LPIC-2 Timed Practice Test 2 — 10 Questions

Question 1

Refer to the exhibit. A user in the group 'staff' attempts to access the share 'share' from a Windows client. The user is prompted for credentials and authenticates successfully, but cannot write any files. What is the most likely reason?

10 minute time limit — choose an answer to begin.

Accepted Answer

The share has read only = Yes, which prevents writes even for authenticated users.. The `read only = Yes` parameter in a Samba share definition explicitly prevents all write operations, even for authenticated users. When this parameter is set, Samba enforces read-only access at the share level, overriding any user or group permissions that might otherwise allow writes. Since the user authenticates successfully but cannot write, the most direct cause is this share-level restriction.

Answer

The passdb backend is set to tdbsam, which does not support write operations.

Answer

The share has guest ok = No, which prevents guest access.

Answer

The valid users parameter does not include the user.

Question 2

An administrator configures iptables on a Linux firewall with the following rules: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT; -A INPUT -p tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT; -A INPUT -j DROP. Users report that SSH connections are being dropped. What is the most likely cause?

Accepted Answer

The SSH rule should have -m state --state NEW to allow new connections.. The most likely cause is that the SSH rule only matches packets that are already part of an established or related connection. New SSH connections start with a SYN packet that is in the NEW state, so they are not matched by the second rule. They fall through to the final DROP rule and are dropped. Adding `-m state --state NEW` (or `-m state --state NEW,ESTABLISHED,RELATED`) to the SSH rule would allow new connections. Option A is incorrect because the default INPUT policy is not relevant when explicit DROP exists; B confuses source and destination ports; D is wrong because reordering does not change the state matching logic.

Answer

The default INPUT policy is DROP, so the last rule is redundant but harmless.

Answer

The rule for SSH uses --dport 22, but the source port is randomized; it should use --sport 22.

Answer

The established/related rule should come after the SSH rule.

Question 3

A firewall rule set is implemented using iptables. The administrator wants to allow incoming SSH connections only from the 192.168.1.0/24 subnet, while all other incoming traffic is dropped. Which set of rules achieves this?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -j DROP. It first adds a rule to accept TCP traffic on port 22 (SSH) from the 192.168.1.0/24 subnet, then adds a default DROP rule for all other incoming traffic. Since iptables processes rules in order, the ACCEPT rule matches allowed SSH connections first, and the subsequent DROP rule catches all other incoming packets, effectively dropping everything else including SSH from other sources.

Answer

iptables -A INPUT -p tcp --sport 22 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -j DROP

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j DROP

Answer

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP

Question 4

Which TWO commands can be used to list all currently listening TCP ports and the associated processes?

Accepted Answer

ss -tlnp. (ss -tlnp) is correct because the ss command with -t (TCP), -l (listening), -n (numeric), and -p (process) shows all listening TCP ports and their associated processes. Option C (netstat -tlnp) is correct because netstat with the same flags provides equivalent output, though ss is the modern replacement on many distributions.

Answer

lsof -i TCP -s TCP:LISTEN

Answer

fuser -v 80/tcp

Answer

nmap -sT localhost

Question 5

In Samba 4, what is the default security mode when no 'security' parameter is set in the [global] section?

Accepted Answer

user. In Samba 4, when no 'security' parameter is explicitly set in the [global] section, the default security mode is 'user'. This means clients must authenticate with a valid username and password, and Samba validates credentials against the local passdb backend (e.g., tdbsam or LDAP). This default has been consistent since Samba 3.x and ensures that each connection is tied to a specific user identity.

Answer

ads

Answer

share

Answer

domain

Question 6

A company wants to host multiple websites on a single Apache server with different domain names. Which approach is most appropriate?

Accepted Answer

Name-based virtual hosting. Name-based virtual hosting allows a single Apache server to serve multiple websites using the same IP address and port by relying on the HTTP Host header sent by the client. This is the most efficient and commonly used method for hosting multiple domains on one server, as it conserves IP addresses and requires minimal configuration via the `<VirtualHost *:80>` directive.

Answer

IP-based virtual hosting

Answer

Port-based virtual hosting

Answer

Using mod_rewrite for each domain

Question 7

Based on the smbstatus output, which statement is true?

Accepted Answer

User 'alice' connected from IP 192.168.1.10 using SMB3 protocol. The smbstatus output shows that user 'alice' is connected from IP address 192.168.1.10 and the 'Protocol' column explicitly lists 'SMB3_11', which is a variant of the SMB3 protocol. This directly matches the statement in option A that alice is using SMB3 protocol.

Answer

Both users are using SMB2 protocol

Answer

User 'bob' is accessing share2 with write permissions

Answer

User 'alice' has an exclusive lock on report.pdf

Question 8

A system with SELinux in enforcing mode is running a custom application that needs to write to a file in /data. The application's context type is 'myapp_t', and the target file context is 'default_t'. The file's current context is 'var_t'. Which command changes the file's context to allow access?

Accepted Answer

chcon -t default_t /data/file. `chcon -t default_t /data/file` directly changes the SELinux type of the file to `default_t`, which matches the type expected by the `myapp_t` domain's access rules. Since the application runs in enforcing mode and needs to write to a file with type `default_t`, this command immediately sets the correct context without modifying the policy or requiring a relabel.

Answer

fixfiles -F relabel /data

Answer

semanage fcontext -a -t default_t /data/file

Answer

restorecon /data/file

Question 9

Refer to the exhibit. The /data filesystem is nearly full. The administrator has added a new disk /dev/sdc with 10GB capacity. The VG currently has no free space. Which steps will increase the available space for /data using LVM and ext4?

Accepted Answer

pvcreate /dev/sdc; vgextend vg /dev/sdc; lvextend -l +100%FREE /dev/vg/data; resize2fs /dev/vg/data. It follows the proper LVM workflow: create a physical volume (pvcreate), add it to the volume group (vgextend), extend the logical volume using all free space in the VG (lvextend -l +100%FREE), and then resize the ext4 filesystem (resize2fs). This ensures the new 10GB disk is fully utilized for /data.

Answer

vgextend vg /dev/sdc; lvextend -L +10G /dev/vg/data; resize2fs /dev/vg/data

Answer

pvcreate /dev/sdc; lvextend -L +10G /dev/vg/data; resize2fs /dev/vg/data

Answer

pvcreate /dev/sdc; vgextend vg /dev/sdc; lvextend -l +50%FREE /dev/vg/data; resize2fs /dev/vg/data

Question 10

Which command will display the current VLAN membership of interface eth1?

Accepted Answer

bridge vlan show dev eth1. The `bridge vlan show dev eth1` command displays the current VLAN membership of a specific interface when the interface is part of a Linux bridge. This command queries the kernel's bridge VLAN filtering database, showing which VLAN IDs are tagged or untagged on the given port, which is the standard way to view VLAN membership in modern Linux networking.

Answer

vconfig list eth1

Answer

ip addr show eth1

Answer

cat /proc/net/vlan/eth1

Answer

ip link show eth1