LPIC-2 Network Client Management Practice Test 4 — 15 Questions

Question 1

An administrator needs to configure an NFS client to mount an export from an NFSv4 server that requires Kerberos authentication. The client should mount the export at boot time. Which of the following must be ensured for the mount to succeed automatically?

Accepted Answer

The client must have a valid keytab for its host principal.. For an NFSv4 client to automatically mount an export requiring Kerberos authentication at boot time, the client must possess a valid keytab file containing its host principal (e.g., nfs/client.example.com@REALM). This keytab allows the system to obtain Kerberos credentials without interactive user input, enabling the kernel's NFS client to authenticate to the server during the mount process. Without a keytab, the mount would fail because no user is present to run kinit, and the system lacks the cryptographic material to prove its identity.

Answer

The NFS server must have the same hostname as the client.

Answer

The user must run kinit before mounting.

Answer

The mount must be performed via an autofs map.

Question 2

The DHCP client lease file shows a lease for 192.168.1.100. If the client fails to contact the original DHCP server by the rebind time (12:00), what will occur?

Accepted Answer

The client will attempt to contact any DHCP server to extend the lease.. When a DHCP client reaches the rebind time (T2, default 87.5% of lease duration) without contacting the original server, it enters the REBINDING state. In this state, the client broadcasts a DHCPREQUEST to any available DHCP server to extend the lease. Option D correctly describes this behavior, as defined in RFC 2131.

Answer

The client will continue to use the address until the expire time without any further attempts.

Answer

The client will immediately release the address.

Answer

The client will rebind with a new IP address from any server.

Question 3

A new user has been added to the LDAP directory, but the user cannot log in. The admin confirms the LDAP server is reachable and the user entry exists. Which of the following is the most likely missing configuration?

Accepted Answer

The PAM configuration does not include pam_ldap.. D is correct because even if the LDAP server is reachable and the user entry exists, the system must be configured to use LDAP for authentication. PAM (Pluggable Authentication Modules) controls how authentication is performed; without pam_ldap (or pam_ldap.so) in the PAM stack, the system will not consult the LDAP server during login, so authentication fails regardless of the LDAP directory contents.

Answer

The LDAP server does not have the correct schema for the user.

Answer

The nscd cache is stale and needs to be cleared.

Answer

The nsswitch.conf file should have 'ldap' before 'files' for passwd.

Question 4

Given the mount options shown, which of the following events will cause the NFS mount to become unresponsive (hang)?

Accepted Answer

The NFS server reboots.. When the NFS server reboots, the client's TCP connection to the server is broken. With the `hard` mount option (default), the client will retry indefinitely until the server comes back online, causing all processes accessing the mount to hang (become unresponsive). The `intr` option (if not set) prevents interruption by signals, making the hang persistent until the server responds.

Answer

The network becomes saturated.

Answer

The client runs out of disk space on /mnt/data.

Answer

The /mnt/data directory is deleted locally.

Question 5

Which TWO authentication modules can be used with PAM to integrate LDAP authentication on a Linux client?

Accepted Answer

pam_krb5. Option B (pam_krb5) is correct because it allows PAM to authenticate users against a Kerberos KDC, which is commonly used alongside LDAP for single sign-on in enterprise environments. Option E (pam_ldap) is correct because it directly enables PAM to bind to an LDAP directory server for user authentication, typically using the LDAP BIND operation. Both modules are standard choices for integrating LDAP authentication on a Linux client.

Answer

pam_unix

Answer

pam_radius

Answer

pam_tally2

Question 6

Which TWO commands can be used to connect to a Samba share from a Linux command line?

Accepted Answer

smbclient. B is correct because smbclient is a command-line tool that uses the SMB/CIFS protocol to connect to Samba shares, allowing file transfers and directory listing. D is correct because mount.cifs is a helper program that mounts a Samba share to a local directory using the CIFS filesystem type, enabling direct file access via the kernel's cifs module.

Answer

sshfs

Answer

nfsmount

Answer

ftp

Question 7

Which THREE files are commonly involved in configuring a Linux client for LDAP authentication?

Accepted Answer

/etc/pam.d/system-auth. Option C is correct because /etc/pam.d/system-auth (or its equivalent, such as /etc/pam.d/common-auth on Debian-based systems) is the central PAM configuration file that defines authentication modules. For LDAP authentication, the pam_ldap module is typically stacked here to allow LDAP-based user credential verification, making it essential for integrating LDAP into the system's authentication flow.

Answer

/etc/hosts

Answer

/etc/resolv.conf

Question 8

Which file is used to configure the LDAP client for system authentication on a modern Linux system using nss-pam-ldapd?

Accepted Answer

/etc/nslcd.conf. Option C is correct because /etc/nslcd.conf is the configuration file for nslcd, the LDAP name service daemon used by nss-pam-ldapd to perform LDAP queries for system authentication and user/group lookups. This daemon communicates with the LDAP server and provides the results to NSS and PAM modules, making it the central configuration point for LDAP client authentication on modern Linux systems.

Answer

/etc/openldap/ldap.conf

Answer

/etc/nsswitch.conf

Answer

/etc/ldap.conf

Question 9

Which directive in dhcpd.conf sets the maximum lease time?

Accepted Answer

max-lease-time. Option D is correct because the `max-lease-time` directive in `dhcpd.conf` explicitly sets the maximum lease time (in seconds) that the DHCP server will assign to a client, overriding any client request for a longer lease. This ensures the server enforces an upper bound on lease duration, preventing clients from monopolizing IP addresses indefinitely.

Answer

option lease-time

Answer

default-lease-time

Answer

lease-time

Question 10

A company runs an NTP server that should only synchronize with trusted upstream servers and provide time to internal clients. Which restrict clause in ntp.conf would best secure the server against unauthorized queries?

Accepted Answer

restrict 192.168.0.0 mask 255.255.0.0 nomodify notrap. Option C is correct because it uses a restricted subnet mask (192.168.0.0/16) to allow only internal clients to query the NTP server, while blocking unauthorized external queries. The `nomodify` and `notrap` flags prevent clients from altering the server's configuration or sending control message traps, which aligns with the requirement to secure the server against unauthorized queries. This approach ensures that only trusted internal hosts can synchronize time without exposing the server to external threats.

Answer

restrict default ignore

Answer

restrict default kod nomodify notrap nopeer noquery

Answer

restrict 127.0.0.1

Question 11

An administrator notices that clients are unable to obtain IP addresses from the DHCP server. The server logs show 'no free leases' error. What is the most likely cause?

Accepted Answer

The DHCP server's address range is exhausted.. The 'no free leases' error indicates that the DHCP server has exhausted all available IP addresses in its configured pool. This occurs when the address range defined in the dhcpd.conf file has been fully allocated to clients and no leases are available for new requests. The server logs confirm this specific condition, making address exhaustion the most likely cause.

Answer

The DHCP server's subnet declaration does not match the client's network.

Answer

The dhcpd.conf file has invalid syntax.

Answer

The DHCP relay agent is misconfigured.

Question 12

A Linux client is configured with the following in /etc/nslcd.conf: 'uri ldap://10.0.0.1/', 'base dc=example,dc=com'. Which command can be used to test connectivity to the LDAP server and verify the base DN?

Accepted Answer

ldapsearch -x -H ldap://10.0.0.1 -b dc=example,dc=com. The `ldapsearch` command with `-x` (simple authentication), `-H ldap://10.0.0.1` (specifying the LDAP URI), and `-b dc=example,dc=com` (setting the search base DN) directly performs an anonymous LDAP search against the server. If the server is reachable and the base DN exists, it returns entries, confirming both connectivity and the validity of the base DN. This matches the configuration in `/etc/nslcd.conf` and is the standard tool for testing LDAP server responses.

Answer

authconfig --test

Answer

getent passwd

Answer

nslcd -d

Question 13

In a PAM configuration file, which control flag is used for modules that are not required but can provide additional functionality?

Accepted Answer

optional. In PAM (Pluggable Authentication Modules) configuration files, the 'optional' control flag indicates that the module's success or failure is not critical to the overall authentication result. It is used for modules that provide additional functionality, such as logging or session recording, without affecting whether access is granted or denied. This allows administrators to add supplementary checks without breaking existing authentication flows.

Answer

required

Answer

sufficient

Answer

requisite

Question 14

Which of the following is a valid NTP configuration file directive to specify a broadcast client?

Accepted Answer

broadcastclient. Option D is correct because the `broadcastclient` directive in an NTP configuration file instructs the NTP daemon to listen for NTP broadcast messages on the local network. This is the standard way to configure a client to synchronize time from a broadcast server without specifying individual server addresses.

Answer

peer

Answer

server

Answer

broadcast

Question 15

Which directive in ntp.conf enables the NTP server to respond to queries from clients?

Accepted Answer

restrict. The `restrict` directive in ntp.conf controls access to the NTP server, including whether it responds to client queries. By default, NTP servers restrict all access; adding a `restrict` line with the `nomodify` and `notrap` flags (or no restrictive flags) allows clients to query the server. Option C is correct because `restrict` is the directive that explicitly permits or denies NTP queries from clients.

Answer

broadcast

Answer

peer

Answer

server