LPIC-2 restrict clause Practice Question
A company runs an NTP server that should only synchronize with trusted upstream servers and provide time to internal clients. Which restrict clause in ntp.conf would best secure the server against unauthorized queries?
⚠ Common exam trap
Many candidates choose option B because it includes many security flags, but they overlook that `restrict default` applies to all hosts not explicitly allowed, which would block the required upstream synchronization unless additional `restrict` lines are added for trusted servers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
restrict 192.168.0.0 mask 255.255.0.0 nomodify notrap
The best choice among the options because it restricts internal clients with `nomodify` and `notrap`, preventing them from altering the server's configuration or sending control message traps. However, to fully secure against unauthorized queries, a `restrict default ignore` or similar rule is needed; otherwise, external hosts can still query. Option B would block all hosts by default, requiring explicit allows for trusted upstream servers, which is less practical. Option A would block all queries entirely, including internal clients. Option D applies only to localhost and does not affect external queries. Thus, C is the most effective at securing against unauthorized queries while allowing internal client synchronization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
restrict default ignore
Why it's wrong here
Blocks all NTP packets, including time requests.
- ✗
restrict default kod nomodify notrap nopeer noquery
Why it's wrong here
Blocks all queries including time synchronization.
- ✓
restrict 192.168.0.0 mask 255.255.0.0 nomodify notrap
Why this is correct
Allows time synchronization from the subnet while blocking modifications.
- ✗
restrict 127.0.0.1
Why it's wrong here
Only allows localhost, not sufficient for clients.
Go deeper
Related to this question
About these practice questions
This LPIC-2 question is part of Courseiva's 507-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.