LPIC-2 Network Client Management Practice Test 3 — 15 Questions

Question 1

Which TWO authentication modules can be used with PAM to integrate LDAP authentication on a Linux client?

Accepted Answer

pam_krb5. pam_ldap (option E) is the dedicated PAM module that binds directly to an LDAP directory (e.g., OpenLDAP or Active Directory's LDAP interface) to verify user credentials, making it a correct choice for integrating LDAP authentication on a Linux client. pam_krb5 (option B) is also correct because LDAP directories such as Active Directory commonly rely on Kerberos for the actual authentication exchange, and pam_krb5 lets the client obtain and validate Kerberos tickets against the KDC associated with that directory. pam_unix (option A) only authenticates against local /etc/passwd and /etc/shadow files, so it cannot perform LDAP authentication. pam_radius (option C) authenticates via the RADIUS protocol to a RADIUS server, not directly against LDAP. pam_tally2 (option D) is an account-lockout/failed-login counting module and does not provide LDAP authentication.

Answer

pam_unix

Answer

pam_radius

Answer

pam_tally2

Question 2

A company runs an NTP server that should only synchronize with trusted upstream servers and provide time to internal clients. Which restrict clause in ntp.conf would best secure the server against unauthorized queries?

Accepted Answer

restrict 192.168.0.0 mask 255.255.0.0 nomodify notrap. The best choice among the options because it restricts internal clients with `nomodify` and `notrap`, preventing them from altering the server's configuration or sending control message traps. However, to fully secure against unauthorized queries, a `restrict default ignore` or similar rule is needed; otherwise, external hosts can still query. Option B would block all hosts by default, requiring explicit allows for trusted upstream servers, which is less practical. Option A would block all queries entirely, including internal clients. Option D applies only to localhost and does not affect external queries. Thus, C is the most effective at securing against unauthorized queries while allowing internal client synchronization.

Answer

restrict default ignore

Answer

restrict default kod nomodify notrap nopeer noquery

Answer

restrict 127.0.0.1

Question 3

Which directive in ntp.conf enables the NTP server to respond to queries from clients?

Accepted Answer

restrict. The `restrict` directive in ntp.conf controls access to the NTP server, including whether it responds to client queries. By default, NTP servers restrict all access; adding a `restrict` line with the `nomodify` and `notrap` flags (or no restrictive flags) allows clients to query the server. Option C is correct because `restrict` is the directive that explicitly permits or denies NTP queries from clients.

Answer

broadcast

Answer

peer

Answer

server

Question 4

Which TWO options in dhcpd.conf are used to define the subnet and the address range for dynamic allocation? (Select two.)

Accepted Answer

range 192.168.1.10 192.168.1.100;. Option E, `subnet 192.168.1.0 netmask 255.255.255.0 { ... }`, is correct because the `subnet` declaration is the fundamental dhcpd.conf block that defines the subnet itself, and its `netmask` argument specifies the network mask for that subnet. Option C, `range 192.168.1.10 192.168.1.100;`, is correct because the `range` statement inside a subnet (or pool) declares the contiguous pool of IP addresses from which the DHCP server dynamically allocates leases. Option A is not correct because `option subnet-mask` merely supplies the client's subnet mask via DHCP option 1; it does not define the subnet or the allocation range. Option B is not correct because `pool { ... }` is only a grouping construct that can contain a `range`, but by itself it neither defines the subnet nor the address range. Option D is not correct because `host` with `fixed-address` defines a static reservation for a single client, not a dynamic allocation range.

Answer

option subnet-mask 255.255.255.0;

Answer

pool { ... }

Answer

host fixed-address 192.168.1.200;

Question 5

Which TWO commands can be used to query a DHCP server's lease database on a Linux server running ISC DHCP? (Assume default paths.) (Select two.)

Accepted Answer

cat /var/lib/dhcp/dhcpd.leases. Option B, `cat /var/lib/dhcp/dhcpd.leases`, is correct because ISC DHCP stores its active and historical lease records in the plain-text file `/var/lib/dhcp/dhcpd.leases` (on Debian/Ubuntu-style default paths), so reading it directly queries the lease database. Option C, `dhcp-lease-list`, is correct because it is a utility that parses the ISC DHCP lease file and prints a formatted, human-readable list of current leases, effectively querying the lease database. Option A, `dhcpd -t`, only tests the configuration file syntax and does not read or display leases. Option D, `less /etc/dhcp/dhcpd.conf`, opens the server configuration file, which defines subnets, pools, and options but contains no lease data. Option E, `dhcpd -p`, sets an alternate listening port for the daemon and does not query leases.

Answer

dhcpd -t

Answer

less /etc/dhcp/dhcpd.conf

Answer

dhcpd -p

Question 6

An LDAP client fails to authenticate users against an LDAP server. The /etc/nsswitch.conf includes 'passwd: files ldap' and the /etc/pam.d/system-auth has appropriate pam_ldap.so entries. However, 'getent passwd' shows only local users. Which command should the administrator run first to diagnose the issue?

Accepted Answer

Run 'ldapsearch -x -H ldap://server -b dc=example,dc=com' to test connectivity.. The first step in diagnosing an LDAP authentication failure is to verify basic connectivity to the LDAP server. Running 'ldapsearch -x -H ldap://server -b dc=example,dc=com' tests whether the client can reach the server and perform a simple anonymous search. If this fails, no amount of configuration tweaking will resolve the issue, as the root cause is likely network or server availability.

Answer

View the contents of /etc/nsswitch.conf.

Answer

Restart the nslcd service.

Answer

Check the syntax of /etc/ldap.conf with 'slaptest -f /etc/ldap.conf'.

Question 7

A developer frequently needs to access a remote database server that is only accessible via SSH from a jump host. To simplify access, the administrator wants to create a local port forward so that the developer can connect to localhost:3306 and reach the remote database's MySQL port 3306. Which SSH command achieves this?

Accepted Answer

ssh -L 3306:db.internal:3306 user@jump.example.com. `ssh -L 3306:db.internal:3306 user@jump.example.com` forwards local port 3306 to `db.internal:3306` through the jump host, allowing the developer to connect to localhost:3306 and reach the remote database. Option E is incorrect because `-L 3306:localhost:3306` forwards to the jump host's own localhost, not the database server; this would only work if the database were running on the jump host itself, which is not the case.

Answer

ssh -J user@jump.example.com -L 3306:localhost:3306 db.internal

Answer

ssh -L localhost:3306:db.internal:3306 user@jump.example.com

Answer

ssh -R 3306:localhost:3306 user@jump.example.com

Answer

ssh -L 3306:localhost:3306 user@jump.example.com

Question 8

Given the LDAP client configuration shown in the exhibit, which THREE additional components are required for LDAP authentication to work? (Choose three.)

Accepted Answer

Edit /etc/nsswitch.conf to include ldap in passwd, shadow, and group lines.. Option A is correct because LDAP authentication requires the Name Service Switch to consult LDAP for user and group lookups, so /etc/nsswitch.conf must list ldap in the passwd, shadow, and group lines (e.g., passwd: files ldap). Option D is correct because PAM must be configured to actually authenticate against LDAP, which is done by adding a line such as 'auth sufficient pam_ldap.so' to /etc/pam.d/system-auth so login services call the LDAP PAM module. Option E is correct because starting the nscd (Name Service Cache Daemon) service is needed to cache and serve the LDAP-backed NSS lookups reliably, ensuring passwd/shadow/group queries resolve through the configured LDAP source. Option B is not required because autofs handles automounting of file systems and is unrelated to LDAP authentication. Option C is not required because Kerberos configuration in /etc/krb5.conf is only needed for Kerberos-based authentication, not for plain LDAP bind authentication.

Answer

Install and configure autofs.

Answer

Configure /etc/krb5.conf for Kerberos.

Question 9

A company's file server uses NFS to export /data to clients. An administrator configures an NFS client by running 'mount -t nfs fileserver:/data /mnt/data'. The mount succeeds and the user can read files. However, after a network interruption, the client system becomes unresponsive when a user attempts to access /mnt/data. Which action should the administrator take to prevent this issue in the future?

Accepted Answer

Add the 'soft' option to the mount command: 'mount -t nfs -o soft fileserver:/data /mnt/data'.. Using a 'soft' mount causes NFS operations to return an error to the calling application after a timeout, rather than hanging indefinitely. This prevents the client system from becoming unresponsive when the NFS server is unreachable, as the kernel will not retry the request forever. The default 'hard' mount (used in the original command) will keep retrying until the server responds, which can block processes and make the system appear frozen.

Answer

Add the 'intr' mount option to allow signal interrupts.

Answer

Increase the timeout value with 'timeo=600' and keep the hard mount.

Answer

Use the 'noac' option to disable attribute caching.

Question 10

An organization uses LDAP for centralized authentication. The /etc/nsswitch.conf contains 'passwd: files ldap' and 'shadow: files ldap'. The /etc/pam.d/system-auth includes 'auth requisite pam_ldap.so' and 'account required pam_ldap.so'. However, users can log in using local accounts but not LDAP accounts. The ldapsearch command works correctly against the LDAP server. Logs show 'pam_ldap: error trying to bind as user (No such object)'. Which configuration change is most likely needed?

Accepted Answer

Ensure /etc/ldap.conf contains a valid 'binddn' and 'bindpw' for the search user.. The error 'pam_ldap: error trying to bind as user (No such object)' indicates that PAM LDAP cannot find the user entry in the LDAP directory. This typically occurs because the binddn (the search user) specified in /etc/ldap.conf is incorrect or missing, preventing PAM from performing the initial search to locate the user's DN. Since ldapsearch works manually, the LDAP server is reachable, but the PAM module lacks the credentials to bind and search for users.

Answer

Open TCP port 389 on the client firewall.

Answer

Add 'uri ldaps://ldap.example.com' to /etc/ldap.conf.

Answer

Restart the nscd service.

Question 11

An administrator configured an autofs direct map for a remote NFS share. The master map at /etc/auto.master contains a line: '/data /etc/auto.direct'. The direct map file /etc/auto.direct has: '/projects -rw,soft fileserver:/exports/projects'. When a user tries to cd /data/projects, it hangs. The autofs service is running. What is the most likely cause?

Accepted Answer

The master map should use '/-' instead of '/data' for direct maps.. Direct maps in autofs must use the special mount point '/-' in the master map, not an actual directory path like '/data'. When '/data' is specified, autofs treats it as an indirect map key, causing it to look for a subdirectory matching the key under '/data' rather than triggering the direct mount of '/projects'. This mismatch leads to a hang when the user attempts to access '/data/projects' because autofs never attempts the NFS mount.

Answer

The NFS server fileserver is not exporting /exports/projects.

Answer

The autofs service is not started.

Answer

The 'soft' mount option is missing.

Question 12

An administrator is configuring a PXE boot environment using dnsmasq. Clients receive an IP address but fail to download the boot file. The administrator has set dhcp-boot=pxelinux.0 in dnsmasq.conf, and the TFTP server is running on the same host. What is the most likely cause of the failure?

Accepted Answer

The TFTP server is not enabled or the root directory does not contain pxelinux.0.. For PXE boot with dnsmasq, you must enable TFTP service and ensure the boot file exists in the TFTP root directory. The dhcp-boot option only tells the client the filename; the client then retrieves it via TFTP. If TFTP is not enabled or the file is missing, the boot fails. Other options are not relevant because the client gets an IP and the filename is provided.

Answer

The clients are on a different subnet and require a DHCP relay agent.

Answer

The DHCP option 67 (boot-file) is not set; dnsmasq uses option 66 instead.

Answer

The dhcp-boot option requires the TFTP server's IP address as an additional parameter.

Question 13

An administrator must join a Debian 12 workstation to an Active Directory domain using realmd. After running 'realm join --user=Administrator ad.example.com', the command succeeds, but 'realm list' shows 'configured: no'. Which command should the administrator run to correct this?

Accepted Answer

realm join --client-software=sssd ad.example.com. A realm that joins but reports 'configured: no' means realmd did not persist a usable local client configuration. Forcing a supported client stack with an explicit client-software selection makes realmd write the domain configuration, so the realm is reported as configured and domain logins become possible. Discovery and permit operations do not affect the configured state.

Answer

realm permit --all

Answer

realm discover ad.example.com

Answer

realm join --user=Administrator ad.example.com

Question 14

A Linux server provides NFS shares to clients. The administrator wants to ensure that the NFS service starts automatically at boot and is managed by systemd. Which command should be used to enable the NFS server service?

Accepted Answer

systemctl enable nfs-server. The correct command is 'systemctl enable nfs-server'. This enables the NFS server systemd unit to start automatically at boot. The nfs-server unit is provided by the NFS server package and manages the kernel NFS daemon. Enabling it ensures that the server exports shares as configured in /etc/exports. Other units like nfs-client or rpcbind serve different purposes and are not the NFS server service.

Answer

systemctl enable rpcbind

Answer

systemctl enable nfs-client

Answer

systemctl enable nfs-kernel-server

Question 15

A junior administrator needs to join a Debian 12 client to an Active Directory domain so that domain users can log in. The administrator has installed the required packages and now runs 'realm join --user=Administrator example.com'. The command fails with '! Couldn't join realm: Insufficient permissions to join the domain'. Which action should be performed to resolve this issue?

Accepted Answer

Run the command as root using sudo.. The realm join command must be run with root privileges (via sudo) to perform the necessary system changes and authenticate to Active Directory. The error message indicates insufficient permissions, which typically occurs when the command is run as a regular user. Running it with sudo provides the required privileges to create the computer account and join the domain.

Answer

Add the current user to the sudo group.

Answer

Specify a different domain controller with --server.

Answer

Use the --client-software=winbind option.