LPIC-2 Practice Test 8 — 10 Questions

Question 1

An application running under AppArmor is failing to write to its log directory. The AppArmor profile for the application includes the line '/var/log/myapp/ r,' but not '/var/log/myapp/** rw,'. What is the most likely issue?

Accepted Answer

The 'r' permission only allows read, but write is required.. Option C is correct because the trailing comma allows writing to the directory itself but not its contents. Option A is wrong because 'r' allows read, but the profile lacks write. Option B is wrong because the profile is not enforcing? Possibly, but the issue is specific to the log directory. Option D is wrong because the profile does allow access to the directory, just not the files inside.

Answer

The directory itself is not created, and AppArmor prevents creation.

Answer

The AppArmor service is not running, so the profile is not enforced.

Answer

The profile needs 'ix' instead of 'r' for execute rights.

Question 2

An administrator uses logwatch to send daily summaries to root. Which configuration file controls the default logwatch behavior?

Accepted Answer

/etc/logwatch/conf/logwatch.conf. The main logwatch configuration file is /etc/logwatch/conf/logwatch.conf. The other paths are incorrect or used for auxiliary configuration.

Answer

/etc/logwatch.conf

Answer

/usr/share/logwatch/default.conf

Answer

/etc/logwatch/logwatch.conf

Question 3

A PAM configuration file for password authentication includes the line 'password requisite pam_cracklib.so retry=3 minlen=8'. A user tries to change their password but is rejected even though the new password meets the stated criteria. The administrator suspects a conflict with another PAM module. Which of the following is the most likely cause?

Accepted Answer

Another PAM module such as pam_pwhistory.so might be configured to prevent reuse of old passwords, causing rejection even though pam_cracklib passes.. Option D is correct because if another module (like pam_pwhistory) is configured to require that the password not be in a history file, it may reject a valid password. Option A is wrong because pam_cracklib options are correct. Option B is wrong because the retry count only affects attempts, not the criteria. Option C is wrong because order matters: if pam_cracklib runs first, it may pass, but later modules may fail. But the question says 'suspects a conflict with another PAM module', so history is common.

Answer

The 'retry=3' option limits attempts, but the password is only tried once.

Answer

The 'requisite' control flag causes immediate failure if pam_cracklib fails, but another module might be overriding.

Answer

The 'minlen=8' option requires exactly 8 characters, not at least 8.

Question 4

To protect against SSH brute-force attacks, a system administrator installs fail2ban. Which configuration file should be modified to enable the SSH jail with default settings?

Accepted Answer

/etc/fail2ban/jail.local. Option B is correct because the local configuration file /etc/fail2ban/jail.local overrides defaults. Option A is wrong because jail.conf is the default and should not be edited directly; local changes go in .local. Option C is wrong because fail2ban.conf controls daemon behavior. Option D is wrong because sshd_config is for SSH server.

Answer

/etc/fail2ban/fail2ban.conf

Answer

/etc/ssh/sshd_config

Answer

/etc/fail2ban/jail.conf

Question 5

Refer to the exhibit. What type of attack is indicated by the log entries?

Accepted Answer

Brute-force attack on SSH. Option A is correct because multiple failed password attempts for root from the same IP in quick succession indicate a brute-force attack. Option B is wrong because a DDoS would involve many different IPs. Option C is wrong because a man-in-the-middle attack would not show in auth logs. Option D is wrong because privilege escalation is internal.

Answer

Privilege escalation attempt

Answer

Man-in-the-middle attack

Answer

Distributed denial-of-service (DDoS) attack

Question 6

A web server is running in enforcing mode under SELinux. The administrator wants to allow Apache to connect to a remote database server. Which SELinux boolean needs to be set to allow httpd to make network connections?

Accepted Answer

httpd_can_network_connect. Option C is correct. Option A is wrong because httpd_can_network_connect_db is for database protocols (e.g., MySQL), but the question says 'connect to a remote database server', which is specific. Actually, httpd_can_network_connect allows general outbound connections, and httpd_can_network_connect_db is more specific for database ports. The answer depends on the exact scenario. The official SELinux policy includes httpd_can_network_connect and httpd_can_network_connect_db. For a generic database connection, httpd_can_network_connect_db is more precise, but httpd_can_network_connect also works. The question likely expects httpd_can_network_connect as the essential boolean. But to be precise, I'll choose httpd_can_network_connect. Option B is wrong because httpd_enable_homedirs allows access to home directories. Option D is wrong because httpd_unified allows Apache to run in unified mode.

Answer

httpd_enable_homedirs

Answer

httpd_can_network_connect_db

Answer

httpd_unified

Question 7

An administrator wants to allow user 'john' to execute any command as root without a password. Which sudoers entry is correct?

Accepted Answer

john ALL=(ALL) NOPASSWD:ALL. The correct entry is 'john ALL=(ALL) NOPASSWD:ALL', which allows john to run any command as any user without a password. Option A requires a password. Option C restricts to a specific command. Option D requires a password.

Answer

john ALL=(ALL) NOPASSWD:/bin/ls

Answer

john ALL=(ALL) ALL

Answer

john ALL=(ALL) PASSWD:ALL

Question 8

An administrator wants to create a chroot environment for a potentially compromised service. The service needs to read /etc/resolv.conf and /etc/hosts, and run from a directory /chroot/service. Which of the following steps is essential to ensure the chroot environment is secure and functional?

Accepted Answer

Create /dev/null and /dev/random inside the chroot using mknod.. Option B is correct because the chroot environment must contain the necessary device files for system calls. Option A is wrong because copying binaries into the chroot is not always sufficient; they must be linked against libraries available inside. Option C is wrong because /proc should be mounted for some services but not essential for basic resolution files; however, it is often needed. Option D is wrong because setting the jail to read-only filesystem is a security measure but not essential for functionality. The most essential step is to create device nodes (like /dev/null, /dev/random) because many services require them.

Answer

Set the chroot directory to be read-only.

Answer

Mount /proc within the chroot jail.

Answer

Copy only the service binaries and configuration files into the chroot.

Question 9

An administrator wants to drop incoming TCP packets on port 22 from IP 10.0.0.5 using iptables. Which command is correct?

Accepted Answer

iptables -A INPUT -s 10.0.0.5 -p tcp --dport 22 -j DROP. The correct command uses the INPUT chain, source IP, protocol TCP, destination port 22, and target DROP. Options A, B, and C use incorrect chains or directions.

Answer

iptables -A INPUT -d 10.0.0.5 -p tcp --dport 22 -j DROP

Answer

iptables -A FORWARD -s 10.0.0.5 -p tcp --dport 22 -j DROP

Answer

iptables -A OUTPUT -s 10.0.0.5 -p tcp --dport 22 -j DROP

Question 10

Which TWO of the following are effective methods to secure SSH access on a Linux server? (Choose two.)

Accepted Answer

Disable password authentication and use only key-based authentication.. Options A and D are correct. Option A: Changing the SSH port reduces automated attacks. Option D: Using key-based authentication is more secure than passwords. Option B is wrong because using FTP over SSH (SFTP) is not an authentication method. Option C is wrong because regular password changes without key-only is less secure (though some may argue, but best practice is key-only). Option E is wrong because disabling root login prevents direct root access, but it is not a method to secure SSH itself; it's a separate measure.

Answer

Disable root login over SSH.

Answer

Use FTP over SSH (SFTP) for file transfers.

Answer

Require users to change their passwords every 30 days.