LPIC-2 DNS, Web and Mail Services Practice Test 2 — 15 Questions

Question 1

A company is migrating from Apache HTTPD 2.2 to 2.4 and needs to configure SSL for a virtual host. The administrator wants to use modern security practices. Which of the following configurations is the most secure and recommended for Apache 2.4?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSLEngine on; SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1; SSLCipherSuite HIGH:!aNULL:!MD5. It explicitly enables only TLS 1.2 and TLS 1.3 (by disabling SSLv3, TLSv1.0, and TLSv1.1) and uses the HIGH cipher suite with exclusion of aNULL (anonymous NULL ciphers) and MD5 (weak hash). This aligns with modern security standards (e.g., PCI DSS, NIST) and Apache 2.4's recommended hardening practices, avoiding deprecated protocols and weak ciphers.

Answer

SSLEngine on; SSLProtocol -SSLv2 -SSLv3; SSLCipherSuite MEDIUM:!aNULL

Answer

SSLEngine on; SSLProtocol TLSv1.2 TLSv1.3; SSLCipherSuite ECDHE+AESGCM

Answer

SSLEngine on; SSLProtocol all; SSLCipherSuite DEFAULT

Question 2

An Apache web server is experiencing high memory usage under heavy load. The administrator wants to reduce the number of idle child processes. Which configuration directive should be adjusted?

Accepted Answer

MinSpareThreads. MinSpareThreads controls the minimum number of idle threads that should be available to handle incoming requests. By reducing this value, the administrator ensures fewer idle child processes are kept running, which lowers memory usage under heavy load. This directive is specific to Apache's worker MPM (Multi-Processing Module) and directly influences the number of spare processes.

Answer

ServerLimit

Answer

MaxRequestWorkers

Answer

KeepAliveTimeout

Question 3

An organization's Postfix mail server is being used as an open relay. The administrator wants to restrict relaying to only authenticated users from the internal network. Which combination of settings is correct?

Accepted Answer

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination. It enforces relaying restrictions in the correct order: first permit mail from trusted internal networks (permit_mynetworks), then permit authenticated users (permit_sasl_authenticated), and finally reject all other unauthorized destinations (reject_unauth_destination). This ensures that only authenticated users or hosts in mynetworks can relay, while blocking open relay attempts from external unauthenticated sources.

Answer

smtpd_helo_restrictions = permit_sasl_authenticated, reject_unauth_destination

Answer

smtpd_recipient_restrictions = reject_unauth_destination, permit_mynetworks, permit_sasl_authenticated

Answer

smtpd_client_restrictions = permit_mynetworks, reject_unauth_destination

Question 4

Refer to the exhibit. The DNS server at 192.0.2.1 is the primary for example.com. What does the 'lame server' message indicate?

Accepted Answer

The server does not consider itself authoritative for example.com.. A 'lame server' message in DNS indicates that a server has received a query for a domain for which it is configured as a nameserver (e.g., via NS records or delegation), but it does not consider itself authoritative for that domain. In this case, the DNS server at 192.0.2.1 is the primary for example.com, so the message means it is not configured with the zone data or does not have the zone loaded, thus it responds as non-authoritative.

Answer

The server received a query for an invalid domain.

Answer

The server is not configured to listen on the querying client's network.

Answer

The server is too busy to answer queries.

Question 5

A Postfix administrator wants to restrict which clients can relay mail through the server. Which three smtpd restriction lists are typically used for this purpose? (Choose three.)

Accepted Answer

smtpd_helo_restrictions. The three restriction lists typically used to control mail relaying are smtpd_client_restrictions (D), smtpd_helo_restrictions (A), and smtpd_recipient_restrictions (E). smtpd_client_restrictions (D) is the primary list for deciding whether a connecting client is allowed to relay, using checks such as reject_unknown_client_hostname, permit_mynetworks, and reject_unauth_destination. smtpd_helo_restrictions (A) validates the client's HELO/EHLO argument with checks like reject_invalid_helo_hostname and reject_non_fqdn_helo_hostname, helping block clients that fail basic SMTP identity checks before relaying is considered. smtpd_recipient_restrictions (E) is evaluated at RCPT TO and is where relay authorization is commonly enforced with reject_unauth_destination, permit_mynetworks, and reject_unauth_pipelining. smtpd_data_restrictions (B) applies at the DATA command and is used for content/header checks such as reject_unauth_pipelining or header/body checks, not for client relay authorization. smtpd_sender_restrictions (C) validates the MAIL FROM sender address with checks like reject_unknown_sender_domain, so it does not by itself determine whether a client may relay.

Answer

smtpd_data_restrictions

Answer

smtpd_sender_restrictions

Question 6

Which TWO are best practices for securing an Apache web server?

Accepted Answer

Disable directory listing using Options -Indexes.. Disabling directory listing with `Options -Indexes` prevents Apache from generating a list of files in a directory when no index file (e.g., index.html) is present. This is a fundamental security hardening step that avoids exposing the directory structure, which could reveal sensitive files or paths to attackers. Option D is also correct: setting `ServerTokens Prod` reduces the amount of information Apache reveals about itself in HTTP headers and error pages (e.g., it omits the version number and OS details), making it harder for attackers to target specific vulnerabilities.

Answer

Allow directory indexing for ease of navigation.

Answer

Use .htaccess files for all access control.

Answer

Enable mod_info to monitor server status.

Question 7

A junior administrator accidentally deleted all log files in /var/log/nginx/ while the Nginx web server was running. The master process still holds open file descriptors to the deleted files. The administrator needs to resume receiving access logs in the original filenames without restarting the service. Which command should be used?

Accepted Answer

nginx -s reopen. The USR1 signal tells the Nginx master process to reopen log files. The `nginx -s reopen` command sends this signal, allowing new log files to be created with the same names and permissions. This is the standard approach after log rotation or accidental deletion, ensuring logging continues without a service restart.

Answer

systemctl restart nginx

Answer

kill -HUP $(cat /run/nginx.pid)

Answer

nginx -s reload

Question 8

An administrator is configuring Apache HTTPD 2.4 to serve multiple websites over HTTPS. The server has a single IP address and uses name-based virtual hosts. The administrator wants to ensure that each site presents the correct certificate and that SNI is used. Which directive must be set in each virtual host block to enable SNI for that site?

Accepted Answer

No additional directive is required; SNI is enabled by default in Apache 2.4. Apache 2.4 enables SNI by default for name-based SSL virtual hosts. Each virtual host needs its own certificate directives and SSLEngine on, but no separate SNI-enabling directive exists; the server automatically uses the hostname from the TLS handshake to select the appropriate virtual host and certificate.

Answer

SSLEngine on

Answer

SSLCertificateFile

Answer

ServerName

Question 9

A mail administrator is troubleshooting a Postfix server that relays outbound mail through a smart host requiring authentication. Users report that mail is deferred with the error 'SASL authentication failed; cannot authenticate to server'. The administrator has already verified the username and password in /etc/postfix/sasl_passwd and run postmap on the file. Which parameter in main.cf must be checked to ensure Postfix knows to use the password map?

Accepted Answer

smtp_sasl_password_maps. For Postfix to authenticate as a client to a smart host, it needs both smtp_sasl_auth_enable set to yes and smtp_sasl_password_maps pointing to a valid lookup table. The password file must be converted with postmap. Once those are in place, the SMTP client can retrieve credentials and complete SASL authentication, resolving the deferral error.

Answer

smtpd_sasl_auth_enable

Answer

smtp_sasl_security_options

Answer

smtp_sasl_auth_enable

Question 10

A company runs an Apache HTTPD 2.4 server hosting a customer portal at https://portal.example.com. The security team requires that the portal only accept TLS 1.2 and TLS 1.3 connections and present a certificate chain that includes the intermediate CA. The administrator adds the intermediate certificate to the file referenced by SSLCertificateChainFile in the virtual host. Which directive should be used in this modern configuration to ensure the intermediate certificate is sent to clients?

Accepted Answer

SSLCertificateFile /etc/pki/tls/certs/portal-fullchain.crt. Concatenating the server certificate with the intermediate CA certificates into the file referenced by SSLCertificateFile is the correct 2.4-era approach; the server transmits the whole bundle in the handshake. The former SSLCertificateChainFile directive is deprecated, and the other directives govern client-certificate verification or the private key rather than the chain presented to clients.

Answer

SSLCACertificateFile /etc/pki/tls/certs/intermediate.crt

Answer

SSLCertificateKeyFile /etc/pki/tls/certs/portal-fullchain.crt

Answer

SSLCertificateChainFile /etc/pki/tls/certs/intermediate.crt

Question 11

An administrator runs an Apache HTTP Server 2.4 instance serving several name-based virtual hosts over HTTPS on a single IP address. Clients connecting with TLS SNI for shop.example.com receive the certificate and content intended for www.example.com. The configuration contains a single <VirtualHost *:443> block with the shop vhost's ServerName, and the www vhost is defined earlier in the same file. Which action resolves the mismatch?

Accepted Answer

Define a separate <VirtualHost *:443> block for shop.example.com with its own ServerName and SSLCertificateFile.. With multiple HTTPS virtual hosts on one address, mod_ssl must map the SNI hostname to a vhost whose ServerName or ServerAlias matches and that carries the correct SSLCertificateFile. A single vhost block can only serve one certificate, so the shop hostname needs its own SSL vhost definition to stop receiving the www certificate.

Answer

Move the www.example.com vhost block after the shop.example.com block in the configuration.

Answer

Add a NameVirtualHost *:443 directive before the first vhost block.

Answer

Set SSLStrictSNIVHostCheck on in the global server configuration.

Question 12

A web administrator is configuring Apache HTTP Server 2.4 to serve a site over HTTPS. The server certificate, private key, and intermediate CA certificate are stored in separate files. The administrator wants to ensure that clients receive the full certificate chain to avoid chain-building errors. Which directive should be used to specify the intermediate CA certificate?

Accepted Answer

SSLCertificateChainFile. To avoid chain-building errors, Apache must send the intermediate CA certificate along with the server certificate. SSLCertificateChainFile explicitly loads the intermediate certificate file, ensuring clients can build a complete chain to a trusted root. This directive remains available in Apache 2.4 and is the correct choice when the intermediate is not concatenated into the server certificate file.

Answer

SSLCACertificateFile

Answer

SSLCertificateKeyFile

Answer

SSLCertificateFile

Question 13

A mail administrator runs Postfix on a gateway host that must accept mail for the internal domain example.com and relay it to an internal server while rejecting all other relay attempts. The administrator sets mydestination = example.com and configures relayhost. External spammers are attempting to use the gateway as an open relay by sending mail to unrelated domains. Which main.cf parameter must be configured to restrict relaying to example.com only?

Accepted Answer

relay_domains = example.com. relay_domains declares the domains for which Postfix accepts and forwards mail, so listing example.com authorizes relay for that domain alone. Combined with a recipient restriction such as reject_unauth_destination, the gateway refuses to relay for any other domain. The other parameters address trusted networks, access decisions, or per-destination transport selection rather than the relay-domain list.

Answer

smtpd_recipient_restrictions = permit_mynetworks, reject_unauth_destination

Answer

transport_maps = hash:/etc/postfix/transport

Answer

mynetworks = 127.0.0.0/8

Question 14

A mail administrator is configuring Postfix to use Dovecot's SASL implementation for SMTP AUTH on port 587. The administrator has already installed Dovecot and configured its SASL socket. Which TWO main.cf parameters must be set to enable Postfix to use Dovecot SASL for incoming SMTP authentication? (Choose two.)

Accepted Answer

smtpd_sasl_path = private/auth. To integrate Postfix with Dovecot SASL, the administrator must set smtpd_sasl_type to dovecot and smtpd_sasl_path to the location of Dovecot's SASL socket, typically private/auth. These two parameters tell Postfix which SASL implementation to use and where to find its socket, enabling SMTP AUTH via Dovecot.

Answer

smtpd_tls_auth_only = yes

Answer

smtpd_sasl_auth_enable = yes

Answer

smtpd_sasl_security_options = noanonymous

Question 15

A web administrator is configuring Apache HTTPD 2.4 to serve multiple secure websites on a single IP address using name-based virtual hosts. The administrator has created a single self-signed certificate for the server and wants to avoid certificate warnings for all sites. Which action must be taken to ensure that all virtual hosts present a valid certificate?

Accepted Answer

Use Server Name Indication (SNI) by configuring each virtual host with its own SSLCertificateFile and SSLCertificateKeyFile.. To serve multiple secure virtual hosts on one IP without warnings, Apache must use SNI to select the correct certificate per hostname. Each virtual host must have its own SSLCertificateFile and SSLCertificateKeyFile. SNI is supported by all modern clients. Without SNI, the first virtual host's certificate would be used for all, causing warnings for other hostnames.

Answer

Enable the SSLStrictSNIVHostCheck directive to require SNI support from clients.

Answer

Set the SSLProtocol directive to allow only TLSv1.2 or higher on all virtual hosts.

Answer

Configure a single wildcard certificate for the server and use it for all virtual hosts.