LPIC-2 Practice Test 9 — 10 Questions

Question 1

A sysadmin is configuring VLAN tagging on a Linux server that will act as a router-on-a-stick for multiple VLANs (10, 20, 30). The server has a single physical interface enp0s3 connected to a switch trunk port that allows VLANs 10, 20, and 30. The administrator uses systemd-networkd and creates VLAN interfaces enp0s3.10, enp0s3.20, enp0s3.30 with IP addresses 10.0.10.1/24, 10.0.20.1/24, and 10.0.30.1/24 respectively. They enable IP forwarding and, for security, set the iptables FORWARD chain default policy to DROP, but they add no specific rules. Clients in VLAN 10 can ping their gateway (10.0.10.1) but cannot ping clients in VLAN 20 (10.0.20.2). The switch confirms correct configuration. Which of the following is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The server's iptables FORWARD chain is set to DROP by default.. The default policy of the iptables FORWARD chain is set to DROP, and no specific rules are added to allow traffic between VLANs. Since the server is acting as a router-on-a-stick, inter-VLAN traffic must be forwarded by the kernel, which requires explicit ACCEPT rules in the FORWARD chain. Without these rules, packets from VLAN 10 to VLAN 20 are dropped, even though the VLAN interfaces and switch configuration are correct.

Answer

The VLAN interface enp0s3.10 is missing the 'vlan' flag or is not properly bound.

Answer

The server's MAC address is not allowed on the switch for VLAN 10.

Answer

The switch port is configured as an access port instead of a trunk.

Question 2

A Linux administrator is setting up an IPsec VPN between two sites using strongSwan. The VPN established successfully, but traffic between the sites is not being encrypted. What is the most probable cause?

Accepted Answer

The IPsec policies are not configured to match the traffic.. The most probable cause for traffic not being encrypted after a successful IPsec tunnel establishment is that the IPsec policies (e.g., strongSwan's `ipsec.conf` `conn` section with `leftsubnet`/`rightsubnet`) do not match the actual traffic flows. Even if the IKE/SA is up, strongSwan only applies encryption to packets that match the configured selectors; mismatched subnets or protocols result in cleartext traffic bypassing the tunnel.

Answer

The firewall is blocking UDP port 500.

Answer

The kernel does not support IPsec (net.ipv4.ip_forward=0).

Answer

The IPsec daemon is not started.

Question 3

A network administrator notices that VLAN tagging is not working on a Linux bridge. The bridge interface br0 has member ports eth0 and eth1. The administrator runs 'bridge vlan show' and sees that only the default VLAN 1 is present. What is the most likely cause?

Accepted Answer

The bridge is not enabled for VLAN filtering. The 'bridge vlan show' command only displays VLAN filtering information when VLAN filtering is enabled on the bridge. By default, Linux bridges operate in a simple switching mode without VLAN awareness, meaning all frames are forwarded regardless of VLAN tags. The administrator must explicitly enable VLAN filtering using 'ip link set dev br0 type bridge vlan_filtering 1' to activate per-VLAN forwarding and filtering, which is why only the default untagged VLAN 1 appears.

Answer

The kernel module for VLAN is not loaded

Answer

The VLAN protocol is not set to 802.1Q

Answer

Ports eth0 and eth1 are not set to promiscuous mode

Question 4

A company requires link aggregation between a Linux server and a switch to increase throughput and provide redundancy. The switch supports only standard 802.3ad (LACP). Which bonding mode should be configured on the Linux server?

Accepted Answer

mode=4 (802.3ad). Mode=4 (802.3ad) implements the IEEE 802.3ad standard for Link Aggregation Control Protocol (LACP). This mode requires the switch to support LACP, which the scenario states, and provides both increased throughput through load balancing and redundancy through automatic failover if a link fails.

Answer

mode=2 (balance-xor)

Answer

mode=1 (active-backup)

Answer

mode=3 (broadcast)

Answer

mode=0 (balance-rr)

Question 5

Which THREE factors can cause a kernel panic during boot? (Select THREE.)

Accepted Answer

Corrupted kernel image. A kernel panic during boot occurs when the kernel cannot continue initializing the system. Option B (Corrupted kernel image) is correct because if the kernel binary itself is damaged or truncated, the bootloader loads invalid code and the kernel cannot execute, triggering a panic. Option C (Hardware incompatibility) is correct because unsupported or faulty hardware (e.g., CPU features, memory, or chipset) can cause the kernel to hit an unrecoverable error during early initialization. Option E (Missing device drivers for storage controllers) is correct because if the kernel lacks the driver needed to access the root filesystem's storage controller, it cannot mount root and will panic with a 'VFS: Unable to mount root fs' error. Option A (Too many kernel modules loaded) is not a direct cause of panic; module count alone does not break boot, and modules load after the kernel is already running. Option D (Filesystem errors on the root partition) typically cause a mount failure or drop to a recovery shell rather than a kernel panic, since the kernel itself can still run and report the error.

Answer

Too many kernel modules loaded

Answer

Filesystem errors on the root partition

Question 6

Which THREE commands can be used to display routing information?

Accepted Answer

route -n. The `route -n` command displays the kernel's IPv4 routing table with numeric addresses, avoiding DNS lookups. It is a standard tool for viewing routing information on Linux systems, making option B correct.

Answer

ping -R

Answer

traceroute

Question 7

Which file is used by GRUB2 to load the kernel and initramfs?

Accepted Answer

/boot/grub/grub.cfg. GRUB2 uses /boot/grub/grub.cfg as its main configuration file, which contains the menu entries, kernel paths, and initramfs locations. This file is generated by update-grub (or grub-mkconfig) based on scripts in /etc/grub.d/ and settings in /etc/default/grub, and it is read directly by the GRUB2 bootloader at boot time to load the kernel and initramfs.

Answer

/etc/lilo.conf

Answer

/etc/default/grub

Answer

/boot/grub/menu.lst

Question 8

An administrator wants to implement network bonding for redundancy on a Linux server running RHEL 8. The server has two physical interfaces em1 and em2. The administrator creates a bond interface bond0 with mode active-backup (mode 1) and adds the slaves em1 and em2. They assign IP address 192.168.50.10/24 to bond0 and bring up the bond. The bond appears to work initially, with one slave active. However, when they disconnect the cable from the active slave, the bond does not fail over to the other slave. The administrator checks /proc/net/bonding/bond0 and sees that the link status for both slaves shows 'up' even after the disconnection. They confirm the bonding module is loaded and the mode is correct. Which of the following is the most likely missing configuration?

Accepted Answer

The MII monitoring interval (miimon) is not configured.. In active-backup bonding mode (mode 1), the kernel bonding driver requires the MII (Media Independent Interface) monitoring interval (miimon) to be configured in order to detect link failures. Without miimon, the driver never polls the slave interfaces for link state changes, so even when a cable is disconnected, the driver continues to see the link as 'up' and does not trigger a failover. The administrator must set miimon=100 (or another value in milliseconds) in the bond configuration to enable periodic link monitoring.

Answer

The bond interface requires a specific kernel module that is missing.

Answer

The slave interfaces were not set to 'down' before enslaving.

Answer

The bond mode is set to mode 0 instead of mode 1.

Question 9

A system administrator is responsible for a production server running a custom-compiled Linux kernel version 5.15. After a routine update of the kernel source and recompilation, the server fails to boot. The error message on the console is: 'Kernel panic - not syncing: No working init found. Try passing init= option to kernel.' The administrator verifies that the root filesystem is intact by booting from a live USB and mounting the root partition. The filesystem contains the usual /sbin/init (symlinked to systemd). The administrator also checks the boot loader configuration and sees that the kernel command line includes 'root=/dev/sda1 ro'. The init binary exists and is executable. Which of the following is the most likely cause of this boot failure?

Accepted Answer

The boot loader's 'initrd' directive is missing or points to a non-existent file. The error 'No working init found' indicates the kernel successfully mounted the root filesystem but could not execute the init binary. Since the administrator confirmed the init binary exists and is executable on the root partition, the most likely cause is that the kernel did not have access to the necessary drivers or modules to properly access the root filesystem at boot time. The missing or misconfigured initrd (initial RAM disk) directive means the kernel lacks the temporary root filesystem containing essential modules (e.g., storage controller drivers) needed to mount the real root filesystem, leading to the kernel falling back to a failed init search.

Answer

The kernel was compiled without support for the ext4 filesystem

Answer

The init binary is missing or corrupted

Answer

The root filesystem is corrupted and cannot be mounted properly

Question 10

In Samba 4, what is the default security mode when no 'security' parameter is set in the [global] section?

Accepted Answer

user. In Samba 4, when no 'security' parameter is explicitly set in the [global] section, the default security mode is 'user'. This means clients must authenticate with a valid username and password, and Samba validates credentials against the local passdb backend (e.g., tdbsam or LDAP). This default has been consistent since Samba 3.x and ensures that each connection is tied to a specific user identity.

Answer

ads

Answer

share

Answer

domain