LPIC-2 Network Client Management Practice Test 2 — 15 Questions

Question 1

An administrator configures LDAP authentication on a Linux client. After making changes to /etc/nsswitch.conf and /etc/pam.d/system-auth, users can log in but cannot execute commands like 'id username'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

nsswitch.conf lacks 'ldap' for passwd. The 'id username' command relies on the Name Service Switch (NSS) to resolve user and group information from configured sources. If 'ldap' is not listed for the 'passwd' database in /etc/nsswitch.conf, the system will not query the LDAP server for user account details, even though PAM may have been configured to authenticate against LDAP. This mismatch allows login (via PAM) but prevents user attribute lookups (via NSS).

Answer

LDAP server is not reachable

Answer

LDAP binddn is missing

Answer

PAM configuration is incorrect

Question 2

A Linux server exports a directory /data via NFS to a client. The client mounts it with 'mount -t nfs server:/data /mnt/data'. Write operations from the client fail with 'Permission denied' on some files. The server's /etc/exports contains: /data 192.168.1.0/24(rw,root_squash). What is the most likely issue?

Accepted Answer

root_squash maps root to nobody. The 'root_squash' option in /etc/exports maps the UID 0 (root) on the client to the 'nobody' user (typically UID 65534) on the server. When a client user with UID 0 attempts to write to files owned by other users or with restrictive permissions, the server sees the request as coming from 'nobody', which lacks write access, resulting in 'Permission denied'. This is the most likely cause because the client mount command does not specify 'no_root_squash', and the server's export explicitly enables root squashing.

Answer

NFS version mismatch

Answer

Client mount option 'noexec'

Answer

Missing 'rw' option in /etc/exports

Question 3

A Samba share is configured with 'valid users = @staff' but users in the staff group still get 'NT_STATUS_ACCESS_DENIED' when accessing the share. The server uses 'security = user'. Which additional configuration is required?

Accepted Answer

Run smbpasswd -a for each user. With 'security = user', Samba requires each user to have a separate Samba password stored in the smbpasswd file (or another passdb backend). Even if a user is a member of the 'staff' group and exists in the system's /etc/passwd, they cannot authenticate to the share without an smbpasswd entry. Running 'smbpasswd -a' for each user creates that entry, resolving the NT_STATUS_ACCESS_DENIED error.

Answer

Set 'guest ok = yes'

Answer

Set 'force group = staff'

Answer

Add the share to [global]

Question 4

A company uses NIS for user authentication. A client cannot log in with network accounts but local accounts work. Which command should be used to check if the client is bound to the NIS domain?

Accepted Answer

ypwhich. The `ypwhich` command is used to display the NIS server to which the client is currently bound. If the client is not bound to any NIS domain, `ypwhich` returns an error, confirming the binding issue. This directly checks the NIS client-server binding, which is essential for network authentication.

Answer

ypset

Answer

ypcat passwd

Answer

domainname

Question 5

To ensure LDAP communication is encrypted, an administrator configures LDAP over SSL (LDAPS) on port 636. Which configuration file on the client should be modified to specify the LDAP server with TLS?

Accepted Answer

/etc/ldap/ldap.conf. The LDAP client configuration file on Linux systems is typically located at /etc/ldap/ldap.conf (or /etc/openldap/ldap.conf on some distributions). This file is used by LDAP client libraries (e.g., libldap) to specify the LDAP server URI, including the use of TLS/SSL via the ldaps:// scheme or the TLS_REQCERT directive. Modifying this file allows the client to connect to an LDAP server over port 636 with encryption.

Answer

/etc/pam_ldap.conf

Answer

/etc/openldap/ldap.conf

Answer

/etc/nsswitch.conf

Question 6

Which TWO DHCP options are commonly used to provide network configuration to clients? (Choose two.)

Accepted Answer

routers. (routers) is correct because the DHCP option 3 (Router) provides the default gateway address to clients, enabling them to route traffic outside their local subnet. Option E (domain-name-servers) is correct because DHCP option 6 (Domain Name Server) supplies the DNS server addresses, allowing clients to resolve domain names. Both are essential for basic network connectivity and are almost universally configured in DHCP scopes.

Answer

subnet-mask

Answer

ntp-servers

Answer

host-name

Question 7

Which THREE directives are essential for configuring an OpenLDAP client in /etc/ldap/ldap.conf? (Choose three.)

Accepted Answer

BASE. Option C (BASE) is essential because it defines the default search base DN that the client appends to relative search requests, allowing tools like ldapsearch to resolve entries without specifying a base each time. Option D (TLS_REQCERT) is essential because it controls how the client validates the server's TLS certificate (values such as never, allow, try, demand, hard), which is required for secure StartTLS/LDAPS connections. Option E (URI) is essential because it specifies the LDAP server address(es) in the form ldap://host:port or ldaps://host:port, telling the client where to connect. Option A (SIZELIMIT) is not essential since it only caps the number of entries returned and defaults are usually acceptable, and Option B (BINDDN) is not essential because it merely sets a default bind DN for authentication, which can instead be supplied per-command or via other credentials.

Answer

SIZELIMIT

Answer

BINDDN

Question 8

A client on the 192.168.2.0/24 network cannot obtain an IP address. Other clients on that subnet work fine. The DHCP server logs show no request from the client's MAC. What is the most likely cause?

Accepted Answer

No DHCP relay agent is configured on the client's subnet.. The client's DHCP request never reaches the DHCP server, as indicated by the server logs showing no request from the client's MAC. Since other clients on the same subnet work fine, the DHCP server and the local subnet are functional. The most likely cause is that the client's subnet (192.168.2.0/24) lacks a DHCP relay agent (e.g., configured on a router or switch using the 'ip helper-address' command) to forward broadcast DHCPDISCOVER messages to the DHCP server located on a different subnet. Without a relay agent, DHCP broadcasts are confined to the local subnet and cannot reach a remote server.

Answer

The range is too small for the number of clients.

Answer

The subnet declaration for 192.168.2.0 is missing option routers.

Answer

The client is configured with a static IP address.

Question 9

A user authenticates via LDAP successfully, but 'getent passwd' only shows local users. What is the problem?

Accepted Answer

The LDAP server is not responding for passwd queries.. The user can authenticate via LDAP (which typically uses the 'auth' or 'account' NSS modules) but 'getent passwd' only shows local users, indicating that the NSS 'passwd' map is not querying the LDAP server. This means the LDAP server is either unreachable for passwd queries or the NSS configuration for the 'passwd' database is misconfigured (e.g., missing 'ldap' in /etc/nsswitch.conf for passwd). The successful authentication suggests the LDAP server is reachable for authentication purposes, but the passwd map query fails, often due to a separate LDAP server or service issue specific to user/group lookups.

Answer

The ldap entry should be before files.

Answer

The shadow map is missing LDAP.

Answer

The nscd cache needs to be cleared.

Question 10

An administrator needs to mount an NFSv4 export from server:/exports/data onto /mnt/data on a client. The requirement is to use Kerberos security, a hard mount, and ensure that the NFS server does not squash root's privileges. Which line in /etc/fstab correctly implements these requirements?

Accepted Answer

server:/exports/data /mnt/data nfs4 defaults,sec=krb5,hard 0 0. It specifies NFSv4 with Kerberos security (sec=krb5) and a hard mount, which meets the requirements. The no_root_squash option is not a valid mount option in /etc/fstab for the client side; it is an export option set on the NFS server in /etc/exports. Thus, D correctly omits it, as the client cannot enforce root squashing behavior.

Answer

server:/exports/data /mnt/data nfs4 defaults,sec=none,hard,no_root_squash 0 0

Answer

server:/exports/data /mnt/data nfs4 defaults,sec=krb5,soft 0 0

Answer

server:/exports/data /mnt/data nfs4 defaults,sec=krb5,hard,no_root_squash 0 0

Question 11

A user reports that the command 'smbclient -L //fileserver' fails with a timeout. What is the most likely cause?

Accepted Answer

A firewall on the client or server is blocking TCP port 445.. The command 'smbclient -L //fileserver' uses SMB protocol to list shares. A timeout indicates the client cannot establish a TCP connection to the server on port 445, which is the default SMB port. A firewall blocking TCP 445 would prevent the connection, causing a timeout, while other issues like a stopped smbd service or unreachable server would typically produce different errors (e.g., 'connection refused' or 'no route to host').

Answer

The smbd service on the server is not running.

Answer

The user does not have an account on the server.

Answer

The server is not reachable via ping.

Question 12

A Linux client is configured to authenticate users against an LDAP server using PAM. Some users are unable to log in, while others succeed. The admin has verified that the LDAP server is reachable and that the user entries exist. Which of the following is the most likely cause?

Accepted Answer

The pam_ldap configuration has a size limit that restricts search results.. The pam_ldap configuration can include a size limit (e.g., 'pam_ldap size_limit 500') that restricts the number of entries returned from an LDAP search. When a user logs in, PAM may perform a search that returns multiple matching entries (e.g., due to ambiguous username or group membership lookups), and if the result set exceeds this limit, the search fails for some users. This explains why some users succeed while others fail, even though the LDAP server is reachable and user entries exist.

Answer

The nsswitch.conf file is missing the 'ldap' entry for 'passwd'.

Answer

The LDAP server is using different encryption settings.

Answer

The nslcd service is not running.

Question 13

An administrator needs to configure an NFS client to mount an export from an NFSv4 server that requires Kerberos authentication. The client should mount the export at boot time. Which of the following must be ensured for the mount to succeed automatically?

Accepted Answer

The client must have a valid keytab for its host principal.. For an NFSv4 client to automatically mount an export requiring Kerberos authentication at boot time, the client must possess a valid keytab file containing its host principal (e.g., nfs/client.example.com@REALM). This keytab allows the system to obtain Kerberos credentials without interactive user input, enabling the kernel's NFS client to authenticate to the server during the mount process. Without a keytab, the mount would fail because no user is present to run kinit, and the system lacks the cryptographic material to prove its identity.

Answer

The NFS server must have the same hostname as the client.

Answer

The user must run kinit before mounting.

Answer

The mount must be performed via an autofs map.

Question 14

A new user has been added to the LDAP directory, but the user cannot log in. The admin confirms the LDAP server is reachable and the user entry exists. Which of the following is the most likely missing configuration?

Accepted Answer

The PAM configuration does not include pam_ldap.. D is correct because even if the LDAP server is reachable and the user entry exists, the system must be configured to use LDAP for authentication. PAM (Pluggable Authentication Modules) controls how authentication is performed; without pam_ldap (or pam_ldap.so) in the PAM stack, the system will not consult the LDAP server during login, so authentication fails regardless of the LDAP directory contents.

Answer

The LDAP server does not have the correct schema for the user.

Answer

The nscd cache is stale and needs to be cleared.

Answer

The nsswitch.conf file should have 'ldap' before 'files' for passwd.

Question 15

Given the mount options shown, which of the following events will cause the NFS mount to become unresponsive (hang)?

Accepted Answer

The NFS server reboots.. When the NFS server reboots, the client's TCP connection to the server is broken. With the `hard` mount option (default), the client will retry indefinitely until the server comes back online, causing all processes accessing the mount to hang (become unresponsive). The `intr` option (if not set) prevents interruption by signals, making the hang persistent until the server responds.

Answer

The network becomes saturated.

Answer

The client runs out of disk space on /mnt/data.

Answer

The /mnt/data directory is deleted locally.