be extended online with `lvextend`, and then `xfs_growfs /var/lib/mysql` resizes the filesystem to fill the expanded LV without requiring unmounting or downtime.

Answer

Run `lvextend -L +50G /dev/vg_data/lv_db` followed by `resize2fs /dev/vg_data/lv_db`.

Answer

Unmount /var/lib/mysql, run `lvextend -L +50G /dev/vg_data/lv_db`, run `resize2fs /dev/vg_data/lv_db`, then remount.

Answer

Run `lvresize -L +50G /dev/vg_data/lv_db`.

Question 5

A Linux client is configured with two network interfaces: eth0 (connected to the internet) and eth1 (connected to a private LAN). The default route is set to eth0. The client can access the internet but cannot access hosts on the private LAN. What is the most likely cause?

Accepted Answer

There is no route to the private subnet via eth1.. Without a route to the private subnet via eth1, the client has no way to forward packets destined for the private LAN out of eth1. The default route via eth0 only handles traffic for destinations not explicitly matched by other routes; if the private subnet is not in the routing table, packets to that subnet will be sent to the default gateway (internet) and fail. The `ip route` command would show the missing entry, and adding a static route (e.g., `ip route add 192.168.1.0/24 dev eth1`) resolves the issue.

Answer

A firewall on the client is blocking ICMP packets on eth1.

Answer

The eth1 interface is not configured with an IP address.

Answer

The eth1 interface is not receiving a DHCP lease.

Question 6

Which Samba component provides NetBIOS name resolution and browsing services?

Accepted Answer

nmbd. The nmbd daemon is the Samba component responsible for NetBIOS name resolution and browsing services. It listens for NetBIOS name service requests (port 137/UDP) and datagram distribution (port 138/UDP), enabling Windows clients to resolve NetBIOS names to IP addresses and participate in network browsing (e.g., listing shares in Network Neighborhood). Without nmbd, Samba cannot provide legacy NetBIOS-based name resolution or browse lists, though modern Samba can also use DNS-based discovery.

Answer

swat

Answer

smbd

Answer

winbind

Question 7

Order the steps to configure a Linux system as a router using iptables.

Accepted Answer

Enable IP forwarding, set default iptables policies, add NAT and FORWARD rules, then save the iptables configuration.. When configuring a Linux system as a router using iptables, the proper order is: first enable IP forwarding (via sysctl), then set default iptables policies (e.g., DROP for FORWARD), then add NAT (e.g., MASQUERADE) and FORWARD rules, and finally save the iptables configuration to make it persistent. This sequence ensures the kernel is prepared for routing, policies are in place to control traffic flow, rules are applied correctly, and changes are saved.

Answer

Set default iptables policies, enable IP forwarding, add NAT and FORWARD rules, then save the iptables configuration.

Answer

Save the iptables configuration, enable IP forwarding, set default iptables policies, then add NAT and FORWARD rules.

Answer

Add NAT and FORWARD rules, enable IP forwarding, set default iptables policies, then save the iptables configuration.

Question 8

Which TWO files are commonly used by Samba for configuration and user authentication? (Choose two.)

Accepted Answer

/etc/samba/smbpasswd. Option E, /etc/samba/smb.conf, is correct because it is Samba's primary configuration file, defining global server settings and per-share parameters such as workgroup, security mode, and share paths. Option C, /etc/samba/smbpasswd, is correct because it is the traditional Samba file storing SMB/CIFS user account credentials (NT/LM password hashes) used for authenticating clients, managed via smbpasswd. Option A, /etc/samba/smbusers, is not correct because it only maps local Linux usernames to SMB aliases and does not store authentication credentials or main configuration. Option B, /etc/passwd, is not correct because it is the system's local account database, not Samba's authentication store, though Samba may reference system accounts. Option D, /etc/hosts.allow, is not correct because it is a TCP wrapper access-control file, not a Samba configuration or authentication file.

Answer

/etc/samba/smbusers

Answer

/etc/passwd

Answer

/etc/hosts.allow

Question 9

Which TWO statements about the DHCP client on Linux are correct?

Accepted Answer

The dhclient command can be used to release and renew a DHCP lease.. Option A is correct because dhclient supports the -r flag to release the current lease and the -n/-1 or simply re-running it to renew, making it the standard ISC DHCP client tool for managing leases on Linux. Option B is correct because /etc/dhcp/dhclient.conf accepts the 'send host-name "name";' directive, which controls the hostname the client transmits to the DHCP server in its DHCPDISCOVER/DHCPREQUEST messages. Option C is wrong because dhclient-script is invoked by dhclient to configure the interface (IP address, routes, DNS) based on the lease, not to parse /etc/resolv.conf; the script writes resolv.conf rather than parsing it. Option D is wrong because dhcpcd is one of several clients (alongside dhclient, NetworkManager's internal client, and systemd-networkd) and is not the standard on all distributions. Option E is wrong because /etc/dhcpd.conf configures the DHCP server daemon (dhcpd), not the client; the client configuration file is /etc/dhcp/dhclient.conf.

Answer

The dhclient-script is used to parse the /etc/resolv.conf file.

Answer

The dhcpcd daemon is the standard DHCP client on all Linux distributions.

Answer

The /etc/dhcpd.conf file configures the DHCP client.

Question 10

Which TWO statements are true regarding BIND DNS server security? (Choose two.)

Accepted Answer

The 'allow-recursion' ACL can be used to restrict which clients can use the server's recursive lookup feature.. Option B is correct because in BIND, the 'allow-recursion' ACL specifically controls which client addresses are permitted to use the server's recursive resolution capability, so only trusted clients perform recursion while others are limited to authoritative answers. Option E is correct because the 'allow-query' ACL defines which clients are allowed to send any DNS queries to the server, effectively restricting query access by source address. Option A is incorrect because 'allow-transfer' governs zone transfers (AXFR/IXFR) to secondary servers, not recursive query permissions. Option C is incorrect because the 'blackhole' ACL lists addresses the server will not answer or query at all; it does not prevent cache poisoning, which is mitigated by source-port randomization, DNSSEC, and bailiwick checking. Option D is incorrect because 'forwarders' specifies servers to which queries are forwarded, and recursion is disabled with 'recursion no', not with 'forwarders'.

Answer

The 'allow-transfer' ACL is used to restrict which clients can perform recursive queries.

Answer

The 'blackhole' ACL can be used to prevent cache poisoning attacks.

Answer

The 'forwarders' option can be used to disable recursion entirely.