LPIC-2 DNS, Web and Mail Services — Timed 15 Questions

Question 1

A company's mail server (Postfix) is rejecting incoming emails from a trusted partner with the error '550 5.7.1 Service unavailable; Client host [203.0.113.50] blocked using zen.spamhaus.org'. The partner's IP is not listed on any public DNSBL. What is the most likely cause?

Accepted Answer

The partner's SMTP server does not have a valid PTR record for its IP, and Postfix has reject_unknown_client_hostname enabled.. The error message explicitly states the block is from zen.spamhaus.org, a public DNSBL. However, the partner's IP is not listed on any public DNSBL. This contradiction suggests the block is actually due to Postfix's reject_unknown_client_hostname restriction, which checks for a valid PTR record. When the PTR record is missing or does not match the connecting IP, Postfix may log a generic DNSBL-style error if the administrator has misconfigured the restriction to use a DNSBL-like check, or the error message is misleading. Option D is correct because a missing or invalid PTR record triggers this rejection, not a DNSBL listing.

Answer

The partner's SPF record is misconfigured, causing Postfix to reject the email.

Answer

The partner's IP is listed on a local DNSBL that is aggregated with zen.spamhaus.org.

Answer

The mail server is using greylisting and the partner's server has not retried.

Question 2

An administrator needs to configure a BIND DNS server to allow dynamic updates from a specific subnet (192.168.1.0/24) for the zone 'example.com'. The administrator must also ensure that the zone file is updated immediately after a dynamic update. Which configuration accomplishes this?

Accepted Answer

zone "example.com" { type master; file "db.example.com"; allow-update { 192.168.1.0/24; }; };. Option C is correct because the `allow-update` statement in BIND explicitly permits dynamic DNS updates (RFC 2136) from specified sources, such as the subnet 192.168.1.0/24. Dynamic updates are written to the zone file immediately by default when using a master zone, ensuring the file is updated in real time.

Answer

zone "example.com" { type master; file "db.example.com"; update-policy { grant 192.168.1.0/24 zonesub ANY; }; };

Answer

zone "example.com" { type master; file "db.example.com"; allow-transfer { 192.168.1.0/24; }; };

Answer

zone "example.com" { type master; file "db.example.com"; also-notify { 192.168.1.0/24; }; };

Question 3

A web server running Apache httpd is experiencing high load. The administrator suspects that many requests are for non-existent virtual hosts. Which configuration change would reduce the load caused by these requests?

Accepted Answer

Define a default virtual host that returns a 444 status code.. Option A is correct because defining a default virtual host that returns a 444 status code (a non-standard Apache code meaning 'Connection closed without response') immediately terminates the connection for requests to non-existent virtual hosts. This prevents Apache from wasting resources on DNS lookups, logging, and content generation for invalid hostnames, directly reducing load from such requests.

Answer

Enable logging for all virtual hosts to identify the source of requests.

Answer

Increase the MaxClients directive to allow more concurrent connections.

Answer

Disable KeepAlive to reduce the number of requests per connection.

Question 4

A company runs a Postfix mail server that relays mail for internal clients. Users report that emails to a specific external domain 'example.org' are delayed by several hours. The administrator checks the mail logs and sees entries like: 'status=deferred (connect to mx.example.org[203.0.113.10]:25: Connection timed out)'. What is the most likely cause?

Accepted Answer

The remote mail server mx.example.org is blocking connections from the company's mail server IP.. The log entry 'Connection timed out' indicates that the company's Postfix server successfully resolved the MX record for example.org to the IP 203.0.113.10 but could not establish a TCP connection to port 25 on that host. This is consistent with the remote server explicitly blocking inbound connections from the company's IP, often via a firewall rule or access control list, rather than a DNS or rate-limiting issue.

Answer

The company's mail server is not authorized to relay mail for the internal clients, causing a deferral.

Answer

The DNS MX record for example.org is misconfigured, pointing to a non-existent host.

Answer

The remote server is rate limiting connections from the company's mail server.

Question 5

Which TWO statements are true regarding BIND DNS server security? (Choose two.)

Accepted Answer

The 'allow-recursion' ACL can be used to restrict which clients can use the server's recursive lookup feature.. Option B is correct because the 'allow-recursion' ACL in BIND explicitly controls which clients are permitted to use the server's recursive query feature. By restricting recursion to trusted clients, the server avoids being used in amplification attacks and reduces exposure to cache poisoning. This ACL is defined in the options block or per-zone and can reference address match lists or named ACLs.

Answer

The 'allow-transfer' ACL is used to restrict which clients can perform recursive queries.

Answer

The 'blackhole' ACL can be used to prevent cache poisoning attacks.

Answer

The 'forwarders' option can be used to disable recursion entirely.

Question 6

You are the administrator of a medium-sized company that runs its own authoritative DNS servers for the domain 'company.com'. The primary DNS server is a BIND9 master, and there are two slaves. Recently, you updated the zone file on the master to add a new subdomain 'lab.company.com' with an A record pointing to 10.0.0.10. After the update, you increased the serial number and ran 'rndc reload'. However, after several hours, some external clients report that they cannot resolve 'lab.company.com'. You check the master server and find that the zone file contains the new record. You also check the slave servers and find that they still have the old zone data. The serial number on the master is 2025011501, while the slaves show 2025011400. The master's syslog shows no errors. The slaves' syslogs show 'zone company.com/IN: Transfer started.' but no completion messages. Firewall rules allow TCP and UDP port 53 between all DNS servers. What should you do to resolve the issue?

Accepted Answer

Run 'rndc notify company.com' on the master to force sending NOTIFY messages to the slaves.. Option D is correct because the master's syslog shows no errors and the slaves' logs indicate a transfer started but never completed, which suggests the NOTIFY messages were sent but the slaves may have missed or ignored them due to a transient issue. Running 'rndc notify company.com' forces the master to re-send NOTIFY messages to all configured slaves, prompting them to initiate a zone transfer immediately, which should update the stale zone data on the slaves.

Answer

Check the 'allow-transfer' ACL on the master; it might be restricting transfers to the slaves.

Answer

Increase the serial number again on the master to a higher value and wait for the slaves to refresh.

Answer

Restart the BIND service on the slave servers.

Question 7

An administrator is configuring a BIND 9 DNS server to support DNSSEC for the zone 'example.com'. The zone is signed using the NSEC3 algorithm. Which TWO statements are correct regarding the configuration and operation of NSEC3?

Accepted Answer

The NSEC3 record uses the 'opt-out' flag to allow insecure delegations to exist without being covered by NSEC3 records.. Option B is correct because the NSEC3 specification (RFC 5155) includes an 'opt-out' flag that allows insecure delegations (i.e., delegations that are not signed with DNSSEC) to exist in a zone without requiring corresponding NSEC3 records. This prevents the zone from being forced to cover every possible owner name, reducing the size of the signed zone and improving performance when many unsigned delegations are present.

Answer

NSEC3 records are stored in the zone in plain text order to allow efficient denial of existence.

Answer

The NSEC3 record type is NXT and is used to provide authenticated denial of existence.

Answer

NSEC3 uses SHA-256 as the default hash algorithm.

Question 8

A small company runs a LAMP stack web server with Postfix mail server on a single Ubuntu 22.04 instance. The web server hosts a PHP application that sends password reset emails via the local mail server using PHP's mail() function. Recently, users report that password reset emails are not arriving. The administrator checks the mail log and finds that messages are being accepted by Postfix but are not being delivered. The mail queue shows messages with the status 'deferred'. There are no obvious errors in the mail log. The server has sufficient disk space and memory. The administrator suspects a DNS resolution issue. Which of the following is the most likely cause of the deferred mail?

Accepted Answer

The DNS resolver on the server is unable to resolve the MX records for the recipient domains.. Postfix accepts the messages but defers delivery when it cannot resolve the recipient domain's MX record. The mail log shows no errors because the deferral is a normal queue action, not a failure. DNS resolution failure for MX records is a common cause of deferred mail, as Postfix cannot determine where to deliver the message.

Answer

The server's firewall is blocking outbound connections on port 25, causing connection timeouts.

Answer

The SPF record for the sender domain is missing, causing the recipient's mail server to reject the email.

Answer

The server's IP address has no PTR record, causing the recipient's mail server to reject the connection.

Question 9

Order the steps to configure a Linux system to use LDAP for authentication.

Question 10

Match each kernel parameter to its effect.

Question 11

A company uses BIND9 as the authoritative name server for its public zone example.com. External users report that they cannot resolve the MX record for the domain, but internal users can. What is the most likely cause?

Accepted Answer

The allow-query ACL restricts queries to the internal network.. Option B is correct because the allow-query ACL in BIND9 restricts which source IP addresses are permitted to send queries to the server. If it is set to allow only the internal network (e.g., 192.168.0.0/16), external users' queries are rejected, causing resolution failures for MX records and all other records. Internal users succeed because their IPs match the ACL, while external users receive a REFUSED response or no answer.

Answer

The zone file lacks an MX record.

Answer

The server is behind a firewall that blocks UDP port 53.

Answer

The recursion is set to no.

Question 12

A mail server running Postfix is deferring messages for a local user. The mail log shows 'status=deferred (mailbox is locked)'. What is the most likely cause?

Accepted Answer

The user's mailbox is currently being accessed by a POP3 client.. The 'mailbox is locked' message in Postfix logs indicates that the mailbox file is currently locked by another process, typically a POP3 or IMAP client that has the mailbox open for exclusive access. Postfix defers delivery because it cannot acquire the necessary lock to write to the mailbox, ensuring data integrity. This is a standard behavior defined by the mailbox locking mechanism (e.g., fcntl, dotlock) used by the MTA and MDA.

Answer

The filesystem containing the mail spool is out of inodes.

Answer

The disk quota for the user has been exceeded.

Answer

The Postfix process lacks write permission to the mailbox.

Question 13

Which Apache module is used to rewrite URLs based on rules?

Accepted Answer

mod_rewrite. mod_rewrite is the correct Apache module for rewriting URLs based on rules. It uses a regular expression engine to match incoming request URIs against patterns defined in .htaccess or server configuration files, then transforms them according to specified substitution rules. This module is essential for creating clean URLs, redirecting traffic, and implementing URL-based access control.

Answer

mod_proxy

Answer

mod_alias

Answer

mod_redirect

Question 14

A DNS administrator wants to implement DNSSEC on an authoritative zone. Which TWO resource records are essential for DNSSEC?

Accepted Answer

DNSKEY. DNSKEY and RRSIG are the two essential resource records for DNSSEC. The DNSKEY record holds the public signing key, while the RRSIG record contains the digital signature for each RRset, allowing resolvers to verify authenticity and integrity of the zone data.

Answer

NSEC

Answer

A

Answer

SOA

Question 15

A mail administrator is configuring Postfix to use SASL authentication for incoming connections. Which THREE parameters must be set in main.cf?

Accepted Answer

smtpd_sasl_security_options. B is correct because `smtpd_sasl_security_options` controls which SASL security mechanisms are allowed for the Postfix SMTP server (e.g., `noanonymous` to reject anonymous logins). This parameter is essential for enforcing authentication policy when SASL is enabled.

Answer

smtpd_tls_auth_only

Answer

smtp_sasl_auth_enable