LPIC-2 DNS, Web and Mail Services Practice Test 3 — 15 Questions

Question 1

An administrator is configuring Apache HTTPD 2.4 to serve a website over HTTPS using a self-signed certificate. The server has the certificate and key files at /etc/ssl/certs/server.crt and /etc/ssl/private/server.key. The administrator wants to enforce modern SSL/TLS settings and redirect all HTTP traffic to HTTPS. Which THREE directives are required in the virtual host configuration to achieve this? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSLCertificateFile /etc/ssl/certs/server.crt. To enable HTTPS in Apache HTTPD 2.4, the minimum required directives are SSLEngine on, SSLCertificateFile, and SSLCertificateKeyFile. These activate SSL/TLS, provide the certificate, and provide the private key. Redirecting HTTP to HTTPS and restricting protocols are additional security measures but not strictly required to serve HTTPS.

Answer

SSLProtocol -all +TLSv1.2 +TLSv1.3

Answer

Redirect permanent / https://example.com/

Question 2

Which TWO statements are true regarding BIND DNS server security? (Choose two.)

Accepted Answer

The 'allow-recursion' ACL can be used to restrict which clients can use the server's recursive lookup feature.. Option B is correct because in BIND, the 'allow-recursion' ACL specifically controls which client addresses are permitted to use the server's recursive resolution capability, so only trusted clients perform recursion while others are limited to authoritative answers. Option E is correct because the 'allow-query' ACL defines which clients are allowed to send any DNS queries to the server, effectively restricting query access by source address. Option A is incorrect because 'allow-transfer' governs zone transfers (AXFR/IXFR) to secondary servers, not recursive query permissions. Option C is incorrect because the 'blackhole' ACL lists addresses the server will not answer or query at all; it does not prevent cache poisoning, which is mitigated by source-port randomization, DNSSEC, and bailiwick checking. Option D is incorrect because 'forwarders' specifies servers to which queries are forwarded, and recursion is disabled with 'recursion no', not with 'forwarders'.

Answer

The 'allow-transfer' ACL is used to restrict which clients can perform recursive queries.

Answer

The 'blackhole' ACL can be used to prevent cache poisoning attacks.

Answer

The 'forwarders' option can be used to disable recursion entirely.

Question 3

A company uses BIND9 as the authoritative name server for its public zone example.com. External users report that they cannot resolve the MX record for the domain, but internal users can. What is the most likely cause?

Accepted Answer

The allow-query ACL restricts queries to the internal network.. The allow-query ACL in BIND9 restricts which source IP addresses are permitted to send queries to the server. If it is set to allow only the internal network (e.g., 192.168.0.0/16), external users' queries are rejected, causing resolution failures for MX records and all other records. Internal users succeed because their IPs match the ACL, while external users receive a REFUSED response or no answer.

Answer

The zone file lacks an MX record.

Answer

The server is behind a firewall that blocks UDP port 53.

Answer

The recursion is set to no.

Question 4

A mail server running Postfix is deferring messages for a local user. The mail log shows 'status=deferred (mailbox is locked)'. What is the most likely cause?

Accepted Answer

The user's mailbox is currently being accessed by a POP3 client.. The 'mailbox is locked' message in Postfix logs indicates that the mailbox file is currently locked by another process, typically a POP3 or IMAP client that has the mailbox open for exclusive access. Postfix defers delivery because it cannot acquire the necessary lock to write to the mailbox, ensuring data integrity. This is a standard behavior defined by the mailbox locking mechanism (e.g., fcntl, dotlock) used by the MTA and MDA.

Answer

The filesystem containing the mail spool is out of inodes.

Answer

The disk quota for the user has been exceeded.

Answer

The Postfix process lacks write permission to the mailbox.

Question 5

Which Apache module is used to rewrite URLs based on rules?

Accepted Answer

mod_rewrite. mod_rewrite is the correct Apache module for rewriting URLs based on rules. It uses a regular expression engine to match incoming request URIs against patterns defined in .htaccess or server configuration files, then transforms them according to specified substitution rules. This module is essential for creating clean URLs, redirecting traffic, and implementing URL-based access control.

Answer

mod_proxy

Answer

mod_alias

Answer

mod_redirect

Question 6

A DNS administrator wants to implement DNSSEC on an authoritative zone. Which TWO resource records are essential for DNSSEC?

Accepted Answer

DNSKEY. DNSKEY (B) is essential because it holds the zone's public signing keys (the Zone Signing Key and Key Signing Key) that validators use to verify DNSSEC signatures. RRSIG (C) is essential because it contains the actual cryptographic signature covering each RRset in the signed zone, allowing resolvers to authenticate the data. Together, DNSKEY and RRSIG form the core of DNSSEC validation for an authoritative zone. NSEC (A) is used for authenticated denial of existence but is not required for every signed zone (NSEC3 is an alternative), so it is not universally essential. A (D) is just a host address record and SOA (E) is the zone's start-of-authority record; neither provides the cryptographic material DNSSEC requires.

Answer

NSEC

Answer

A

Answer

SOA

Question 7

Refer to the exhibit. A DNS query for 'ftp.example.com' returns NXDOMAIN. What configuration change would best resolve this?

Accepted Answer

Add an A record for ftp pointing to an IP address.. An NXDOMAIN response means the queried domain name does not exist in the zone. To resolve 'ftp.example.com', a DNS record must be created that maps the name to an IP address. Option D adds an A record, which directly provides the IPv4 address for the host, making the query succeed.

Answer

Add a CNAME record for ftp pointing to www.example.com.

Answer

Increase the serial number in the SOA record.

Answer

Ensure recursion is enabled on the server.

Question 8

Which Postfix configuration parameter specifies the domain that is appended to unqualified email addresses?

Accepted Answer

myorigin. The `myorigin` parameter in Postfix controls the domain that is appended to locally-originated mail from unqualified addresses (e.g., 'user' becomes 'user@example.com'). By default, it uses the value of `myhostname`, but it is commonly set to `$mydomain` to append the domain rather than the full hostname. This ensures that outbound mail has a consistent and clean sender domain.

Answer

myhostname

Answer

mydomain

Answer

mydomainname

Question 9

A company wants to host multiple websites on a single Apache server with different domain names. Which approach is most appropriate?

Accepted Answer

Name-based virtual hosting. Name-based virtual hosting allows a single Apache server to serve multiple websites using the same IP address and port by relying on the HTTP Host header sent by the client. This is the most efficient and commonly used method for hosting multiple domains on one server, as it conserves IP addresses and requires minimal configuration via the `<VirtualHost *:80>` directive.

Answer

IP-based virtual hosting

Answer

Port-based virtual hosting

Answer

Using mod_rewrite for each domain

Question 10

An Apache administrator is troubleshooting a slow website. Which THREE modules could be causing performance issues if misconfigured?

Accepted Answer

mod_proxy. mod_proxy (A) is correct because a misconfigured reverse or forward proxy can introduce latency, connection-pool exhaustion, or proxy loops that severely degrade website performance. mod_ssl (B) is correct because SSL/TLS handshakes are CPU-intensive, and poor configuration such as weak ciphers, no session caching (SSLSessionCache), or no session tickets forces repeated full handshakes that slow every HTTPS request. mod_rewrite (E) is correct because complex or poorly ordered RewriteRule/RewriteCond directives are evaluated on every request and can cause excessive regex processing or unintended internal redirects that multiply request handling. mod_status (C) only exposes server status/metrics and does not itself process request content, so it is not a typical performance bottleneck. mod_include (D) handles server-side includes and, while it adds some parsing overhead, is not among the modules most commonly implicated in the severe performance problems described here.

Answer

mod_status

Answer

mod_include

Question 11

A BIND9 nameserver is configured with 'allow-transfer { none; };' but a secondary nameserver needs to receive zone transfers. What change must be made on the master?

Accepted Answer

Set 'allow-transfer' to the secondary's IP.. The 'allow-transfer' directive on the master nameserver controls which hosts are permitted to request zone transfers (AXFR/IXFR). Setting it to 'none;' blocks all transfers, so to allow a secondary to receive the zone, you must explicitly list the secondary's IP address in the 'allow-transfer' statement on the master. This is the direct and necessary change to enable zone transfers to that specific slave.

Answer

Add a 'masters' statement in the slave's configuration.

Answer

Set 'notify' to yes.

Answer

Set 'also-notify' to the secondary IP.

Question 12

Which of the following is a mail delivery agent (MDA)?

Accepted Answer

Procmail. Procmail is a classic mail delivery agent (MDA) that receives messages from a mail transfer agent (MTA) and delivers them to a user's local mailbox, often applying filtering rules based on recipes. It operates after the MTA has accepted the message, making it the correct choice for an MDA.

Answer

Postfix

Answer

Dovecot

Answer

Sendmail

Question 13

A Postfix mail server is configured to use Dovecot SASL for authentication. Users report that they can send emails but are prompted for password repeatedly and see "SASL authentication failed" in the logs. The Dovecot SASL socket is configured correctly. What is the most likely cause?

Accepted Answer

The postfix user does not have permission to access the Dovecot auth socket.. The most common cause of repeated password prompts and 'SASL authentication failed' errors when Postfix is configured to use Dovecot SASL is a permissions issue on the Dovecot auth socket. Even if the socket path is correct in Postfix's `smtpd_sasl_path`, the Postfix process (typically running as the `postfix` user) must have read/write access to that socket file. Without proper permissions, Postfix cannot communicate with Dovecot's authentication service, causing SASL failures despite correct authentication mechanisms and enabled settings.

Answer

The mynetworks parameter in Postfix is set to the wrong subnet.

Answer

The Dovecot auth mechanism is set to 'login' but Postfix expects 'PLAIN'.

Answer

The smtpd_sasl_auth_enable parameter is set to no.

Question 14

A company has two BIND DNS servers, a primary and a secondary. The secondary fails to receive zone updates. Which command can be used to check if the primary allows zone transfers to the secondary?

Accepted Answer

dig axfr example.com @primary. The `dig axfr example.com @primary` command performs an AXFR (full zone transfer) request against the primary DNS server. If the primary allows zone transfers to the secondary, the command will return the entire zone file; if it is denied, it will return a 'Transfer failed' or 'refused' message. This directly tests the allow-transfer ACL configuration on the primary, which is the most common cause of secondary servers failing to receive zone updates.

Answer

host -l example.com primary

Answer

dig -x 192.0.2.1 @primary

Answer

nslookup -type=any example.com primary

Question 15

Which command can be used to trace the delegation path of a DNS domain?

Accepted Answer

dig +trace. The `dig +trace` command performs a full iterative DNS resolution from the root nameservers down to the authoritative nameservers for the queried domain, showing each delegation step. The `host -C` command is not a delegation tracing tool; it only queries SOA records from authoritative servers and does not follow the delegation chain. Therefore, only `dig +trace` is correct.

Answer

nslookup -type=any

Answer

host -C

Answer

dig -x

Answer

whois