LPIC-2 Network Client Management Practice Test 7 — 15 Questions

Question 1

A system administrator configures a Linux client to authenticate users via an LDAP directory directory for user login. The LDAP server is located on a remote network across a WAN link with moderate latency. Authentication succeeds, but user logins take 10-15 seconds to complete, causing delays. The LDAP server logs show low CPU usage and minimal queries per second. The client has not yet implemented any local caching services. The administrator wants to reduce the login delay without compromising security. What should the administrator do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable nscd (Name Service Cache Daemon) to cache passwd, group, and services lookups.. Nscd caches the results of name service lookups (passwd, group, hosts, services) in memory, eliminating repeated LDAP queries for the same user or group information. Since the client has no local caching, each login triggers multiple LDAP lookups (e.g., for user entry, group membership, and service resolution), and the WAN latency multiplies the delay. By caching these lookups, nscd reduces the number of round trips over the slow link, cutting login time from 10–15 seconds to near-instant without affecting LDAP TLS security or server configuration.

Answer

Disable LDAP TLS encryption to reduce cryptographic overhead.

Answer

Change the file ownership of /etc/pam.d/common-auth to root to force direct LDAP reads.

Answer

Increase the number of LDAP server threads to handle concurrent requests faster.

Question 2

A Linux server uses DHCP to obtain its IP address, but the administrator needs it to always receive the same address from the DHCP server. The server's MAC address is 00:1a:2b:3c:4d:5e and the DHCP server is ISC dhcpd. Which configuration should the administrator add to the DHCP server to ensure this?

Accepted Answer

host server1 { hardware ethernet 00:1a:2b:3c:4d:5e; fixed-address 192.168.1.50; }. To ensure a DHCP client always receives the same IP, the DHCP server must have a host declaration that maps the client's MAC address to a fixed IP using the fixed-address parameter. This is the correct method in ISC dhcpd. Other approaches like ranges or classes do not provide a guaranteed static assignment for a specific client.

Answer

class "server1" { match if substring(hardware,1,6) = 00:1a:2b:3c:4d:5e; }

Answer

subnet 192.168.1.0 netmask 255.255.255.0 { range 192.168.1.50 192.168.1.50; }

Answer

option fixed-address 192.168.1.50;

Question 3

An administrator needs to configure a Linux client to authenticate users against an LDAP server. After installing the necessary packages, they edit /etc/ldap/ldap.conf and set the URI to ldap://ldap.example.com. However, when they run 'getent passwd testuser', the command returns no output. The server is reachable and testuser exists in the LDAP directory. Which of the following is the most likely cause?

Accepted Answer

The /etc/nsswitch.conf file does not include 'ldap' for the passwd database.. The correct answer is that /etc/nsswitch.conf must include 'ldap' for the passwd database. Without this entry, the system will not query LDAP for user information, resulting in no output from getent. Even if LDAP client configuration is correct, the NSS configuration determines which sources are used for name service lookups. This is a common oversight when setting up LDAP authentication.

Answer

The LDAP server requires TLS, but the URI uses ldap:// instead of ldaps://.

Answer

The LDAP client does not have a valid bind DN and password configured in /etc/ldap/ldap.conf.

Answer

The /etc/ldap/ldap.conf file should be /etc/openldap/ldap.conf on this system.

Question 4

A network administrator needs to set up a Linux router that forwards packets between two internal networks. The router has two interfaces: eth0 (192.168.1.1/24) and eth1 (10.0.0.1/24). After enabling IP forwarding, clients on 192.168.1.0/24 can reach 10.0.0.0/24, but clients on 10.0.0.0/24 cannot reach 192.168.1.0/24. What is the most likely cause?

Accepted Answer

The administrator forgot to add a route on the 10.0.0.0/24 clients pointing to 10.0.0.1 as the gateway.. For clients on 10.0.0.0/24 to reach 192.168.1.0/24, they must have a route to that network via the router at 10.0.0.1. Typically, this is done by setting a default gateway. If they lack this, they cannot send packets off their local subnet. The router's forwarding is already proven by the reverse traffic.

Answer

IP forwarding is not enabled on the router.

Answer

The router's firewall is blocking traffic from 10.0.0.0/24 to 192.168.1.0/24.

Answer

The subnet mask on eth1 is incorrect, causing the router to not recognize the 10.0.0.0/24 network.

Question 5

A junior administrator needs to see which DNS servers a systemd-resolved client is actually using for a specific network interface. Which command displays the current per-link DNS configuration?

Accepted Answer

resolvectl status. systemd-resolved maintains per-link resolver state, and resolvectl status is the tool that reports it, listing DNS servers, search domains, and related flags for each interface. Restarting the service, validating a BIND file, or issuing a single query does not reveal the per-link server list, so only the status command answers the question directly.

Answer

systemctl restart systemd-resolved

Answer

dig @127.0.0.53 example.com

Answer

named-checkconf /etc/resolv.conf

Question 6

An administrator manages a PAM stack where password quality must be enforced centrally. Users report that weak passwords are still accepted on one host even though pam_pwquality is configured. Which action ensures pam_pwquality is actually consulted during password changes?

Accepted Answer

Add 'password requisite pam_pwquality.so retry=3' to the password stack in /etc/pam.d/common-password before pam_unix.so.. Password strength enforcement happens in the password stack, and pam_pwquality must be positioned there with a control flag that fails the operation when the new password is inadequate. Using requisite ahead of pam_unix.so blocks weak passwords before they are written. Auth, account, and session stacks are involved in other phases of authentication and do not govern password changes.

Answer

Add 'session optional pam_pwquality.so' to the session stack in /etc/pam.d/login.

Answer

Add 'account required pam_pwquality.so' to the account stack in /etc/pam.d/password-auth.

Answer

Add 'auth required pam_pwquality.so' to the auth stack in /etc/pam.d/system-auth.

Question 7

An administrator is configuring a Samba server to share a directory with Windows clients. The share is defined in smb.conf with the path /srv/samba/share. The administrator wants to ensure that only users in the 'sales' group can access the share, and that new files created in the share are group-owned by 'sales'. Which TWO additional settings are required in the share definition to meet these requirements? (Choose two.)

Accepted Answer

valid users = @sales. The correct settings are 'valid users = @sales' and 'force group = sales'. The first restricts share access to members of the sales group, ensuring only they can connect. The second forces all newly created files and directories to be owned by the sales group, satisfying the group ownership requirement. Together, they meet both conditions. Other parameters like 'write list' or 'create mask' do not fully address the access restriction or group ownership.

Answer

create mask = 0770

Answer

browseable = no

Answer

write list = @sales

Question 8

A Linux server uses a DHCP client to obtain its network configuration. The administrator wants to ensure that the DHCP client sends a specific hostname to the DHCP server. Which configuration file should be edited to set the hostname sent by the DHCP client?

Accepted Answer

/etc/dhcp/dhclient.conf. The ISC DHCP client, dhclient, reads its configuration from /etc/dhcp/dhclient.conf. To send a specific hostname to the DHCP server, the administrator should add a line such as 'send host-name "myhost";' in this file. Other files mentioned are either for the DHCP server or distribution-specific network configuration, not the generic DHCP client configuration.

Answer

/etc/sysconfig/network-scripts/ifcfg-eth0

Answer

/etc/dhcp/dhcpd.conf

Answer

/etc/network/interfaces

Question 9

A Linux client uses NIS for user authentication. The administrator notices that users can log in, but their home directories are not automatically mounted from an NFS server. The NIS server exports an automount map named auto.home. Which file on the client must be configured to use this automount map?

Accepted Answer

/etc/auto.master. The correct file is /etc/auto.master. This file is read by autofs to determine which automount maps to use for specific mount points. To use the NIS auto.home map, an entry such as '/home yp:auto.home' must be added, which tells autofs to consult the NIS map for /home. Without this entry, autofs will not know to use the NIS map, and home directories will not be mounted automatically.

Answer

/etc/yp.conf

Answer

/etc/nsswitch.conf

Answer

/etc/auto.home

Question 10

A Linux server is configured as a Samba file server. The administrator wants to ensure that user passwords are stored in a separate LDAP directory and that Samba uses that directory for authentication. The LDAP server supports the sambaSamAccount schema. Which TWO steps are required to integrate Samba with LDAP for authentication? (Choose two.)

Accepted Answer

Configure 'ldap admin dn' and 'ldap suffix' in smb.conf to allow Samba to write to LDAP.. Integrating Samba with LDAP for authentication requires setting the passdb backend to ldapsam and providing the necessary LDAP connection details, including an administrative DN and base suffix. These two steps allow Samba to store and retrieve password hashes in LDAP. Local password tools and winbind are not part of this direct integration; winbind is for domain membership, not for ldapsam backend operation.

Answer

Run 'smbpasswd -a username' to add each user to the local Samba password database.

Answer

Enable the 'obey pam restrictions' parameter to force Samba to use PAM for authentication.

Answer

Install and configure the winbind daemon to map LDAP users to local accounts.

Question 11

A network administrator is configuring a Linux client to use an NIS server for user authentication. The NIS domain is set to 'example' and the server is at 192.168.1.10. After running 'ypbind' and editing /etc/nsswitch.conf to include 'nis' for passwd, shadow, and group, users still cannot log in. Which additional configuration is required to allow NIS authentication?

Accepted Answer

Set the NIS domain name with 'domainname example' or by editing /etc/defaultdomain.. The NIS client requires the system's NIS domainname to be set correctly. ypbind uses this domainname to locate and bind to the NIS server. Without it, ypbind cannot function, and NIS lookups fail, preventing logins. The domainname can be set with the domainname command or persistently in /etc/defaultdomain. Once set and ypbind restarted, NIS authentication should work if nsswitch.conf is properly configured.

Answer

Add the NIS server to /etc/hosts and set 'nis_server' in /etc/yp.conf.

Answer

Add 'nis' to the 'hosts' line in /etc/nsswitch.conf.

Answer

Start the 'ypserv' service on the client.

Question 12

A Linux server uses PAM for authentication. The administrator wants to ensure that after five failed login attempts, a user account is locked for 10 minutes. Which PAM module and configuration should be used?

Accepted Answer

pam_faillock.so with deny=5 and unlock_time=600. The pam_faillock.so module is designed to lock user accounts after a specified number of failed authentication attempts (deny=5) and automatically unlock them after a defined period (unlock_time=600 seconds). It is the current standard for this functionality, replacing the older pam_tally2.so. The other modules either lack these capabilities or are deprecated.

Answer

pam_unix.so with maxlogins=5 and lock_time=600

Answer

pam_tally2.so with deny=5 and unlock_time=600

Answer

pam_limits.so with deny=5 and unlock_time=600

Question 13

An administrator is troubleshooting a Samba server that is a member of an Active Directory domain. Users from the AD domain are unable to access a share that has 'valid users = @DOMAIN\staff' in its configuration. The administrator has verified that winbind is running and 'wbinfo -u' lists the domain users. Which action is most likely to resolve the access issue?

Accepted Answer

Ensure that the 'idmap config' lines in smb.conf define a range for the DOMAIN backend and that the domain SID is mapped.. When Samba is integrated with AD via winbind, it must map domain SIDs to local UIDs and GIDs using the idmap config parameters. If the domain's SID is not mapped, winbind may still list users, but group resolution for access checks fails. The valid users directive with @DOMAIN\staff requires that the group be resolved to a local GID. Proper idmap configuration ensures this mapping, allowing Samba to verify group membership and grant access.

Answer

Run 'net rpc join' again to rejoin the domain.

Answer

Set 'security = ads' and 'realm = DOMAIN.EXAMPLE.COM' in smb.conf.

Answer

Add 'winbind use default domain = yes' to smb.conf and restart Samba.

Question 14

An administrator is configuring a DHCP server using ISC dhcpd on a Linux system. The server must provide different DNS server addresses to clients on two different subnets. The subnets are 10.0.1.0/24 and 10.0.2.0/24, and the DHCP server is directly connected to both. Which configuration approach correctly assigns the appropriate DNS servers per subnet?

Accepted Answer

Define a global 'option domain-name-servers' and override it within each subnet declaration.. The correct method is to define a global option domain-name-servers as a default, then override it within each subnet declaration. This allows different DNS servers for each subnet while keeping common settings centralized. ISC dhcpd evaluates options hierarchically: global, then subnet, then host. Overriding at the subnet level ensures clients on 10.0.1.0/24 and 10.0.2.0/24 receive their respective DNS servers. This is efficient and standard practice.

Answer

Configure 'option domain-name-servers' in the 'host' declarations for each client.

Answer

Use 'class' declarations with 'match if' statements to assign DNS servers based on the client's MAC address.

Answer

Define separate 'subnet' declarations and place the 'option domain-name-servers' outside any subnet block.

Question 15

An administrator is troubleshooting a Linux client that uses LDAP for user authentication. The client is configured with nss-pam-ldapd and /etc/nsswitch.conf contains 'passwd: files ldap'. Users cannot log in, and the log shows 'nslcd: [8b4567] failed to bind to LDAP server: Invalid credentials'. Which action will most directly resolve the bind failure?

Accepted Answer

Verify and correct the binddn and bindpw credentials in /etc/nslcd.conf. The message 'failed to bind to LDAP server: Invalid credentials' points to nslcd being unable to authenticate to the directory. nslcd uses the binddn and bindpw directives from /etc/nslcd.conf to perform searches. If these are incorrect or absent, the bind fails and no user lookups can occur. Correcting the credentials to a valid account restores the bind and allows authentication to function.

Answer

Add 'ldap' to the shadow line in /etc/nsswitch.conf

Answer

Restart the nscd service to clear cached credentials

Answer

Change the LDAP URI in /etc/ldap/ldap.conf to use ldaps://