LPIC-2 DNS, Web and Mail Services Practice Test 4 — 15 Questions

Question 1

A company runs a DNS server using BIND9 on a Linux server. The server is configured with two network interfaces: one internal (192.168.1.10) and one external (203.0.113.10). The server is configured to be authoritative for example.com. Internal clients can resolve example.com, but external clients receive "SERVFAIL" responses. The host command from an external client returns "Host not found". The administrator checks the named configuration and finds the following in /etc/bind/named.conf.options:

options {
  directory "/var/cache/bind";
  listen-on { 127.0.0.1; 192.168.1.10; 203.0.113.10; };
  allow-query { 192.168.1.0/24; };
  recursion no;
  dnssec-validation auto;
};

The zone configuration for example.com has proper allow-transfer and allow-update settings. What change should be made to resolve external queries?

Accepted Answer

Change 'allow-query' to '{ any; };'. The 'allow-query' directive restricts which clients can send queries to the server. With 'allow-query { 192.168.1.0/24; };', only internal clients on that subnet are permitted to query, causing external clients to receive SERVFAIL. Changing it to '{ any; };' allows all clients to query the server, resolving the issue while still keeping recursion disabled for security.

Answer

Add 'recursion yes;' to the options block.

Answer

Add 'listen-on port 53 { 203.0.113.10; };' to the options block.

Answer

Change 'listen-on' to '{ any; };'

Question 2

A web administrator has installed Apache httpd 2.4 on a Linux server. The default configuration serves files from /var/www/html. When accessing http://server/, the browser shows a directory listing of /var/www/html instead of the index.html file that exists in that directory. The administrator confirms that the user has read permissions on the file and that the file is named index.html. Which directive is most likely missing from the Apache configuration?

Accepted Answer

DirectoryIndex index.html. The DirectoryIndex directive specifies which file Apache should serve when a client requests a directory (e.g., /). Without it, or if it does not list index.html, Apache falls back to generating a directory listing (if Options +Indexes is enabled) or returns a 403 Forbidden. Since the default configuration for Apache 2.4 includes Options +Indexes and DirectoryIndex index.html, the most likely cause is that the DirectoryIndex directive was removed or overridden in a context (e.g., a <Directory> block) and no longer includes index.html, causing Apache to ignore the file and show the directory listing instead.

Answer

IndexOptions FancyIndexing

Answer

Options -Indexes

Answer

Require all granted

Question 3

A systems administrator is configuring a Postfix mail server to use Dovecot for SASL authentication. The authentication method is set to PLAIN in Dovecot, and Postfix has smtpd_sasl_auth_enable=yes and smtpd_sasl_type=dovecot. Dovecot's auth socket is at /var/run/dovecot/auth-client. The mail logs show repeated "SASL authentication failed" errors for known good credentials. The administrator checks that the socket exists and that Dovecot is running. What is the most likely cause?

Accepted Answer

The postfix user does not have read permission on the Dovecot auth socket.. The most likely cause is that the Postfix user (typically 'postfix' or the mail queue owner) lacks read permission on the Dovecot auth socket at /var/run/dovecot/auth-client. Dovecot's SASL authentication via a Unix socket requires the connecting process (Postfix) to have read/write access to that socket file. Even though the socket exists and Dovecot is running, if the permissions are too restrictive (e.g., owned by 'dovecot' with mode 0600), Postfix cannot communicate with Dovecot's auth service, resulting in repeated 'SASL authentication failed' errors despite valid credentials.

Answer

The smtpd_recipient_restrictions does not include permit_sasl_authenticated.

Answer

The Dovecot service is not listening on TCP port 143 for IMAP.

Answer

The mynetworks parameter in Postfix is set incorrectly.

Question 4

A system administrator notices that external clients cannot resolve the company's primary website (www.example.com) but internal clients can. What is the most likely cause?

Accepted Answer

The external DNS server has a missing A record for www.example.com.. If the external DNS server is missing an A record for www.example.com, external clients querying that server will receive a negative response (NXDOMAIN or NODATA), while internal clients can still resolve the name if the internal DNS server has the correct record (e.g., via zone transfer or manual configuration). This scenario directly explains the symptom: internal resolution works, external fails.

Answer

The internal DNS server is not authoritative for the zone.

Answer

The firewall is blocking port 53 UDP to the internal DNS server.

Answer

The internal DNS server is not configured for recursion.

Question 5

A Linux administrator manages a BIND 9.18 authoritative server for the zone 'corp.example'. The zone file contains an MX record pointing to 'mail.corp.example'. The administrator wants the zone to remain valid if the mail host is temporarily removed, and wants to avoid the zone failing to load due to a missing address record. Which record should be added to ensure the MX target is resolvable within the zone?

Accepted Answer

An A or AAAA record for mail.corp.example in the same zone. For an MX record to be usable, its target hostname must resolve to an A or AAAA record. Adding that address record inside the same zone ensures the MX target is resolvable without relying on external zones, keeping the zone valid and mail flow operational even if the host is temporarily removed elsewhere.

Answer

A CNAME record for mail.corp.example pointing to the MX target

Answer

A PTR record for mail.corp.example in the same zone

Answer

An NS record for mail.corp.example in the same zone

Question 6

A junior administrator needs to check the contents of a zone file for syntax errors before reloading BIND. Which command is specifically designed to verify the syntax of a BIND zone file and report errors without loading it into the running server?

Accepted Answer

named-checkzone. named-checkzone is the BIND tool dedicated to verifying zone file syntax and integrity. It allows an administrator to catch errors before reloading the server, whereas named-checkconf checks configuration files, dig queries live data, and rndc reload applies changes without validation.

Answer

rndc reload

Answer

dig

Answer

named-checkconf

Question 7

A company runs BIND 9 as a caching-only recursive resolver for its office LAN. Users on the LAN suddenly report that lookups for external names are slow, and packet captures show that the server repeatedly queries the root and TLD servers for the same names within a few minutes. The zone file for the root hints is valid, and the server is not authoritative for any zone. Which directive in named.conf is MOST likely misconfigured or missing, causing the cache not to retain answers?

Accepted Answer

max-cache-ttl 0;. A caching-only resolver must retain answers for their TTL so subsequent identical queries are served locally. When max-cache-ttl is set to zero, BIND treats every cached record as immediately expired, producing the repeated root and TLD queries observed while clients still receive answers. Correcting or removing that directive restores normal cache retention.

Answer

recursion no;

Answer

dnssec-validation no;

Answer

allow-query { none; };

Question 8

A Linux administrator maintains a BIND 9 authoritative name server for the zone 'corp.example.net'. The zone file is signed with DNSSEC, and the administrator must publish the public keys so that validating resolvers can build a chain of trust. Which resource record type must be created in the parent zone to delegate trust to this signed child zone?

Accepted Answer

A DS record containing the key tag, algorithm, digest type, and digest of the child's KSK. The parent zone delegates DNSSEC trust by publishing a DS record that contains a digest of the child zone's key-signing key. Validating resolvers fetch this DS record and use it to authenticate the child's DNSKEY RRset, thereby extending the chain of trust down to corp.example.net. Without the DS record, the child zone remains an island of trust.

Answer

An RRSIG record covering the child zone's SOA record

Answer

An NSEC3 record proving the non-existence of unsigned delegations

Answer

A DNSKEY record containing the zone's public key material

Question 9

An administrator runs Postfix 3.x on a mail gateway that must relay outbound mail for an internal application server. The application connects from 10.20.30.40 and sends mail with an envelope sender of 'reports@internal.example.com'. The administrator wants Postfix to accept and relay this mail without requiring SMTP AUTH, but only for that specific host, while rejecting all other unauthorized relaying. Which main.cf parameter should be configured?

Accepted Answer

mynetworks = 10.20.30.40/32. Postfix grants relay access to clients whose IP addresses appear in mynetworks. By listing 10.20.30.40/32, the administrator trusts only that application server to relay mail without authentication. Other clients remain subject to smtpd_relay_restrictions and will be rejected unless they authenticate, satisfying the requirement for selective relay authorization.

Answer

relay_domains = internal.example.com

Answer

smtpd_client_restrictions = check_client_access hash:/etc/postfix/access

Answer

smtpd_relay_restrictions = permit_sasl_authenticated, reject

Question 10

An administrator manages a BIND 9 server that acts as the primary master for the zone sales.example.com. The zone file is /var/named/sales.example.com.zone and the server's named.conf contains a zone statement with type master. After editing the zone file to add a new MX record, the administrator wants the running server to reload just this zone without restarting named or reloading every other zone. Which command accomplishes this?

Accepted Answer

rndc reload sales.example.com. The rndc reload command accepts an optional zone name, allowing a single zone to be re-read from disk while named keeps running. It is the targeted, non-disruptive way to publish an edited MX record. The other commands either validate the file, reload global configuration, or act on the whole service rather than the single zone.

Answer

systemctl reload named.service sales.example.com

Answer

rndc reconfig sales.example.com

Answer

named-checkzone sales.example.com /var/named/sales.example.com.zone

Question 11

A junior administrator has been asked to configure Apache HTTPD 2.4 to serve a static website from /var/www/html and to allow directory listings only for the /var/www/html/docs directory. The administrator adds the directive Options +Indexes inside a block in httpd.conf. After restarting Apache, directory listings for /docs still return 403 Forbidden. Which directive must be present in the block to permit the listing?

Accepted Answer

Require all granted. Apache 2.4 changed the authorization model, replacing Order/Allow/Deny with the Require directive. To allow access to a directory, you must include Require all granted. The Options +Indexes directive only enables the generation of directory listings; it does not override access control. Both are needed for a browsable directory.

Answer

Order allow,deny

Answer

AllowOverride All

Answer

Options +FollowSymLinks

Question 12

A mail administrator is troubleshooting a Postfix server that relays outbound mail for internal applications. Remote recipients report that messages are rejected with relay access denied, and the administrator confirms that the internal application hosts are not listed in any Postfix access map or authenticated session. The administrator wants those internal hosts to be permitted to relay. Which TWO main.cf parameters should be configured to allow this? (Choose two.)

Accepted Answer

mynetworks. Postfix authorizes relaying for non-authenticating clients by trusting their source addresses through mynetworks, and by including permit_mynetworks in smtpd_recipient_restrictions so the relay decision at RCPT TO accepts them. Both pieces are required: the network list identifies trusted clients, and the restriction list actually grants them permission to relay.

Answer

smtpd_sasl_auth_enable

Answer

inet_interfaces

Answer

relayhost

Question 13

A DNS administrator is adding a new mail exchanger record for the domain example.com. The mail server is mail.example.com with IP address 203.0.113.5, and it should be the primary MX with priority 10. The administrator also wants to ensure that mail servers attempting delivery can resolve mail.example.com. Which TWO resource records must be added to the zone file to satisfy these requirements?

Accepted Answer

An MX record for example.com pointing to mail.example.com with priority 10, and an A record for mail.example.com pointing to 203.0.113.5.. For mail delivery, an MX record specifies the mail server hostname for a domain, and an A record provides the IPv4 address for that hostname. The MX record must be placed at the domain receiving mail, and its target must have an address record. Using a CNAME or PTR in place of the A record would not correctly resolve the mail server's address.

Answer

An MX record for example.com pointing to mail.example.com with priority 10, and a CNAME record for mail.example.com pointing to example.com.

Answer

An MX record for mail.example.com pointing to example.com with priority 10, and an A record for example.com pointing to 203.0.113.5.

Answer

An MX record for example.com pointing to mail.example.com with priority 10, and a PTR record for mail.example.com pointing to 203.0.113.5.

Question 14

A web administrator runs Apache HTTP Server 2.4 with mod_proxy and mod_proxy_balancer. Backend application servers are configured as balancer members in a ProxyPass directive using the balancer://appcluster URL. One backend begins returning HTTP 500 responses for every request, but the balancer keeps sending it traffic, so about one third of user requests fail. The administrator wants the balancer to stop using that member automatically without editing the configuration. Which action achieves this?

Accepted Answer

Enable the balancer member's failonstatus parameter so the member is placed in error state when it returns the specified HTTP status.. mod_proxy_balancer only removes a member from rotation when it is placed in error state. The failonstatus parameter makes the balancer interpret specific HTTP response codes from a member, such as 500, as failures, marking that member in error so the remaining healthy backends serve all requests until it recovers.

Answer

Configure the balancer's lbmethod to byrequests instead of bytraffic.

Answer

Set the ProxyPass directive's retry parameter to 0 for the cluster.

Answer

Add the ping parameter to each BalancerMember so the balancer performs health checks.

Question 15

A company delegates the subdomain lab.example.com to an internal BIND 9 server. The parent zone on the external authoritative server contains NS records for lab.example.com pointing to ns1.lab.example.com, plus a glue A record. Internal clients query the external resolver and receive the delegation, but queries for host1.lab.example.com time out. The internal server's named.conf contains a zone statement for lab.example.com with type master and a valid zone file. Which condition MOST likely explains the timeout?

Accepted Answer

The internal server is not configured to allow queries from the external resolver's address.. When a delegation exists and the child server is authoritative with a valid zone file, a timeout usually means the child never answers the querying resolver. Restrictive allow-query settings on the internal server silently drop queries from the external resolver's address, producing timeouts while the parent delegation itself still works.

Answer

The internal server's zone file uses an SOA serial number lower than the parent zone's serial.

Answer

The external authoritative server needs a forward zone for lab.example.com to answer child queries.

Answer

The glue A record for ns1.lab.example.com is missing from the parent zone.