Linux Professional Institute Certification Level 2 LPIC-2 (LPIC-2) — Questions 376–450

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because `aa-disable` completely disables the AppArmor profile, removing all confinement and logging, which does not help learn required accesses. Option C is wrong because `aa-enforce` puts the profile into enforce mode, which actively blocks denied operations, the opposite of what is needed for learning. Option D is wrong because `aa-log` is not a valid AppArmor command; AppArmor uses `aa-logprof` to analyze logs, but that is for reviewing denials after running in complain mode, not for setting the mode itself.

Why this answer

How to eliminate wrong answers

Option A is wrong because /proc/config.gz is a compressed representation of the current kernel's configuration, but it is only available if the kernel was built with CONFIG_IKCONFIG_PROC enabled; it is not a guaranteed file on all systems and is not the standard reference file for building modules. Option C is wrong because /boot/System.map-5.10.0-9-amd64 contains kernel symbol addresses used for debugging and resolving kernel oopses, not the kernel build configuration. Option D is wrong because /boot/initrd.img-5.10.0-9-amd64 is an initial ramdisk image used during boot to load necessary drivers and mount the root filesystem, and it has no role in providing kernel build configuration.

Why this answer

How to eliminate wrong answers

Option A is wrong because `peer` configures symmetric active association for mutual time synchronization between two NTP servers, not for a client listening to broadcasts. Option B is wrong because `server` specifies a unicast NTP server address for direct client-server polling, not a broadcast client mode. Option C is wrong because `broadcast` is used on the server side to enable sending NTP broadcast packets, not on the client side to receive them.

Why this answer

How to eliminate wrong answers

Option A is wrong because the rule specifically matches the NEW state, not ESTABLISHED; established connections are handled by a separate rule (not shown) or the default policy. Option C is wrong because the default policy is ACCEPT (as indicated by the chain policy being ACCEPT in the output), not DROP, so SSH connections are not dropped by default. Option D is wrong because the rule applies to eth0, not the loopback interface (lo); there is no restriction to loopback, and SSH on eth0 is explicitly allowed.

Why this answer

How to eliminate wrong answers

Option A is wrong because /proc/scsi/scsi is a read-only file that displays SCSI device information; writing 'scan' to it has no effect and is not a valid method to rescan the bus. Option B is wrong because blockdev --rereadpt /dev/sdc only re-reads the partition table of an already recognized disk; it does not rescan the SCSI bus to discover a new disk that is not yet present in the system. Option C is wrong because there is no standard 'scsi' service in Linux; the correct way to manage SCSI hosts is through sysfs or by removing/re-adding the host adapter via /sys/class/scsi_host/.

Why this answer

How to eliminate wrong answers

Option B is wrong because it restricts john to only the '/bin/ls' command, not 'any command' as required. Option C is wrong because it lacks the 'NOPASSWD' tag, so john would still be prompted for a password when executing commands as root. Option D is wrong because 'PASSWD:ALL' explicitly requires a password (which is the default behavior), and the 'PASSWD' tag is redundant here; it does not grant passwordless execution.

Why this answer

How to eliminate wrong answers

Option A is wrong because mkfs.ext4 attempts to create a filesystem on /dev/md0, but the RAID device does not exist yet; the array must be created first. Option C is wrong because pvcreate is used to prepare physical volumes for LVM, not for creating a RAID array; it would be appropriate only if the goal were to use LVM on top of RAID. Option D is wrong because fdisk is used for partitioning disks, but the question states that /dev/sdb1 and /dev/sdc1 are already partitions; repartitioning them is unnecessary and would destroy existing data or partition tables.

Why this answer

How to eliminate wrong answers

Option A is wrong because exporting DRBD via NFS and using a load balancer does not provide automatic failover of the DRBD resource itself; NFS adds a single point of failure and the load balancer cannot handle DRBD state transitions. Option B is wrong because manual failover using drbdadm requires human intervention, which violates the automatic failover requirement. Option C is wrong because Heartbeat alone is a legacy cluster manager that lacks the advanced resource management and fencing capabilities of Pacemaker; while it can promote the secondary, it does not support Primary/Primary mode and is not the recommended stack for modern DRBD high-availability setups.

Why this answer

How to eliminate wrong answers

Option A is wrong because `broadcast` configures the NTP server to send broadcast or multicast packets to clients, not to respond to client queries; it is a one-way announcement mode. Option B is wrong because `peer` configures symmetric active association with another NTP server for mutual synchronization, not to respond to client queries. Option D is wrong because `server` configures the local NTP daemon to synchronize to an upstream NTP server, not to respond to client queries.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because unmounting the logical volume causes downtime, which contradicts the requirement to keep the application operational with minimal disruption. Option B is wrong because using dd to clone a mounted XFS filesystem can result in an inconsistent backup due to ongoing writes and metadata changes during the copy, leading to potential corruption. Option C is wrong because cp -a cannot copy the contents of an unmounted snapshot volume directly; the snapshot must be mounted first to access its filesystem, and cp -a would require mounting to read the data.

Why this answer

How to eliminate wrong answers

Option B is wrong because it only adds an ACCEPT rule for SSH on eth0, leaving the default policy (typically ACCEPT) to allow SSH on eth1 as well, thus not restricting SSH to the public network only. Option C is wrong because the first rule drops all SSH traffic regardless of interface, and the second rule attempts to accept SSH on eth0, but due to iptables' first-match order, the DROP rule will match first for all SSH packets (including those on eth0), effectively blocking SSH everywhere. Option D is wrong because it drops all SSH traffic on all interfaces, completely blocking SSH access from both public and private networks.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because bridge_stp on enables Spanning Tree Protocol, which actually introduces a forward delay (default 15 seconds) and would not cause the bridge to fail forwarding; it would only delay it. Option C is wrong because bridge_maxwait is not a standard bridge configuration parameter; the correct parameter for maximum wait time is maxwait, but it controls the delay before the bridge starts, not the forward delay. Option D is wrong because up ip link set br0 up is a command to bring the interface up, but the bridge is already up after reboot; the issue is that the bridge is not forwarding due to the forward delay, not that it is down.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because the FORWARD chain controls traffic routed through the server, not traffic destined to the server itself; SSH connections to the server are handled by the INPUT chain, so a DROP policy on FORWARD has no effect on incoming SSH. Option B is wrong because it states the SSH rule is missing source IP restriction, which is actually the correct diagnosis (same as D), but the answer choice is labeled as incorrect in the question; the correct answer is D, not B. Option C is wrong because if the default policy for INPUT is DROP, then all incoming traffic would be blocked by default, and the ESTABLISHED,RELATED rule only permits return traffic for already established connections, not new SSH connections; thus SSH would not work at all under that default policy.

Why this answer

How to eliminate wrong answers

Option B is wrong because `dhcpd -cf /etc/dhcp/dhcpd.conf` starts a DHCP server, not a relay agent; it would attempt to serve addresses locally rather than forward broadcasts to a remote server. Option C is wrong because `iptables -A INPUT -i eth0 -p udp --dport 67 -j REDIRECT` redirects incoming DHCP requests to a local process, but it does not forward them to a remote server and violates the intended relay functionality (REDIRECT is for local socket redirection, not forwarding). Option D is wrong because `dnsmasq -i eth0` starts a combined DNS/DHCP server, not a dedicated relay agent; while dnsmasq can act as a relay with specific options (e.g., `--dhcp-relay`), the plain `-i eth0` flag only binds the service to that interface and does not enable relay mode.

Why this answer

How to eliminate wrong answers

Option A is wrong because `pam_radius.so` is used for RADIUS-based authentication, which can support two-factor authentication but is not a TOTP-specific module; it relies on an external RADIUS server (e.g., with token support) rather than implementing TOTP directly on the system. Option B is wrong because `pam_ldap.so` authenticates against an LDAP directory (e.g., OpenLDAP or Active Directory) and does not provide any one-time password or TOTP functionality. Option C is wrong because `pam_krb5.so` implements Kerberos authentication, which uses tickets and symmetric-key cryptography, not time-based one-time passwords.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because 'ip route show cache' displays the routing cache (which is deprecated in modern kernels and not used for policy routing verification), not the rule matching behavior. Option C is wrong because 'ip rule show' lists the configured policy rules but does not simulate a packet or show which rule is actually matched for a specific traffic flow. Option D is wrong because 'ip route show table all' dumps all routing tables but provides no insight into which rule triggers which table for a given packet.

Why this answer

How to eliminate wrong answers

Option A is wrong because `ip route with priority` is not a valid mechanism for traffic shaping; the `ip route` command manages routing table entries and can set route metrics or preferences, but it does not provide per-packet prioritization or bandwidth control. Option C is wrong because `tcpdump` is a packet capture and analysis tool, not a traffic control tool; it cannot shape or prioritize traffic, only observe it. Option D is wrong because while `iptables` with the mangle table can mark packets for later classification, it does not perform traffic shaping or prioritization itself; the actual queuing and scheduling must be handled by `tc`.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because /etc/resolv.conf only configures DNS resolver settings (nameservers, search domains), not routing or default gateways. Option B is wrong because /etc/network/routes is not a standard file in the ifupdown framework; routing is handled via the 'up' or 'post-up' directives in /etc/network/interfaces or through separate route files in /etc/network/if-up.d/. Option C is wrong because /etc/sysconfig/network is used by Red Hat-based distributions (e.g., RHEL, CentOS) with the initscripts or NetworkManager, not by Debian/Ubuntu systems using ifup/ifdown.

Why this answer

How to eliminate wrong answers

Option B (pam_securetty.so) is wrong because it restricts root logins to terminals listed in /etc/securetty, not to the /etc/nologin file. Option C (pam_access.so) is wrong because it controls access based on rules in /etc/security/access.conf, not the /etc/nologin file. Option D (pam_lastlog.so) is wrong because it records login timestamps and displays the last login message, and has no role in denying access based on /etc/nologin.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'printable = yes' is already present in the configuration, and it is required for a print share; its absence would prevent printing, not driver uploads. Option B is wrong because /var/spool/samba is the correct default spool directory for Samba print jobs; changing it would not affect driver uploads. Option D is wrong because 'browseable = no' only hides the share from network browsing (e.g., in Windows Explorer), but does not prevent Windows clients from connecting directly via the printer path or uploading drivers; driver discovery and upload use the printer's UNC path, not browsing.

Why this answer

How to eliminate wrong answers

Option B is wrong because `allow hosts` is not a valid Samba parameter; the correct syntax is `hosts allow` (with the keyword order reversed). Option C is wrong because `browseable` controls whether the share appears in network browse lists, not IP-based access restrictions. Option D is wrong because `valid users` restricts access based on usernames or groups, not client IP addresses.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because `swapcreate` is not a standard Linux command; the correct command to initialize a swap partition is `mkswap`. Option C is wrong because `swapon` alone only activates an already-initialized swap partition; it does not create the swap filesystem or signature, so it would fail on a raw partition. Option D is wrong because `mkfs.swap` is not a valid command; the proper utility for setting up swap is `mkswap`, not a variant of `mkfs`.

Why this answer

How to eliminate wrong answers

Option B is wrong because changing the SSH port to a non-standard port only obscures the service from casual scans but does not prevent privilege escalation from the compromised 'www-data' user; the attacker can still connect via SSH if credentials are compromised or use other lateral movement techniques. Option C is wrong because running the web application in a chroot jail can limit filesystem access but does not prevent the 'www-data' user from using sudo if a misconfigured sudo rule exists, as chroot does not restrict process capabilities or sudo execution. Option D is wrong because implementing AppArmor profiles can confine the web application's behavior and system calls, but it does not directly address the misconfigured sudo rule; an attacker could still execute 'sudo' commands if the rule is present, as AppArmor typically does not restrict sudo execution unless specifically profiled.

Why this answer

How to eliminate wrong answers

Option A is wrong because `grub-mkconfig -o /boot/grub/grub.cfg` only generates the GRUB configuration file from templates; it does not install any boot code to the MBR or disk. Option B is wrong because `update-grub` is a wrapper script that calls `grub-mkconfig` to regenerate the configuration file; it performs no installation to the MBR. Option C is wrong because `grub-install /dev/sda1` attempts to install GRUB to a partition (e.g., /dev/sda1), which is incorrect for MBR booting—GRUB must be installed to the whole disk device (e.g., /dev/sda) to write to the MBR, not to a partition block device.

Why this answer

How to eliminate wrong answers

Option A is wrong because it suggests the packet exits eth0 first and then eth1 after ARP, which implies a multi-hop path that is not indicated by the routing table; the packet is routed directly via the interface with a matching route, not sequentially through multiple interfaces. Option B is wrong because eth0 is on the 192.168.1.0/24 subnet, which does not have a route to 10.0.0.5; the packet would be dropped or sent to a default gateway, not exit eth0. Option D is wrong because the loopback interface (lo) is only used for traffic destined to the local host (127.0.0.0/8), not for traffic to a remote network like 10.0.0.5.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because permit_sasl_authenticated in smtpd_recipient_restrictions controls whether authenticated clients are allowed to relay mail, not whether authentication itself succeeds; authentication failures occur before this restriction is evaluated. Option B is wrong because Dovecot does not need to listen on TCP port 143 for IMAP to provide SASL authentication to Postfix; Postfix communicates with Dovecot via the local auth socket, not over IMAP. Option C is wrong because mynetworks defines trusted networks for relay control and does not affect SASL authentication; misconfiguration of mynetworks would cause relay access errors, not authentication failures.

Why this answer

How to eliminate wrong answers

Option A is wrong because joining as a 'member' creates a domain member server, not a domain controller; promoting it to RODC afterward is not a supported workflow in Samba 4.11 and would lack the pre-created RODC account. Option B is wrong because 'samba-tool domain provision' creates a new domain, which is incorrect for adding a RODC to an existing domain; it would overwrite the domain configuration and cause a conflict. Option D is wrong because while the join command syntax is close, it omits the critical prerequisite step of pre-creating the RODC account on the existing DC; without this, the join will fail as Samba requires the RODC computer object and associated krbtgt account to exist beforehand.

Why this answer

How to eliminate wrong answers

Option B is wrong because the kernel does not assign names randomly; it uses deterministic rules from udev or the biosdevname utility to avoid conflicts. Option C is wrong because a faulty network card would not cause the kernel to rename it; the name change is a deliberate design choice for consistency, not a fault response. Option D is wrong because 'enp0s3' is not specific to virtual devices; it is used for physical interfaces as well, and virtual interfaces typically get names like 'eth0' or 'ens3' depending on the hypervisor.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'install pcspkr /bin/false' would override the module's install command, but it does not prevent the module from being loaded by dependencies or alias resolution; it only replaces the load action with a false return, which may still trigger unwanted side effects and is not the standard blacklist mechanism. Option B is wrong because 'pcspkr=off' is not a valid kernel parameter; the kernel does not have a built-in parameter to disable a specific module by name, and GRUB parameters are used for kernel command-line options, not for module blacklisting. Option D is wrong because removing the module file from the filesystem is not a supported or safe method; it can break package management, prevent future updates, and may cause system instability, and the module could be reinstalled by updates or kernel upgrades.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because port security with a maximum MAC address count restricts which devices can connect to a port based on MAC addresses, but it does not isolate traffic at Layer 2; it only controls access. Option C is wrong because configuring switch ports as part of a bridge group is not a standard VLAN isolation technique; bridge groups are used in routing contexts (e.g., on routers or Linux bridges) and do not provide the per-port VLAN segmentation required here. Option D is wrong because trunk mode is used to carry traffic for multiple VLANs between switches or to routers, not to assign an end device to a single VLAN; setting a port to trunk mode would expect tagged frames and would not isolate the development team's traffic.

Why this answer

How to eliminate wrong answers

Option A is wrong because the initiator name is typically set automatically during package installation (e.g., in /etc/iscsi/initiatorname.iscsi) and is not required for a single session; a missing name would cause a different error, not a silent failure to appear as a block device. Option B is wrong because if the IQN were incorrect, `iscsiadm` would return an explicit authentication or login failure, not a scenario where the target is known to be online and reachable yet no block device appears. Option D is wrong because the network interface being down would prevent the target from being reachable at all, contradicting the premise that the target is known to be online and reachable.

Why this answer

How to eliminate wrong answers

Option B is wrong because it attempts to resize the filesystem before extending the logical volume; `resize2fs` will fail or do nothing if the underlying block device has no additional space. Option C is wrong because `mount -o remount` does not resize the filesystem; it only remounts the filesystem with new options, and the filesystem must be explicitly resized after the logical volume is extended. Option D is wrong because it includes `e2fsck -f` unnecessarily before `resize2fs`; while a filesystem check is not harmful, it is not required for extending an ext4 filesystem, and the correct sequence is to extend the logical volume first, then resize the filesystem.

Why this answer

How to eliminate wrong answers

Option A is wrong because smtpd_helo_restrictions controls restrictions based on the HELO/EHLO command, not recipient relaying; it does not include permit_mynetworks, so internal hosts would be blocked unless authenticated. Option B is wrong because it places reject_unauth_destination before permit_mynetworks and permit_sasl_authenticated, causing legitimate internal or authenticated relays to be rejected before they are allowed. Option C is wrong because smtpd_client_restrictions only checks the client IP/hostname and does not evaluate SASL authentication or recipient destination, so authenticated users would still be blocked if not in mynetworks.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because even if the path does not exist or has incorrect permissions, the error would typically occur after authentication succeeds, not prevent the users from connecting at all. Option B is wrong because 'read only = no' is a valid and correctly spelled parameter in smb.conf; 'writable = yes' is an alias, not a required replacement. Option D is wrong because the 'valid users' parameter can list individual usernames directly without any prefix; the '@' prefix is only needed when specifying group names.

Why this answer

How to eliminate wrong answers

Option A is wrong because log file size or overwriting would cause missing older logs, not a failure to log specific commands; auditd continues to log new events regardless of rotation. Option B is wrong because if the kernel lacked audit support, auditd would fail to start entirely and no rules would be processed, but the question states that some logging (e.g., time changes) is occurring, proving audit is functional. Option C is wrong because the adjtimex syscall rule is syntactically correct and does not prevent other rules from being processed; auditd rules are independent and do not block each other.

Why this answer

How to eliminate wrong answers

Option B is wrong because while `brctl addbr br0` and `brctl addif br0 eth0 eth1` can create a bridge and add interfaces, the `brctl addif` command only accepts one interface at a time; adding two interfaces in one command (eth0 eth1) is syntactically invalid and will fail. Option C is wrong because `ifconfig br0 create` is not a valid command; `ifconfig` does not support creating bridge interfaces—it only configures existing ones, and the `create` argument is used for virtual interfaces like VLANs, not bridges. Option D is wrong because both A and B do not work correctly; B has a syntax error and C is entirely invalid.

Why this answer

How to eliminate wrong answers

Option A is wrong because the `recycle` VFS module is used to implement a recycle bin for deleted files, not for ACL mapping. Option B is wrong because the `full_audit` VFS module is used for logging Samba operations, not for storing or mapping NT ACLs. Option C is wrong because the `streams_xattr` VFS module is used to support NTFS alternate data streams by storing them in extended attributes, but it does not handle NT ACL to POSIX ACL mapping.

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling recursion ('recursion yes;') would allow the server to perform recursive queries on behalf of external clients, which is unnecessary for authoritative responses and introduces security risks like amplification attacks; the problem is not about recursion but about query permissions. Option B is wrong because 'listen-on' already includes the external IP (203.0.113.10), so adding a separate listen-on statement for port 53 is redundant and does not address the access control issue. Option D is wrong because changing 'listen-on' to '{ any; };' would make the server listen on all interfaces, which is already effectively achieved by listing the specific IPs; the real issue is the restrictive 'allow-query', not the listening interfaces.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'SSLProtocol all -SSLv2 -SSLv3' still enables all protocols except SSLv2 and SSLv3, which includes TLS 1.0 and TLS 1.1 — these are below TLS 1.2 and do not satisfy the requirement to disable all TLS versions below 1.2. Option B is wrong because adding 'SSLProtocol -SSLv3' after the existing line would override the previous directive (Apache uses the last directive for a given context), resulting in only disabling SSLv3 while re-enabling all other protocols (including SSLv2 and TLS 1.0/1.1), which fails to disable TLS below 1.2. Option D is wrong because 'SSLProtocol TLSv1.2 TLSv1.3 -SSLv2 -SSLv3' is redundant and syntactically incorrect — the '-SSLv2' and '-SSLv3' flags are unnecessary since explicitly listing TLSv1.2 and TLSv1.3 already excludes all other protocols, and Apache may ignore or misinterpret the extra negations.

Why this answer

How to eliminate wrong answers

Option A is wrong because /etc/udev/rules.d/ is a directory containing custom user-defined udev rules, not the primary configuration file. Option B is wrong because /lib/udev/rules.d/ is a directory for system-provided default rules, not the configuration file. Option C is wrong because /etc/udev/rules.d/ is a directory, not a file; the primary configuration file is /etc/udev/udev.conf.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option B is wrong because the web server in the DMZ can route back to internal clients via the router's eth1 interface; the router has a route to 192.168.1.0/24 via eth2, so return traffic is not blocked by routing. Option C is wrong because the FORWARD rule for return traffic matches packets with source port 80, regardless of destination; the issue is not the return rule but the lack of a forward rule for the initial connection from eth2 to eth1. Option D is wrong because IP forwarding is enabled globally (the administrator enabled it), and it applies to all interfaces; there is no per-interface setting for IP forwarding in Linux.

Why this answer

How to eliminate wrong answers

Option B is wrong because disabling 'winbind use default domain' would force users to always use full domain qualification (e.g., 'MYDOM\jdoe'), which contradicts the goal of simplifying logins and does not fix the separator mismatch. Option C is wrong because the quotes around the group name in the valid users line are syntactically correct in Samba; they do not cause authentication failures, and removing them would not resolve the separator issue. Option D is wrong because 'winbind offline logon' is used for caching credentials for offline access, not for fixing username mapping or separator problems in a domain member configuration.

Why this answer

How to eliminate wrong answers

Option A is wrong because not updating GRUB configuration would typically result in the system booting the old kernel, not a hang with the new kernel; the new kernel is already selected and booting, so GRUB is not the issue. Option C is wrong because depmod updates module dependencies in /lib/modules/<kernel-version>, but the kernel can still boot without it; the hang occurs before init due to missing root filesystem access, not module loading order. Option D is wrong because if the root filesystem setting were incorrect, the kernel would likely panic with a 'VFS: Unable to mount root fs' message, not hang silently before init; the hang suggests the initramfs is missing or incomplete.

Why this answer

How to eliminate wrong answers

Option A is wrong because the destination IP 10.0.1.10 is directly connected to the router (assuming it is a public IP on eth0 or a DMZ), so the packet is not dropped for being not directly connected. Option B is wrong because the default gateway is used for forwarding packets to external networks, not for handling packets destined to a local IP that has a NAT rule applied. Option C is wrong because DNAT only changes the destination IP and port, not the source IP; source IP modification would require source NAT (SNAT) or masquerading, which is not indicated.

Why this answer

How to eliminate wrong answers

Option A is wrong because `security = domain` requires the Samba server to be a member of a Windows domain and relies on a domain controller for authentication, which is overkill and not necessary for a simple authenticated share without further restrictions. Option B is wrong because `security = server` is deprecated and delegates authentication to another SMB server, which adds complexity and is not the standard way to require user credentials for a local share. Option C is wrong because `security = share` allows access without per-user authentication (often using a guest or anonymous connection), which directly contradicts the requirement that users must provide valid credentials.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because HTTP (Hypertext Transfer Protocol) is a stateless application protocol for web content transfer, not designed for file sharing with Windows SMB semantics or authentication. Option B is wrong because AFP (Apple Filing Protocol) is Apple's proprietary protocol for macOS file sharing, not used by Windows clients. Option D is wrong because NFS (Network File System) is a Unix/Linux-centric protocol (RFC 1813, 3530) that lacks the native authentication and locking mechanisms required by Windows clients.

Why this answer

How to eliminate wrong answers

Option A is wrong because `--clearsign` creates a detached or inline clear-text signature, not encryption; it does not encrypt the file content. Option B is wrong because `--encrypt` without `--symmetric` defaults to public-key encryption, which requires a recipient's key rather than a shared passphrase. Option C is wrong because `--sign` only creates a digital signature, leaving the file unencrypted; it does not perform any encryption.

Why this answer

How to eliminate wrong answers

Option A is wrong because `usb_storage` has a 'Used by' count of 0, meaning no other module is currently using it. Option B is wrong because `kvm_intel` has a 'Used by' count of 0, indicating it is not currently in use by another module; it is a dependency of `kvm` but not used by another module at this moment. Option C is wrong because `aesni_intel` has a 'Used by' count of 0, showing no other module depends on it currently.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'netns add test' is not a valid command; the correct syntax requires the 'ip' prefix to invoke the iproute2 tool. Option B is wrong because 'network namespace add test' is not a valid Linux command; the proper command uses 'ip netns' and not the full phrase 'network namespace'. Option D is wrong because 'ip netns create test' uses the incorrect subcommand 'create'; the correct subcommand is 'add', as 'create' is not recognized by the ip netns utility.

Why this answer

How to eliminate wrong answers

Option A is wrong because privilege escalation attempts involve gaining higher-level permissions after initial access, not repeated login failures from external sources. Option B is wrong because man-in-the-middle attacks intercept or modify communications between two parties, which would show ARP spoofing or SSL certificate mismatches, not SSH authentication failures. Option C is wrong because DDoS attacks flood a target with traffic to overwhelm resources, which would show high packet rates or connection timeouts, not sequential login attempts.

Why this order

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the warning is about /var/log/syslog, not the SHA512 hash of /var/log itself; AIDE computes hashes for monitored files, but if the directory entry is monitored without recursion, file content changes are not hashed. Option C is wrong because AIDE's default configuration for /var/log often includes permission checks but does not include content hashes for files inside the directory unless recursive rules are specified; the issue is not about missing hashes but about the scope of monitoring. Option D is wrong because the +c flag in AIDE checks for changes in the file's ctime (inode change time), but this flag applies to the monitored entry itself; if /var/log is monitored as a directory, the ctime of the directory does not change when a file inside it is modified, so syslog changes are not detected via ctime.

Why this answer

How to eliminate wrong answers

Option B is wrong because editing /etc/default/grub and running update-grub makes permanent changes to the GRUB configuration, affecting all future boots, not just the next boot. Option C is wrong because pressing 'c' enters the GRUB command-line interface, which is used for manual commands like ls or insmod, not for editing kernel boot parameters for the next boot. Option D is wrong because pressing 'Esc' typically exits the GRUB menu or returns to the previous screen, not providing access to an advanced options menu for modifying kernel parameters.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'masters' is a slave-side directive that tells the secondary where to request the zone from; it does not change the master's access control. Option C is wrong because 'notify yes;' is a master-side directive that sends NOTIFY messages to slaves when the zone changes, but it does not override the 'allow-transfer' restriction; the transfer itself will still be denied. Option D is wrong because 'also-notify' specifies additional IPs to send NOTIFY messages to, but like 'notify', it does not grant transfer permission; the secondary must still be allowed by 'allow-transfer'.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because ServerLimit sets the maximum number of child processes that can be created, not the number of idle processes; adjusting it upward would allow more processes, worsening memory usage. Option B is wrong because MaxRequestWorkers (formerly MaxClients) limits the total number of concurrent connections (or threads) that can be served, not the number of idle child processes; reducing it would cap overall load but not specifically target idle processes. Option C is wrong because KeepAliveTimeout controls how long an idle keep-alive connection is kept open before closing, which affects connection reuse but does not directly reduce the number of idle child processes; it can actually increase idle processes if set too high.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the DNS timeout in /etc/resolv.conf would make resolution slower, not faster, as it extends the wait time for DNS responses. Option C is wrong because installing nscd adds overhead and does not change the order of resolution; it caches results but still processes the entire /etc/hosts file first when 'files' is listed before 'dns'. Option D is wrong because removing entries from /etc/hosts is unnecessary and may break local name resolution for static mappings; the issue is the lookup order, not the file's content size.