LPIC-2 DNS, Web and Mail Services Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. A DNS query for 'ftp.example.com' returns NXDOMAIN. What configuration change would best resolve this?

Accepted Answer

Add an A record for ftp pointing to an IP address.. An NXDOMAIN response means the queried domain name does not exist in the zone. To resolve 'ftp.example.com', a DNS record must be created that maps the name to an IP address. Option D adds an A record, which directly provides the IPv4 address for the host, making the query succeed.

Answer

Add a CNAME record for ftp pointing to www.example.com.

Answer

Increase the serial number in the SOA record.

Answer

Ensure recursion is enabled on the server.

Question 2

Refer to the exhibit. What is the most likely cause of this Apache error?

Accepted Answer

The semaphore limit for the Apache user is exceeded.. The Apache error 'semaphore limit exceeded' occurs when the number of semaphores allocated to the Apache user exceeds the system-wide or per-user semaphore limit. Apache uses semaphores for inter-process communication (IPC) in its prefork or worker MPMs to coordinate child processes. The correct answer is C because this error directly indicates that the kernel's semaphore limits (e.g., `SEMMSL`, `SEMMNS`, or `SEMOPM` in `/proc/sys/kernel/sem`) have been exhausted for the Apache user, often due to too many child processes or a misconfigured `MaxClients` directive.

Answer

The filesystem containing the logs is full.

Answer

The server is out of memory.

Answer

The RewriteMap file specified is missing.

Question 3

Refer to the exhibit. What is wrong with the reverse DNS resolution for 192.0.2.1?

Accepted Answer

The PTR record for 192.0.2.1 is missing.. The reverse DNS resolution for 192.0.2.1 requires a PTR record in the reverse zone file. The query returns NXDOMAIN, which indicates that the PTR record for 1.2.0.192.in-addr.arpa does not exist, meaning the record is missing. Without this PTR record, the reverse lookup fails.

Answer

The reverse zone is not delegated.

Answer

The query should be for 1.2.0.192.in-addr.arpa.

Answer

The server is not authoritative for the reverse zone.

Question 4

Which Postfix configuration parameter specifies the domain that is appended to unqualified email addresses?

Accepted Answer

myorigin. The `myorigin` parameter in Postfix controls the domain that is appended to locally-originated mail from unqualified addresses (e.g., 'user' becomes 'user@example.com'). By default, it uses the value of `myhostname`, but it is commonly set to `$mydomain` to append the domain rather than the full hostname. This ensures that outbound mail has a consistent and clean sender domain.

Answer

myhostname

Answer

mydomain

Answer

mydomainname

Question 5

A company wants to host multiple websites on a single Apache server with different domain names. Which approach is most appropriate?

Accepted Answer

Name-based virtual hosting. Name-based virtual hosting allows a single Apache server to serve multiple websites using the same IP address and port by relying on the HTTP Host header sent by the client. This is the most efficient and commonly used method for hosting multiple domains on one server, as it conserves IP addresses and requires minimal configuration via the `<VirtualHost *:80>` directive.

Answer

IP-based virtual hosting

Answer

Port-based virtual hosting

Answer

Using mod_rewrite for each domain

Question 6

A DNS server returns SERVFAIL for queries to a zone that is configured as a slave. The master server is reachable. What should the administrator check?

Accepted Answer

The zone transfer is allowed from the slave.. When a slave DNS server returns SERVFAIL for a zone it is configured to serve, but the master is reachable, the most common cause is that the master's zone transfer ACL does not include the slave's IP address. Without an explicit 'allow-transfer' directive (or equivalent) on the master permitting the slave, the master will refuse the zone transfer, leaving the slave with no valid zone data and thus returning SERVFAIL. This is a fundamental access control check in BIND and other DNS servers.

Answer

The serial number on the master is greater than on the slave.

Answer

The slave's allow-query includes the master.

Answer

The TSIG key is correct.

Question 7

Which TWO tools can be used to send test email messages from the command line?

Accepted Answer

sendmail. B is correct because the `sendmail` command can be used directly from the command line to inject a test email into the local MTA queue, bypassing a full MUA. It accepts a recipient address and message body via standard input, making it a reliable tool for testing mail delivery without a full mail client.

Answer

netcat

Answer

mutt

Answer

telnet

Question 8

An Apache administrator is troubleshooting a slow website. Which THREE modules could be causing performance issues if misconfigured?

Accepted Answer

mod_proxy. mod_proxy can cause performance issues if misconfigured because it may create excessive backend connections, fail to reuse connections via KeepAlive, or introduce latency through improper load balancing or reverse proxy caching settings. A common misconfiguration is setting ProxyTimeout too low, causing premature connection drops and retries.

Answer

mod_status

Answer

mod_include

Question 9

A BIND9 nameserver is configured with 'allow-transfer { none; };' but a secondary nameserver needs to receive zone transfers. What change must be made on the master?

Accepted Answer

Set 'allow-transfer' to the secondary's IP.. The 'allow-transfer' directive on the master nameserver controls which hosts are permitted to request zone transfers (AXFR/IXFR). Setting it to 'none;' blocks all transfers, so to allow a secondary to receive the zone, you must explicitly list the secondary's IP address in the 'allow-transfer' statement on the master. This is the direct and necessary change to enable zone transfers to that specific slave.

Answer

Add a 'masters' statement in the slave's configuration.

Answer

Set 'notify' to yes.

Answer

Set 'also-notify' to the secondary IP.

Question 10

Which of the following is a mail delivery agent (MDA)?

Accepted Answer

Procmail. Procmail is a classic mail delivery agent (MDA) that receives messages from a mail transfer agent (MTA) and delivers them to a user's local mailbox, often applying filtering rules based on recipes. It operates after the MTA has accepted the message, making it the correct choice for an MDA.

Answer

Postfix

Answer

Dovecot

Answer

Sendmail

Question 11

A system administrator notices that clients on the internal network can resolve the company's web server's hostname (www.example.com) using the internal DNS server (192.168.1.10), but external clients are unable to resolve it. The company uses BIND9 on an Ubuntu server. Which of the following configuration changes should be made on the DNS server to allow external resolution?

Accepted Answer

Add a 'listen-on' statement for the external IP address.. The BIND9 DNS server is likely only listening on the internal IP address (192.168.1.10) by default, so external queries never reach the server. Adding a 'listen-on' statement for the external IP address (e.g., the public IP assigned to the server's external interface) allows BIND to accept and respond to DNS queries from external clients on that address, enabling external resolution of www.example.com.

Answer

Enable recursion by setting 'recursion yes'.

Answer

Set the 'allow-query' option to 'any' in the options block.

Answer

Add an A record for www.example.com in the reverse zone.

Question 12

A company is migrating from Apache HTTPD 2.2 to 2.4 and needs to configure SSL for a virtual host. The administrator wants to use modern security practices. Which of the following configurations is the most secure and recommended for Apache 2.4?

Accepted Answer

SSLEngine on; SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1; SSLCipherSuite HIGH:!aNULL:!MD5. It explicitly enables only TLS 1.2 and TLS 1.3 (by disabling SSLv3, TLSv1.0, and TLSv1.1) and uses the HIGH cipher suite with exclusion of aNULL (anonymous NULL ciphers) and MD5 (weak hash). This aligns with modern security standards (e.g., PCI DSS, NIST) and Apache 2.4's recommended hardening practices, avoiding deprecated protocols and weak ciphers.

Answer

SSLEngine on; SSLProtocol -SSLv2 -SSLv3; SSLCipherSuite MEDIUM:!aNULL

Answer

SSLEngine on; SSLProtocol TLSv1.2 TLSv1.3; SSLCipherSuite ECDHE+AESGCM

Answer

SSLEngine on; SSLProtocol all; SSLCipherSuite DEFAULT

Question 13

A Postfix mail server is configured to use Dovecot SASL for authentication. Users report that they can send emails but are prompted for password repeatedly and see "SASL authentication failed" in the logs. The Dovecot SASL socket is configured correctly. What is the most likely cause?

Accepted Answer

The postfix user does not have permission to access the Dovecot auth socket.. The most common cause of repeated password prompts and 'SASL authentication failed' errors when Postfix is configured to use Dovecot SASL is a permissions issue on the Dovecot auth socket. Even if the socket path is correct in Postfix's `smtpd_sasl_path`, the Postfix process (typically running as the `postfix` user) must have read/write access to that socket file. Without proper permissions, Postfix cannot communicate with Dovecot's authentication service, causing SASL failures despite correct authentication mechanisms and enabled settings.

Answer

The mynetworks parameter in Postfix is set to the wrong subnet.

Answer

The Dovecot auth mechanism is set to 'login' but Postfix expects 'PLAIN'.

Answer

The smtpd_sasl_auth_enable parameter is set to no.

Question 14

A company has two BIND DNS servers, a primary and a secondary. The secondary fails to receive zone updates. Which command can be used to check if the primary allows zone transfers to the secondary?

Accepted Answer

dig axfr example.com @primary. The `dig axfr example.com @primary` command performs an AXFR (full zone transfer) request against the primary DNS server. If the primary allows zone transfers to the secondary, the command will return the entire zone file; if it is denied, it will return a 'Transfer failed' or 'refused' message. This directly tests the allow-transfer ACL configuration on the primary, which is the most common cause of secondary servers failing to receive zone updates.

Answer

host -l example.com primary

Answer

dig -x 192.0.2.1 @primary

Answer

nslookup -type=any example.com primary

Question 15

An Apache web server is experiencing high memory usage under heavy load. The administrator wants to reduce the number of idle child processes. Which configuration directive should be adjusted?

Accepted Answer

MinSpareThreads. MinSpareThreads controls the minimum number of idle threads that should be available to handle incoming requests. By reducing this value, the administrator ensures fewer idle child processes are kept running, which lowers memory usage under heavy load. This directive is specific to Apache's worker MPM (Multi-Processing Module) and directly influences the number of spare processes.

Answer

ServerLimit

Answer

MaxRequestWorkers

Answer

KeepAliveTimeout