LPIC-2 Hard Questions — 25 Difficult Questions

Question 1

A system's root filesystem on /dev/sda1 is offline. The administrator boots into rescue mode and needs to check the filesystem integrity. Which command should be used first?

Accepted Answer

e2fsck -p /dev/sda1. `e2fsck -p` runs an automatic, non-interactive filesystem check on the ext2/ext3/ext4 filesystem, which is the safest first step when the root filesystem is offline and the administrator is in rescue mode. The `-p` flag automatically repairs any problems that can be safely fixed without user intervention, minimizing risk of further damage. This command is specifically designed for ext-family filesystems and is the recommended initial integrity check before attempting any manual repairs.

Answer

dumpe2fs /dev/sda1

Answer

fsck.ext4 -f /dev/sda1

Answer

fsck -N /dev/sda1

Question 2

Which sysctl parameter controls the system's behavior when a kernel oops occurs (e.g., automatically reboot)?

Accepted Answer

kernel.panic_on_oops. The `kernel.panic_on_oops` sysctl parameter controls the system's behavior when a kernel oops occurs. Setting it to 1 causes the kernel to panic on an oops, and if `kernel.panic` is also set to a positive value (e.g., seconds before reboot), the system will automatically reboot after the panic. This is the correct parameter for triggering a reboot on an oops.

Answer

vm.panic_on_oom

Answer

kernel.unknown_nmi_panic

Answer

kernel.oops

Question 3

Refer to the exhibit. Which kernel version will be booted by default when using a standard GRUB2 configuration that uses the symlinks vmlinuz and initrd.img?

Accepted Answer

5.10.0-9-amd64. In a standard GRUB2 configuration, the symlinks `vmlinuz` and `initrd.img` point to the latest installed kernel version. When GRUB2 generates its boot menu using `update-grub` (or `grub-mkconfig`), it reads these symlinks to create the default boot entry. Therefore, the default booted kernel is the one pointed to by these symlinks, which in this case is 5.10.0-9-amd64.

Answer

Depends on GRUB_DEFAULT setting, but if not set, it will boot the highest versioned kernel

Answer

It will prompt to choose between the two kernels

Answer

5.10.0-8-amd64

Question 4

An administrator configures iptables on a Linux firewall with the following rules: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT; -A INPUT -p tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT; -A INPUT -j DROP. Users report that SSH connections are being dropped. What is the most likely cause?

Accepted Answer

The SSH rule should have -m state --state NEW to allow new connections.. The most likely cause is that the SSH rule only matches packets that are already part of an established or related connection. New SSH connections start with a SYN packet that is in the NEW state, so they are not matched by the second rule. They fall through to the final DROP rule and are dropped. Adding `-m state --state NEW` (or `-m state --state NEW,ESTABLISHED,RELATED`) to the SSH rule would allow new connections. Option A is incorrect because the default INPUT policy is not relevant when explicit DROP exists; B confuses source and destination ports; D is wrong because reordering does not change the state matching logic.

Answer

The default INPUT policy is DROP, so the last rule is redundant but harmless.

Answer

The rule for SSH uses --dport 22, but the source port is randomized; it should use --sport 22.

Answer

The established/related rule should come after the SSH rule.

Question 5

Based on the smbstatus output, which statement is true?

Accepted Answer

User 'alice' connected from IP 192.168.1.10 using SMB3 protocol. The smbstatus output shows that user 'alice' is connected from IP address 192.168.1.10 and the 'Protocol' column explicitly lists 'SMB3_11', which is a variant of the SMB3 protocol. This directly matches the statement in option A that alice is using SMB3 protocol.

Answer

Both users are using SMB2 protocol

Answer

User 'bob' is accessing share2 with write permissions

Answer

User 'alice' has an exclusive lock on report.pdf

Question 6

Refer to the exhibit. The /data filesystem is nearly full. The administrator has added a new disk /dev/sdc with 10GB capacity. The VG currently has no free space. Which steps will increase the available space for /data using LVM and ext4?

Accepted Answer

pvcreate /dev/sdc; vgextend vg /dev/sdc; lvextend -l +100%FREE /dev/vg/data; resize2fs /dev/vg/data. It follows the proper LVM workflow: create a physical volume (pvcreate), add it to the volume group (vgextend), extend the logical volume using all free space in the VG (lvextend -l +100%FREE), and then resize the ext4 filesystem (resize2fs). This ensures the new 10GB disk is fully utilized for /data.

Answer

vgextend vg /dev/sdc; lvextend -L +10G /dev/vg/data; resize2fs /dev/vg/data

Answer

pvcreate /dev/sdc; lvextend -L +10G /dev/vg/data; resize2fs /dev/vg/data

Answer

pvcreate /dev/sdc; vgextend vg /dev/sdc; lvextend -l +50%FREE /dev/vg/data; resize2fs /dev/vg/data

Question 7

A Linux system administrator is tasked with upgrading the kernel on a server running a custom compiled kernel (version 4.19) with many in-house modules. The new kernel (5.10) has significant changes, including a different API for some module functions. After compiling the new kernel and the modules, the system boots but some modules fail to load with 'Unknown symbol' errors. The administrator needs to identify which symbols are missing and fix the modules. Which of the following is the most effective approach?

Accepted Answer

Run 'modprobe --dump-modversions mymodule.ko' and compare with 'cat /proc/kallsyms' to identify mismatches. `modprobe --dump-modversions mymodule.ko` displays the symbol version (CRC) checksums for each symbol the module uses, and comparing these with `/proc/kallsyms` (which lists all symbols exported by the running kernel along with their CRC values) directly pinpoints which symbols have mismatched versions. This is the most efficient method to identify 'Unknown symbol' errors caused by API changes between kernel 4.19 and 5.10, as it reveals exactly which symbols need updating in the module source code.

Answer

Check dmesg for each module load error and recompile modules one by one

Answer

Rename the missing symbols in the source code to match the new kernel's exported symbols

Answer

Use 'nm mymodule.ko' to list all symbols and manually compare with the kernel's symbol table

Question 8

An administrator notices that an NFS mount on a client becomes unresponsive when the NFS server goes offline. The admin wants the mount to return an error to the application after a short timeout instead of hanging indefinitely. Which mount option should be added to the fstab entry?

Accepted Answer

soft. The `soft` mount option causes the NFS client to return an error to the application after a short timeout (typically 60 seconds by default) if the NFS server becomes unresponsive, rather than hanging indefinitely. This is the correct choice because the administrator specifically wants the mount to return an error after a short timeout instead of hanging.

Answer

intr

Answer

bg

Answer

hard

Question 9

A Samba server is configured with 'security = ads' and joined to an Active Directory domain. Users can authenticate but cannot access shares. The smb.conf includes 'winbind use default domain = yes'. What could be the problem?

Accepted Answer

The 'valid users' parameter uses domain prefix while default domain is set. When 'winbind use default domain = yes' is set, Winbind strips the domain prefix from usernames, so users authenticate as 'username' instead of 'DOMAIN\username'. If the 'valid users' parameter in a share definition explicitly uses the domain prefix (e.g., 'valid users = DOMAIN\username'), the stripped username will not match, and access is denied. This mismatch is the most direct cause of authentication succeeding but share access failing.

Answer

The 'winbind use default domain' option should be 'no'

Answer

The 'idmap backend' is not configured

Answer

The Samba server's time is not synchronized with the domain controller

Question 10

A Samba server experiences slow file transfers for large files. The administrator suspects oplock issues. Which set of parameters should be adjusted to disable opportunistic locking?

Accepted Answer

oplocks = no and level2 oplocks = no. Disabling opportunistic locking (oplocks) in Samba requires setting both 'oplocks = no' and 'level2 oplocks = no'. The 'oplocks = no' directive disables exclusive oplocks, but Samba's default behavior still allows level2 oplocks (read-only caching). To fully disable all forms of oplock caching, both parameters must be set to 'no', preventing client-side caching that can cause conflicts and slow transfers for large files.

Answer

oplocks = false alone is sufficient

Answer

strict locking = yes

Answer

kernel oplocks = no

Question 11

Refer to the exhibit. What is the most likely cause of this Apache error?

Accepted Answer

The semaphore limit for the Apache user is exceeded.. The Apache error 'semaphore limit exceeded' occurs when the number of semaphores allocated to the Apache user exceeds the system-wide or per-user semaphore limit. Apache uses semaphores for inter-process communication (IPC) in its prefork or worker MPMs to coordinate child processes. The correct answer is C because this error directly indicates that the kernel's semaphore limits (e.g., `SEMMSL`, `SEMMNS`, or `SEMOPM` in `/proc/sys/kernel/sem`) have been exhausted for the Apache user, often due to too many child processes or a misconfigured `MaxClients` directive.

Answer

The filesystem containing the logs is full.

Answer

The server is out of memory.

Answer

The RewriteMap file specified is missing.

Question 12

A database server experiences performance degradation. Analysis shows high I/O wait on a LVM logical volume that uses striping across two physical volumes. What is the most effective way to improve performance?

Accepted Answer

Add a cache layer using lvmcache on a fast SSD. Adding a cache layer using lvmcache on a fast SSD is the most effective way to reduce high I/O wait because it places frequently accessed (hot) data on the faster SSD while keeping the bulk of data on the slower striped HDDs. This directly addresses the I/O bottleneck without requiring data migration or downtime, and it leverages the existing striped layout for sequential throughput while improving latency for random reads/writes.

Answer

Increase the stripe size and recreate the LV

Answer

Add an additional PV to the VG and extend the LV

Answer

Convert the LV to use linear mapping instead of striping

Question 13

Which three PAM modules can be used to enforce password complexity? (Select three.)

Accepted Answer

pam_passwdqc.so. pam_passwdqc.so, pam_pwquality.so, and pam_cracklib.so are all PAM modules specifically designed to enforce password complexity policies, such as requiring a mix of character types, minimum length, or rejecting weak passwords. pam_passwdqc.so uses a configurable password quality checking framework, pam_pwquality.so (the successor to pam_cracklib.so) provides similar checks via the libpwquality library, and pam_cracklib.so (the original module) performs dictionary checks and complexity rules. These modules are typically stacked in the password authentication stack to validate new passwords against defined policies.

Answer

pam_securetty.so

Answer

pam_unix.so

Question 14

An administrator configures an NIS client by running 'ypbind' and updating /etc/nsswitch.conf to include 'nis' for passwd, shadow, and group. However, 'getent passwd' still shows only local users. Which step is most likely missing?

Accepted Answer

Edit /etc/yp.conf to specify the NIS server's domain and address.. The NIS client must know which NIS server to contact for domain information. This is configured in /etc/yp.conf, which specifies the NIS domain name and the server's hostname or IP address. Without this file, ypbind cannot locate a server, so getent falls back to local sources despite nsswitch.conf listing 'nis'.

Answer

Restart the ypserv service on the client.

Answer

Execute 'yppasswd' to initialize NIS client.

Answer

Run 'make -C /var/yp' on the client.

Question 15

A Linux router running multiple routing tables is misconfigured. The administrator wants to add a policy routing rule that sends all traffic from subnet 10.10.0.0/16 to routing table 200. Which command should be used?

Accepted Answer

ip rule add from 10.10.0.0/16 table 200. The `ip rule` command is used to add policy routing rules in Linux, which direct packets to specific routing tables based on criteria like source address. The `from` parameter specifies the source subnet (10.10.0.0/16), and `table 200` directs matching traffic to routing table 200, enabling policy-based routing beyond the default table.

Answer

route add -net 10.10.0.0/16 table 200

Answer

iptables -A FORWARD -s 10.10.0.0/16 -j table 200

Answer

ip route add 10.10.0.0/16 dev eth0 table 200

Question 16

A system administrator has compiled a custom Linux kernel (version 5.15.19) with ext4 filesystem support built as a module. The administrator installed the kernel to /boot and built an initramfs using dracut with default options. After rebooting, the system fails with a kernel panic: 'VFS: Unable to mount root fs on unknown-block(0,0)'. The administrator confirms that the root partition is /dev/sda1 formatted as ext4 and that the kernel configuration includes the ext4 module. The kernel command line includes 'root=/dev/sda1' and 'rd.auto'. The administrator also notices that the initramfs file is only 5 MB in size, which seems smaller than expected. Which of the following is the most likely cause and best solution?

Accepted Answer

The initramfs is missing the ext4 module because dracut did not include it. The administrator should run 'dracut --force --add-drivers ext4 /boot/initramfs-5.15.19.img 5.15.19' to regenerate the initramfs including the ext4 module.. The initramfs is only 5 MB, which is too small to contain the ext4 kernel module and its dependencies. Dracut with default options may not automatically include modules for the root filesystem if they are not already loaded or detected during initramfs generation. Running 'dracut --force --add-drivers ext4' explicitly forces the ext4 module into the initramfs, ensuring the kernel can mount the root filesystem during boot.

Answer

The kernel command line needs the 'rd.shell' parameter to allow interactive debugging. The administrator should add 'rd.shell' to the kernel parameter and boot again to investigate.

Answer

The root filesystem label or UUID is incorrect. The administrator should change the kernel command line to use 'root=LABEL=root' or 'root=UUID=...'.

Answer

The kernel is missing the ext4 module because it was not compiled. The administrator should recompile the kernel with ext4 compiled directly into the kernel (y) instead of as a module.

Question 17

A mail server running Postfix is deferring messages for a local user. The mail log shows 'status=deferred (mailbox is locked)'. What is the most likely cause?

Accepted Answer

The user's mailbox is currently being accessed by a POP3 client.. The 'mailbox is locked' message in Postfix logs indicates that the mailbox file is currently locked by another process, typically a POP3 or IMAP client that has the mailbox open for exclusive access. Postfix defers delivery because it cannot acquire the necessary lock to write to the mailbox, ensuring data integrity. This is a standard behavior defined by the mailbox locking mechanism (e.g., fcntl, dotlock) used by the MTA and MDA.

Answer

The filesystem containing the mail spool is out of inodes.

Answer

The disk quota for the user has been exceeded.

Answer

The Postfix process lacks write permission to the mailbox.

Question 18

A database server uses LVM with an XFS filesystem on /dev/vg_data/lv_db, mounted at /var/lib/mysql. The LV is at 95% capacity. A new 50GB disk /dev/sdd has been added and initialized as a physical volume, then added to the volume group vg_data. The database is running and cannot be stopped. The administrator must extend the LV and filesystem. What is the correct course of action?

Accepted Answer

Run `lvextend -L +50G /dev/vg_data/lv_db` followed by `xfs_growfs /var/lib/mysql`.. XFS filesystems must be grown while mounted using `xfs_growfs` with the mount point as the argument, not the block device. Since the database cannot be stopped, the LV can be extended online with `lvextend`, and then `xfs_growfs /var/lib/mysql` resizes the filesystem to fill the expanded LV without requiring unmounting or downtime.

Answer

Run `lvextend -L +50G /dev/vg_data/lv_db` followed by `resize2fs /dev/vg_data/lv_db`.

Answer

Unmount /var/lib/mysql, run `lvextend -L +50G /dev/vg_data/lv_db`, run `resize2fs /dev/vg_data/lv_db`, then remount.

Answer

Run `lvresize -L +50G /dev/vg_data/lv_db`.

Question 19

A user reports that they cannot SSH to a remote server using the usual command 'ssh user@remote.example.com'. The administrator tests and gets 'Permission denied (publickey,gssapi-keyex,gssapi-with-mic)'. The user's public key is in ~/.ssh/authorized_keys on the remote server. The local client has the matching private key. Which step should the administrator take to resolve the issue?

Accepted Answer

Check /var/log/auth.log on the remote server to see why the key was rejected.. The error message indicates that the SSH server rejected all offered authentication methods, including publickey. Since the user's public key is in the remote server's authorized_keys file and the client has the matching private key, the most likely cause is a file permission or SELinux/AppArmor issue on the remote server, or a key format mismatch. Checking /var/log/auth.log on the remote server will show the exact reason for the rejection, such as 'bad permissions' or 'key not recognized', allowing targeted troubleshooting.

Answer

Generate a new RSA key pair on the client with ssh-keygen.

Answer

Run 'ssh-add' to add the private key to the SSH agent.

Answer

Restart the sshd service on the client.

Question 20

Traffic from the 10.1.1.0/24 subnet is seen leaving through eth1 as intended, but reply traffic from the internet never comes back. What is the most likely cause?

Accepted Answer

The kernel parameter net.ipv4.conf.all.rp_filter is set to 1.. When `net.ipv4.conf.all.rp_filter` is set to 1, the kernel performs strict reverse path filtering. This means the kernel checks whether the source address of incoming packets can be reached via the interface they arrived on. If reply traffic from the internet arrives on an interface (e.g., eth0) that does not have a route back to the original source subnet (10.1.1.0/24) through that same interface, the kernel drops the packet. This is the most likely cause because the outbound traffic leaves via eth1, but the reply comes back on a different interface, triggering the rp_filter check and causing the reply to be silently discarded.

Answer

The ip rule priority is not set, causing it to be overridden.

Answer

The default route in table 200 points to 172.16.0.1 which does not have a route back to 10.1.1.0/24.

Answer

The router does not have a route back to 10.1.1.0/24 via eth0.