LPIC-2 Hard Questions — 25 Difficult Questions

Question 1

A systems administrator is troubleshooting a server that fails to boot after a kernel upgrade. The boot process hangs at the stage where the kernel attempts to mount the root filesystem. Which of the following is the most likely cause?

Accepted Answer

The root= parameter in the kernel command line points to a non-existent device.. When the kernel fails to mount the root filesystem during boot, the most common cause is an incorrect or missing `root=` parameter in the kernel command line. This parameter specifies the device (e.g., `/dev/sda1` or `UUID=...`) that the kernel should mount as the root filesystem; if it points to a non-existent device, the kernel cannot proceed past the mount stage, resulting in a hang or kernel panic.

Answer

The root filesystem is formatted with an unsupported filesystem type.

Answer

The initrd image is missing from the /boot partition.

Answer

The GRUB bootloader is not installed on the MBR.

Question 2

An administrator is designing a high-availability storage solution using DRBD. The requirement is to have two nodes with synchronous replication and automatic failover in case of primary node failure. Which configuration best achieves this?

Accepted Answer

DRBD in Primary/Primary mode managed by Pacemaker cluster stack.. Option D is correct because DRBD in Primary/Primary mode, managed by the Pacemaker cluster stack, provides synchronous replication and automatic failover. Pacemaker monitors node health and can promote the secondary node to primary automatically upon primary failure, meeting the high-availability requirement without manual intervention.

Answer

Export the DRBD block device via NFS and use a load balancer.

Answer

Primary/Secondary DRBD resource with manual failover using drbdadm.

Answer

DRBD with Heartbeat to automatically promote the secondary on primary failure.

Question 3

A client on the internet sends a TCP SYN packet to 10.0.1.10:8080. The router receives it on eth0. According to the exhibit, what will happen to the packet?

Accepted Answer

The packet is forwarded to 10.0.2.5:80 via eth1, with source IP unchanged.. The router receives the TCP SYN packet on eth0 destined for 10.0.1.10:8080. According to the exhibit (not shown but implied), a destination NAT (DNAT) rule is configured to translate the destination IP and port to 10.0.2.5:80. The packet is forwarded out eth1 with the destination changed, but the source IP remains unchanged because DNAT does not modify the source address. This is a standard port forwarding scenario.

Answer

The packet is dropped because the destination IP is not directly connected.

Answer

The packet is forwarded to 10.0.1.1 because it is the default gateway.

Answer

The packet is forwarded to 10.0.2.5:80 via eth1, with source IP changed to 10.0.2.20.

Question 4

Which TWO statements are true regarding BIND DNS server security? (Choose two.)

Accepted Answer

The 'allow-recursion' ACL can be used to restrict which clients can use the server's recursive lookup feature.. Option B is correct because the 'allow-recursion' ACL in BIND explicitly controls which clients are permitted to use the server's recursive query feature. By restricting recursion to trusted clients, the server avoids being used in amplification attacks and reduces exposure to cache poisoning. This ACL is defined in the options block or per-zone and can reference address match lists or named ACLs.

Answer

The 'allow-transfer' ACL is used to restrict which clients can perform recursive queries.

Answer

The 'blackhole' ACL can be used to prevent cache poisoning attacks.

Answer

The 'forwarders' option can be used to disable recursion entirely.

Question 5

A Samba server is configured as a print server. Clients running Windows 10 report that printer drivers cannot be uploaded. The relevant smb.conf section is:

[printers]
comment = All Printers
path = /var/spool/samba
browseable = no
printable = yes

What is the most likely cause?

Accepted Answer

The 'guest ok = yes' directive is missing. The 'printable = yes' directive is present, so option A is not the issue. The 'path' /var/spool/samba is the standard spool directory for Samba print jobs, so option B is incorrect. The 'browseable = no' only hides the share from browsing, but does not prevent driver uploads; Windows clients can still connect directly. The most likely cause is that 'guest ok = yes' is missing, because by default Samba requires authentication for printer shares, and Windows 10 clients attempting to upload drivers often do so under the guest account (or without valid credentials) unless the share explicitly allows guest access. Without 'guest ok = yes', the upload is denied.

Answer

The 'printable = yes' directive is missing

Answer

The 'path' is incorrectly set to /var/spool/samba

Answer

The 'browseable = no' directive prevents driver discovery

Question 6

A Linux workstation must be configured to automatically mount an NFS share from server nfs.example.com:/exports/data at boot time. The share should be mounted with noexec and nosuid options. Which line should be added to /etc/fstab?

Accepted Answer

nfs.example.com:/exports/data /mnt/data nfs noexec,nosuid,_netdev 0 0. Option B is correct because it specifies the NFS filesystem type, includes the required mount options (noexec, nosuid, _netdev), and uses the correct fstab format. The _netdev option is critical for network filesystems to ensure the system waits for network availability before attempting the mount at boot time.

Answer

nfs.example.com:/exports/data /mnt/data nfs noexec,nosuid,_netdev 0 0

Answer

nfs.example.com:/exports/data /mnt/data auto noexec,nosuid,_netdev 0 0

Answer

nfs.example.com:/exports/data /mnt/data nfs4 noexec,nosuid 0 0

Question 7

An administrator is reviewing the audit rules on a Linux server. The current rules are shown in the exhibit. The administrator needs to ensure that any failed attempts to open files are logged, while also monitoring for successful outbound connections. Which of the following describes the effect of the current rules?

Accepted Answer

The first rule logs only failed openat calls, and the second rule logs all connect calls.. The first rule uses the `-F exit=-EACCES` filter, which matches only failed `openat` calls (those returning the EACCES error). The second rule uses `-S connect` without an exit filter, so it logs all `connect` syscalls regardless of success or failure. Therefore, option A correctly describes the effect: failed openat calls and all connect calls are logged.

Answer

The first rule logs only successful openat calls, and the second rule logs only failed connect calls.

Answer

The first rule logs all openat calls, and the second rule logs all connect calls.

Answer

The first rule logs only failed openat calls, and the second rule logs only failed connect calls.

Question 8

Based on the exhibit, which command would change the DNS server to 1.1.1.1 for the connection MyConnection?

Accepted Answer

nmcli con mod MyConnection ipv4.dns 1.1.1.1. Option B is correct because the `nmcli con mod` command modifies an existing connection profile, and the `ipv4.dns` property sets the DNS server for IPv4. The property name is case-sensitive and must be lowercase `ipv4.dns` as per NetworkManager's D-Bus API. This command replaces any existing DNS servers with the specified value.

Answer

nmcli con mod MyConnection IP4.DNS 1.1.1.1

Answer

nmcli dev mod eth0 ipv4.dns 1.1.1.1

Answer

nmcli con mod MyConnection +ipv4.dns 1.1.1.1

Question 9

A Linux router running multiple routing tables is misconfigured. The administrator wants to add a policy routing rule that sends all traffic from subnet 10.10.0.0/16 to routing table 200. Which command should be used?

Accepted Answer

ip rule add from 10.10.0.0/16 table 200. Option B is correct because the `ip rule` command is used to add policy routing rules in Linux, which direct packets to specific routing tables based on criteria like source address. The `from` parameter specifies the source subnet (10.10.0.0/16), and `table 200` directs matching traffic to routing table 200, enabling policy-based routing beyond the default table.

Answer

route add -net 10.10.0.0/16 table 200

Answer

iptables -A FORWARD -s 10.10.0.0/16 -j table 200

Answer

ip route add 10.10.0.0/16 dev eth0 table 200

Question 10

An administrator is troubleshooting network isolation in a Linux container environment. The container should have its own network stack, but it appears to be using the host's interfaces. Which command correctly runs a command inside a network namespace named 'ns1' to verify its network configuration?

Accepted Answer

ip netns exec ns1 ip addr show. Option B is correct because the `ip netns exec` command is specifically designed to execute a command within a given network namespace. In this scenario, `ip netns exec ns1 ip addr show` runs the `ip addr show` command inside the network namespace named 'ns1', allowing the administrator to verify that the container has its own network stack and is not using the host's interfaces.

Answer

nsenter -t 1234 -n ip addr show

Answer

unshare -n ip addr show

Answer

ip netns add ns1

Question 11

A Samba server experiences slow file transfers for large files. The administrator suspects oplock issues. Which set of parameters should be adjusted to disable opportunistic locking?

Accepted Answer

oplocks = no and level2 oplocks = no. Option D is correct because disabling opportunistic locking (oplocks) in Samba requires setting both 'oplocks = no' and 'level2 oplocks = no'. The 'oplocks = no' directive disables exclusive oplocks, but Samba's default behavior still allows level2 oplocks (read-only caching). To fully disable all forms of oplock caching, both parameters must be set to 'no', preventing client-side caching that can cause conflicts and slow transfers for large files.

Answer

oplocks = false alone is sufficient

Answer

strict locking = yes

Answer

kernel oplocks = no

Question 12

A Samba server is experiencing slow authentication for domain users. The logs show repeated winbind connections to the domain controllers. The administrator suspects that winbind is not caching credentials properly. Which parameter should be checked or increased to improve caching?

Accepted Answer

winbind cache time. The `winbind cache time` parameter controls how long winbindd caches user and group information retrieved from domain controllers. Increasing this value reduces the frequency of authentication requests to the DCs, improving performance. The default is 300 seconds; a higher value (e.g., 900 or 1800) can significantly reduce repeated connections.

Answer

winbind rpc only

Answer

winbind offline logon

Answer

winbind request timeout

Question 13

A company is migrating from a workgroup environment to an Active Directory domain. The Samba server is already configured as a domain member using winbind. The administrator wants to ensure that files created by domain users on the Samba server are owned by the corresponding UNIX user accounts derived from the domain. Which idmap backend and configuration is recommended for this purpose?

Accepted Answer

idmap config * : backend = rid. Option D is correct because the 'rid' backend uses the RID of domain users to generate consistent UNIX IDs without a mapping database, which is simple and common. Option A is wrong because 'tdb' is for local mapping, not consistent across machines. Option B is wrong because 'ad' requires RFC2307 schema in AD. Option C is wrong because 'autorid' is for multiple domains but may not provide consistent IDs.

Answer

idmap config * : backend = ad

Answer

idmap config * : backend = tdb

Answer

idmap config * : backend = autorid

Question 14

A user reports that an external USB hard drive is not detected when plugged in. The system uses a standard kernel with USB support. What is the most likely reason?

Accepted Answer

The usb_storage module is blacklisted.. Option B is correct because the blacklist.conf file prevents the usb_storage module from loading, which is required for USB mass storage devices. The module is installed but not loaded due to blacklisting.

Answer

The USB driver is not installed.

Answer

The external drive is incompatible.

Answer

The kernel lacks USB support.

Question 15

Which THREE kernel boot parameters can be added to the GRUB command line to enable verbose debug output during boot? (Choose three.)

Accepted Answer

debug. The `debug` kernel boot parameter enables verbose debug output from the kernel during boot, printing extensive diagnostic messages. It is a valid parameter that can be added to the GRUB command line to increase verbosity for troubleshooting.

Answer

verbose

Answer

quiet

Question 16

An administrator needs to ensure a kernel module is never loaded, even if requested. Which file should be used?

Accepted Answer

/etc/modprobe.d/blacklist.conf. Option B is correct because the standard mechanism to prevent a kernel module from loading is to add a `blacklist` directive in a file under `/etc/modprobe.d/`, typically named `blacklist.conf`. The `modprobe` utility reads all `.conf` files in this directory, and a `blacklist <module_name>` entry ensures the module is never automatically loaded or loaded via `modprobe`, even if explicitly requested.

Answer

/etc/modprobe.d/deny.conf

Answer

/lib/modprobe.d/blacklist.conf

Answer

/etc/modules-load.d/blacklist.conf

Question 17

A technician is troubleshooting a system that fails to boot after adding a new SATA SSD and editing /etc/fstab. The error message is 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(8,17)'. What is the most likely issue?

Accepted Answer

The root filesystem UUID in /etc/fstab is incorrect.. The error 'unknown-block(8,17)' indicates the kernel cannot find the root filesystem. Block device 8,17 corresponds to /dev/sdb1 (major 8 for SCSI/SATA, minor 17). The most likely cause is an incorrect UUID in /etc/fstab, which prevents the system from mounting the root partition. The kernel can see the device, but the mount fails because the UUID specified does not match any available partition.

Answer

The kernel image is missing.

Answer

The kernel lacks SATA driver support.

Answer

The initramfs was not regenerated after adding the disk.

Question 18

Which TWO statements about LVM thin provisioning are correct?

Accepted Answer

It allows creating logical volumes that can be larger than the available physical storage.. Option B is correct because LVM thin provisioning allows creating logical volumes that appear larger than the available physical storage (overcommitment). This is achieved by allocating data blocks on demand from a thin pool, rather than reserving them at creation time. The thin pool itself must have sufficient physical storage to accommodate actual writes, but the logical volume size can exceed the pool's capacity.

Answer

Thin pools automatically extend when they reach 80% usage.

Answer

A thin pool cannot be extended once created.

Answer

It is only supported on SSDs.

Question 19

An organization uses LDAP for centralized authentication. The /etc/nsswitch.conf contains 'passwd: files ldap' and 'shadow: files ldap'. The /etc/pam.d/system-auth includes 'auth requisite pam_ldap.so' and 'account required pam_ldap.so'. However, users can log in using local accounts but not LDAP accounts. The ldapsearch command works correctly against the LDAP server. Logs show 'pam_ldap: error trying to bind as user (No such object)'. Which configuration change is most likely needed?

Accepted Answer

Ensure /etc/ldap.conf contains a valid 'binddn' and 'bindpw' for the search user.. The error 'pam_ldap: error trying to bind as user (No such object)' indicates that PAM LDAP cannot find the user entry in the LDAP directory. This typically occurs because the binddn (the search user) specified in /etc/ldap.conf is incorrect or missing, preventing PAM from performing the initial search to locate the user's DN. Since ldapsearch works manually, the LDAP server is reachable, but the PAM module lacks the credentials to bind and search for users.

Answer

Open TCP port 389 on the client firewall.

Answer

Add 'uri ldaps://ldap.example.com' to /etc/ldap.conf.

Answer

Restart the nscd service.

Question 20

An administrator is configuring a BIND 9 DNS server to support DNSSEC for the zone 'example.com'. The zone is signed using the NSEC3 algorithm. Which TWO statements are correct regarding the configuration and operation of NSEC3?

Accepted Answer

The NSEC3 record uses the 'opt-out' flag to allow insecure delegations to exist without being covered by NSEC3 records.. Option B is correct because the NSEC3 specification (RFC 5155) includes an 'opt-out' flag that allows insecure delegations (i.e., delegations that are not signed with DNSSEC) to exist in a zone without requiring corresponding NSEC3 records. This prevents the zone from being forced to cover every possible owner name, reducing the size of the signed zone and improving performance when many unsigned delegations are present.

Answer

NSEC3 records are stored in the zone in plain text order to allow efficient denial of existence.

Answer

The NSEC3 record type is NXT and is used to provide authenticated denial of existence.

Answer

NSEC3 uses SHA-256 as the default hash algorithm.