LPIC-2 Timed Hard Questions — 25 Difficult Questions

Question 1

A company runs a web application on a Linux server that uses Apache, MySQL, and PHP. The application stores sensitive user data in a MySQL database. The security team has detected that the MySQL service is listening on port 3306 on all interfaces (0.0.0.0). The application and database are on the same server, so there is no need for remote database access. The administrator must secure the MySQL service without breaking the application. Which of the following is the most appropriate course of action?

15 minute time limit — choose an answer to begin.

Accepted Answer

Edit the MySQL configuration file (my.cnf) and set bind-address = 127.0.0.1, then restart the MySQL service.. Setting bind-address = 127.0.0.1 in the MySQL configuration file (my.cnf) instructs the MySQL server to listen only on the loopback interface, which prevents remote connections while still allowing local applications (Apache/PHP) to connect via the local socket or TCP to 127.0.0.1. This directly addresses the security concern of exposing the database on all interfaces without breaking the application, as the application and database reside on the same server.

Answer

Change the MySQL default port to a non-standard port to avoid automated scans.

Answer

Disable the MySQL network entirely by commenting out the 'skip-networking' directive in my.cnf.

Answer

Use iptables to add a rule dropping incoming packets to port 3306 from all IPs except 127.0.0.1.

Question 2

Based on the ACL output, which user(s) can write to the file /var/www/html/index.html?

Accepted Answer

Only root.. The ACL output shows that the mask is set to r--, which limits the effective permissions of named users and groups to read-only, regardless of their ACL entries. However, the root user is not subject to ACL restrictions and always has full access to any file, including write permission, making root the only user who can write to the file.

Answer

Only the user www-data.

Answer

No one, because the mask is r--.

Answer

Any user in the www-data group.

Question 3

Which TWO statements about LVM thin provisioning are correct?

Accepted Answer

It allows creating logical volumes that can be larger than the available physical storage.. Option B is correct because LVM thin provisioning uses over-provisioning: a thin logical volume can be created with a virtual size larger than the free space in its thin pool, and physical blocks are allocated only when data is actually written. Option E is correct because thin snapshots are copy-on-write and initially reference the same data blocks as the origin, so they consume almost no additional space until the origin or snapshot is modified. Option A is wrong because thin pools do not auto-extend at 80% usage; administrators must manually run lvextend (or configure monitoring/automation) to grow the pool. Option C is wrong because a thin pool can be extended with lvextend as long as free space exists in its volume group. Option D is wrong because thin provisioning is a device-mapper feature independent of the underlying storage type and works on HDDs, SSDs, and SAN LUNs alike.

Answer

Thin pools automatically extend when they reach 80% usage.

Answer

A thin pool cannot be extended once created.

Answer

It is only supported on SSDs.

Question 4

An administrator is configuring nftables to log and drop packets from a specific IP. The rule must be added to the input hook. Which command accomplishes this?

Accepted Answer

nft add rule inet filter input ip saddr 10.0.0.5 log drop. Both options B and C are syntactically valid nftables rules that log and drop packets from the specified IP. Option B uses 'log drop' which logs the packet with default settings and then drops it. Option C adds a custom prefix for more descriptive logging. The question does not require a prefix, so both B and C are correct. Option A logs with 'accept', which contradicts the drop requirement. Option D logs without a verdict, which is incomplete.

Answer

nft add rule inet filter input ip saddr 10.0.0.5 log accept

Answer

nft add rule ip filter input ip saddr 10.0.0.5 drop

Question 5

A Samba share is used by macOS clients. File names with special characters (e.g., ©) appear garbled. Which parameter should be added to the share configuration?

Accepted Answer

fruit:aapl = yes. The `fruit:aapl = yes` parameter enables the Samba VFS module for macOS (Apple Filing Protocol) compatibility, which handles special characters like © by mapping them to Unicode-compatible representations that macOS clients expect. Without this, macOS clients may misinterpret or garble filenames with non-ASCII characters when accessing Samba shares.

Answer

vfs objects = catia

Answer

dos charset = CP850

Answer

mangled names = yes

Question 6

A Linux server exports a directory /data via NFS to a client. The client mounts it with 'mount -t nfs server:/data /mnt/data'. Write operations from the client fail with 'Permission denied' on some files. The server's /etc/exports contains: /data 192.168.1.0/24(rw,root_squash). What is the most likely issue?

Accepted Answer

root_squash maps root to nobody. The 'root_squash' option in /etc/exports maps the UID 0 (root) on the client to the 'nobody' user (typically UID 65534) on the server. When a client user with UID 0 attempts to write to files owned by other users or with restrictive permissions, the server sees the request as coming from 'nobody', which lacks write access, resulting in 'Permission denied'. This is the most likely cause because the client mount command does not specify 'no_root_squash', and the server's export explicitly enables root squashing.

Answer

NFS version mismatch

Answer

Client mount option 'noexec'

Answer

Missing 'rw' option in /etc/exports

Question 7

After upgrading the kernel on a Red Hat Enterprise Linux system, the system fails to boot because the initramfs is missing. Which command can be used to regenerate the initramfs?

Accepted Answer

dracut -f. On Red Hat Enterprise Linux (RHEL) systems, the `dracut` utility is the standard tool for creating and regenerating initial RAM filesystem images (initramfs). The `-f` (force) option overwrites an existing initramfs file, which is necessary after a kernel upgrade to ensure the new kernel has the correct drivers and modules to mount the root filesystem during boot. Without a valid initramfs, the kernel cannot access the root filesystem, causing a boot failure.

Answer

mkinitrd -f

Answer

grub2-mkconfig -o /boot/grub2/grub.cfg

Answer

mkinitramfs -o /boot/initrd.img

Question 8

A company has a Linux client running Ubuntu 20.04 that is used by multiple developers. The client has two network interfaces: eth0 (connected to the corporate network with DHCP) and eth1 (connected to a test lab with static IP 192.168.100.10/24). The client needs to access both the internet (via eth0) and the lab network (192.168.100.0/24). The default gateway is 10.0.0.1 on eth0. The lab network has a server at 192.168.100.50 that provides DHCP for the lab devices, but the client's eth1 is statically configured. Recently, the client cannot reach the lab server at 192.168.100.50. The administrator checks the routing table and sees:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.0.0.1        0.0.0.0         UG    100    0        0 eth0
10.0.0.0        0.0.0.0         255.255.255.0   U     100    0        0 eth0
192.168.100.0   0.0.0.0         255.255.255.0   U     100    0        0 eth1

The administrator can ping 192.168.100.50 from the client. However, the lab server cannot ping the client. What is the most likely cause?

Accepted Answer

The client's firewall is blocking incoming ICMP echo requests.. The client can ping the lab server (192.168.100.50), proving that outbound traffic from the client to the lab network works correctly. However, the lab server cannot ping the client, which indicates that either the return traffic is blocked or the client does not have a route back to the server. Since the client's routing table shows a direct route to 192.168.100.0/24 via eth1, the issue is not a missing route; instead, the most likely cause is that the client's firewall (e.g., iptables or ufw) is blocking incoming ICMP Echo Requests (ping) on eth1, while allowing outbound traffic.

Answer

The lab server's default gateway is misconfigured.

Answer

The client has no route to the lab subnet.

Answer

The client's default gateway is misconfigured.

Question 9

An AppArmor profile for a database server is too restrictive and denies legitimate queries. The administrator wants to learn the required accesses by running the application in complain mode. Which command puts the profile into complain mode?

Accepted Answer

aa-complain /etc/apparmor.d/usr.sbin.mysqld. The `aa-complain` command places an AppArmor profile into complain mode, where policy violations are logged but not blocked. This allows the administrator to run the database server and observe which accesses are denied, then use the logs to update the profile with the required permissions. The correct syntax is `aa-complain /etc/apparmor.d/usr.sbin.mysqld` to target the specific profile file.

Answer

aa-disable /etc/apparmor.d/usr.sbin.mysqld

Answer

aa-enforce /etc/apparmor.d/usr.sbin.mysqld

Answer

aa-log /etc/apparmor.d/usr.sbin.mysqld

Question 10

A Samba server is experiencing slow authentication for domain users. The logs show repeated winbind connections to the domain controllers. The administrator suspects that winbind is not caching credentials properly. Which parameter should be checked or increased to improve caching?

Accepted Answer

winbind cache time. The `winbind cache time` parameter controls how long winbindd caches user and group information retrieved from domain controllers. Increasing this value reduces the frequency of authentication requests to the DCs, improving performance. The default is 300 seconds; a higher value (e.g., 900 or 1800) can significantly reduce repeated connections.

Answer

winbind rpc only

Answer

winbind offline logon

Answer

winbind request timeout

Question 11

A Samba server is configured as a classic PDC (Primary Domain Controller) for a legacy network. The administrator needs to add a new machine account for a client joining the domain. Which command accomplishes this?

Accepted Answer

smbpasswd -a -m MACHINENAME. In a classic Samba PDC (Primary Domain Controller) setup, machine accounts are stored in the `smbpasswd` file (or tdbsam) and are added using `smbpasswd -a -m MACHINENAME`. The `-m` flag specifically indicates a machine account, which appends a `$` to the name and sets the appropriate flags for domain membership. This command creates the machine trust account that the client uses to join the domain.

Answer

samba-tool domain add machinename

Answer

net rpc join machinename

Answer

pdbedit -a -m MACHINENAME

Question 12

Which THREE configuration directives are necessary to enable Winbind for Active Directory authentication on a Samba domain member?

Accepted Answer

security = ads. Option A (security = ads) is correct because a Samba domain member authenticating against Active Directory must run in ADS security mode, which makes Samba use Kerberos for authentication and treat the AD domain as its security authority. Option C (realm = EXAMPLE.COM) is correct because Winbind needs the Kerberos realm name (uppercase DNS form of the AD domain) to locate the KDC and obtain tickets for AD authentication. Option E (idmap config * : range = 10000-20000) is correct because Winbind requires an idmap range for the default domain so it can map non-domain and fallback SIDs to local Unix UIDs/GIDs; without a defined range, Winbind cannot allocate IDs and authentication/identity mapping fails. Option B (winbind use default domain = yes) is not required — it is a convenience setting that lets users log in without the DOMAIN\ prefix, but Winbind works without it. Option D (workgroup = EXAMPLE) is not required for AD authentication; the workgroup parameter is used for NT4-style domains and is not the directive that binds Samba to the AD realm.

Answer

winbind use default domain = yes

Answer

workgroup = EXAMPLE

Question 13

Which THREE directives are essential for configuring an OpenLDAP client in /etc/ldap/ldap.conf? (Choose three.)

Accepted Answer

BASE. Option C (BASE) is essential because it defines the default search base DN that the client appends to relative search requests, allowing tools like ldapsearch to resolve entries without specifying a base each time. Option D (TLS_REQCERT) is essential because it controls how the client validates the server's TLS certificate (values such as never, allow, try, demand, hard), which is required for secure StartTLS/LDAPS connections. Option E (URI) is essential because it specifies the LDAP server address(es) in the form ldap://host:port or ldaps://host:port, telling the client where to connect. Option A (SIZELIMIT) is not essential since it only caps the number of entries returned and defaults are usually acceptable, and Option B (BINDDN) is not essential because it merely sets a default bind DN for authentication, which can instead be supplied per-command or via other credentials.

Answer

SIZELIMIT

Answer

BINDDN

Question 14

Based on the exhibit, which command would change the DNS server to 1.1.1.1 for the connection MyConnection?

Accepted Answer

nmcli con mod MyConnection ipv4.dns 1.1.1.1. The `nmcli con mod` command modifies an existing connection profile, and the `ipv4.dns` property sets the DNS server for IPv4. The property name is case-sensitive and must be lowercase `ipv4.dns` as per NetworkManager's D-Bus API. This command replaces any existing DNS servers with the specified value.

Answer

nmcli con mod MyConnection IP4.DNS 1.1.1.1

Answer

nmcli dev mod eth0 ipv4.dns 1.1.1.1

Answer

nmcli con mod MyConnection +ipv4.dns 1.1.1.1

Question 15

A storage administrator is preparing a new 10 TB LUN for a database server. The workload performs many small random writes, and the administrator wants to minimize write amplification and metadata overhead while keeping crash consistency. Which mkfs.xfs invocation is most appropriate?

Accepted Answer

mkfs.xfs -f -b size=4096 -m crc=1 -d agcount=4 /dev/sdc. For a database doing small random writes, a 4 KB block size matches the typical I/O size, CRC metadata checksums improve crash consistency, and a small allocation group count reduces metadata overhead on a single large LUN. The other invocations either use unsupported block sizes, disable checksums, or create excessive allocation groups.

Answer

mkfs.xfs -f -b size=512 -m crc=0 -d agcount=64 /dev/sdc

Answer

mkfs.xfs -f -b size=65536 -m crc=1 -d agcount=8 /dev/sdc

Answer

mkfs.xfs -f -b size=4096 -m crc=0 -d agcount=64 /dev/sdc

Question 16

A storage engineer is documenting the behavior of LVM RAID (dm-raid) volumes on a production server. Which two statements about LVM RAID are correct? (Choose two.)

Accepted Answer

An LVM RAID1 logical volume can be created with lvcreate --type raid1 -m 1.. LVM RAID volumes are created with lvcreate --type raidN, and a two-way RAID1 uses -m 1. Recovery of a failed leg is performed with lvconvert --repair, which replaces the failed device and resynchronizes the array. These two statements reflect the documented creation and repair workflows for dm-raid volumes, distinguishing LVM RAID from mdadm-managed arrays.

Answer

LVM RAID volumes require the dm-raid kernel module and mdadm userspace tools.

Answer

LVM RAID automatically converts an existing linear LV to RAID5 when a third device is added.

Answer

LVM RAID volumes cannot be extended while active.

Question 17

A Linux router uses nftables with a table inet filter and a base chain forward with policy drop. The administrator wants to allow established and related traffic while accepting new SSH connections to the router itself. Which nftables rule set correctly implements this?

Accepted Answer

nft add rule inet filter input ct state established,related accept; nft add rule inet filter input tcp dport 22 ct state new accept. Inbound SSH to the router is processed by the input chain, so the stateful rule accepting established and related traffic plus the rule for new TCP port 22 must be added there. The forward chain remains restrictive for transit traffic. This preserves the drop policy while enabling management access.

Answer

nft add rule inet filter input ct state new accept; nft add rule inet filter input tcp dport 22 accept

Answer

nft add rule inet filter forward ct state established,related accept; nft add rule inet filter forward tcp dport 22 ct state new accept

Answer

nft add rule inet filter output ct state established,related accept; nft add rule inet filter output tcp dport 22 ct state new accept

Question 18

A database server uses LVM with an XFS filesystem on /dev/vg_data/lv_db, mounted at /var/lib/mysql. The LV is at 95% capacity. A new 50GB disk /dev/sdd has been added and initialized as a physical volume, then added to the volume group vg_data. The database is running and cannot be stopped. The administrator must extend the LV and filesystem. What is the correct course of action?

Accepted Answer

Run `lvextend -L +50G /dev/vg_data/lv_db` followed by `xfs_growfs /var/lib/mysql`.. XFS filesystems must be grown while mounted using `xfs_growfs` with the mount point as the argument, not the block device. Since the database cannot be stopped, the LV can be extended online with `lvextend`, and then `xfs_growfs /var/lib/mysql` resizes the filesystem to fill the expanded LV without requiring unmounting or downtime.

Answer

Run `lvextend -L +50G /dev/vg_data/lv_db` followed by `resize2fs /dev/vg_data/lv_db`.

Answer

Unmount /var/lib/mysql, run `lvextend -L +50G /dev/vg_data/lv_db`, run `resize2fs /dev/vg_data/lv_db`, then remount.

Answer

Run `lvresize -L +50G /dev/vg_data/lv_db`.

Question 19

A Samba administrator needs to configure a share that allows only the user 'alice' and the group 'developers' to read and write files. Others should have no access. Which two parameters should be set in the share definition? (Choose two.)

Accepted Answer

valid users = alice, @developers. The 'valid users' parameter restricts access to only the specified users and groups, so setting 'valid users = alice, @developers' ensures only alice and members of the developers group can connect to the share. The 'write list' parameter grants write access to the listed users and groups, overriding any read-only setting; combining it with 'valid users' ensures that alice and the developers group have both read and write permissions, while all others are denied access entirely.

Answer

invalid users = alice, @developers

Answer

force user = alice

Answer

read list = alice, @developers

Question 20

A Linux client is configured with two network interfaces: eth0 (connected to the internet) and eth1 (connected to a private LAN). The default route is set to eth0. The client can access the internet but cannot access hosts on the private LAN. What is the most likely cause?

Accepted Answer

There is no route to the private subnet via eth1.. Without a route to the private subnet via eth1, the client has no way to forward packets destined for the private LAN out of eth1. The default route via eth0 only handles traffic for destinations not explicitly matched by other routes; if the private subnet is not in the routing table, packets to that subnet will be sent to the default gateway (internet) and fail. The `ip route` command would show the missing entry, and adding a static route (e.g., `ip route add 192.168.1.0/24 dev eth1`) resolves the issue.

Answer

A firewall on the client is blocking ICMP packets on eth1.

Answer

The eth1 interface is not configured with an IP address.

Answer

The eth1 interface is not receiving a DHCP lease.