LPIC-2 System Security Practice Question
A PAM configuration file for password authentication includes the line 'password requisite pam_cracklib.so retry=3 minlen=8'. A user tries to change their password but is rejected even though the new password meets the stated criteria. The administrator suspects a conflict with another PAM module. Which of the following is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume pam_cracklib is the sole arbiter of password validity, overlooking that PAM modules are evaluated sequentially and any module can reject the password independently, especially history-checking modules like pam_pwhistory.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Another PAM module such as pam_pwhistory.so might be configured to prevent reuse of old passwords, causing rejection even though pam_cracklib passes.
Pam_pwhistory.so is commonly used to enforce password history, preventing reuse of recent passwords. Even if pam_cracklib.so accepts the new password as meeting complexity and length requirements, pam_pwhistory.so can reject it if it matches a previously used password, leading to the observed failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Another PAM module such as pam_pwhistory.so might be configured to prevent reuse of old passwords, causing rejection even though pam_cracklib passes.
Why this is correct
pam_pwhistory checks the password against a history file; if the new password matches an old one, it fails.
- ✗
The 'retry=3' option limits attempts, but the password is only tried once.
Why it's wrong here
The retry count allows multiple attempts, but the rejection occurs even on first try.
- ✗
The 'requisite' control flag causes immediate failure if pam_cracklib fails, but another module might be overriding.
Why it's wrong here
Requisite fails immediately, but if pam_cracklib passes, it proceeds; the issue is subsequent modules.
- ✗
The 'minlen=8' option requires exactly 8 characters, not at least 8.
Why it's wrong here
minlen sets minimum length, not exact length.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.