Linux Professional Institute Certification Level 2 LPIC-2 LPIC-2 Questions 451–507 | Page 7/7

451

Multi-Selectmedium

An administrator is setting up a Samba share for a project team. The team members are in different UNIX groups. Which three options can be used to restrict access to specific users or groups? (Choose three.)

Select 3 answers

A.read list

B.write list

C.force group

D.invalid users

E.valid users

AnswersA, D, E

Specifies users and groups that have read-only access.

Why this answer

(read list) is correct because it explicitly restricts read-only access to a list of users or groups, allowing the administrator to control which users can only read files in the Samba share. This is a direct Samba parameter that limits access to specific users or groups, even if they are in different UNIX groups.

Exam trap

The trap here is that candidates often confuse 'write list' as a restriction mechanism, but it actually grants write access, not restricts it, while 'force group' is a red herring that deals with ownership, not access control.

Full explanation →

452

MCQmedium

A web server is running in enforcing mode under SELinux. The administrator wants to allow Apache to connect to a remote database server. Which SELinux boolean needs to be set to allow httpd to make network connections?

A.httpd_enable_homedirs

B.httpd_can_network_connect_db

C.httpd_can_network_connect

D.httpd_unified

AnswerB

Correct. This boolean is specifically designed to allow httpd to connect to remote database servers.

Why this answer

The SELinux boolean `httpd_can_network_connect_db` is specifically designed to allow the httpd process to connect to remote database servers. This boolean is more targeted than the generic `httpd_can_network_connect`, which permits all outbound TCP connections. Since the question explicitly mentions a remote database server, the specific boolean is the most appropriate choice.

Exam trap

The trap is that candidates might choose the generic `httpd_can_network_connect` thinking it covers all network connections, but the question specifies a remote database server, making the database-specific boolean `httpd_can_network_connect_db` the correct and more precise answer.

How to eliminate wrong answers

Option A is wrong because `httpd_enable_homedirs` controls whether httpd can read user home directories (e.g., for public_html), not network connections. Option B is wrong because `httpd_can_network_connect_db` is a more specific boolean that only permits connections to database ports (e.g., 3306 for MySQL, 5432 for PostgreSQL), but the question does not specify a database type and the correct general-purpose boolean is `httpd_can_network_connect`. Option D is wrong because `httpd_unified` is not a valid SELinux boolean; it may be confused with the `httpd_t` domain or the `unconfined` module, but it does not exist in standard SELinux policy.

Full explanation →

453

Multi-Selectmedium

Which TWO conditions must be met for a Linux bridge to forward traffic between its ports?

Select 2 answers

A.The bridge has an IP address.

B.The bridge has at least two ports added.

C.The kernel module bridge is loaded.

D.The interfaces are in promiscuous mode.

E.Spanning Tree Protocol is disabled.

AnswersB, C

Forwarding between ports requires at least two interfaces in the bridge.

Why this answer

A Linux bridge requires at least two ports to forward traffic; a bridge with only one port cannot forward frames between interfaces. Option C is correct because the bridge kernel module must be loaded (e.g., via `modprobe bridge`) to provide the bridging functionality; without it, bridge operations are impossible.

Exam trap

The trap here is that candidates often confuse the requirements for a bridge with those for a router, incorrectly assuming an IP address is necessary for forwarding, or they forget that the bridge kernel module must be explicitly loaded in Linux.

Full explanation →

454

MCQhard

A government agency runs a classified application on a Linux server with strict auditing requirements. The application writes sensitive data to a MySQL database. The auditor requires that all SQL queries executed by the application be logged with timestamps, user, and the full query text. Additionally, the audit logs must be immutable (cannot be altered by the application or any user except a designated auditor account). The database runs on the same server. Which combination of tools and configurations should the administrator deploy?

A.Enable auditd to monitor the MySQL process and log all system calls.

B.Enable MySQL's general query log, direct it to a file on a separate filesystem mounted with the 'noexec' and 'append' options, and set the file immutable with chattr +a.

C.Enable the MySQL audit log plugin and configure rsyslog to forward logs to a remote log server.

D.Use tcpdump to capture all network traffic to port 3306 and save to a file with packet captures.

AnswerB

The general query log logs plaintext queries; chattr +a makes the file append-only, preventing modification of existing logs.

Why this answer

It combines MySQL's general query log (which captures full query text, timestamps, and user) with filesystem-level immutability via `chattr +a` (append-only) on a separate filesystem mounted with `noexec` and `append` options. This ensures logs cannot be modified or deleted by the application or any non-auditor user, meeting the strict auditing requirement for immutable logs.

Exam trap

The trap here is that candidates may choose auditd (Option A) because it is a common auditing tool, but it cannot capture SQL query text, while MySQL's general query log directly logs queries and can be hardened with filesystem attributes for immutability.

How to eliminate wrong answers

Option A is wrong because `auditd` monitors system calls, not SQL query text; it would log file operations or process activity but cannot capture the full SQL query executed by MySQL. Option C is wrong because while the MySQL audit log plugin can log queries, forwarding logs via rsyslog to a remote server does not guarantee immutability on the local server; the auditor requires logs that cannot be altered by any user except a designated auditor account, and remote forwarding does not prevent local tampering. Option D is wrong because `tcpdump` captures raw network packets on port 3306, which would require decrypting MySQL protocol traffic (unless unencrypted) and does not provide structured query text, timestamps, or user information in a readable log format.

Full explanation →

455

MCQmedium

A filesystem created with mkfs.ext4 on /dev/sda1 has a reserved block count of 5%. How can the administrator reduce it to 1% without reformatting?

A.tune2fs -r 1 /dev/sda1

B.tune2fs -m 1 /dev/sda1

C.dumpe2fs -r 1 /dev/sda1

D.resize2fs -r 1 /dev/sda1

AnswerB

-m sets reserved blocks percentage.

Why this answer

The `-m` option of tune2fs sets the reserved block percentage for the filesystem. Since the question asks to reduce the reserved block count from 5% to 1% without reformatting, `tune2fs -m 1 /dev/sda1` correctly adjusts the reserved blocks percentage to 1% on the existing ext4 filesystem.

Exam trap

The trap here is confusing the `-m` (percentage) and `-r` (absolute block count) options of tune2fs, leading candidates to choose `-r 1` thinking it sets 1% when it actually sets only 1 block reserved.

How to eliminate wrong answers

Option A is wrong because `-r` sets the reserved block count to a specific number of blocks, not a percentage; `-r 1` would reserve only 1 block, not 1%. Option C is wrong because `dumpe2fs` is a read-only tool that displays filesystem information, it cannot modify reserved block counts. Option D is wrong because `resize2fs` is used to resize filesystems, not to change reserved block percentages.

Full explanation →

456

Multi-Selecteasy

Which THREE commands are specifically used to diagnose Samba issues?

Select 3 answers

A.smbstatus

B.testparm

C.smbtree

D.netstat

E.ping

AnswersA, B, C

Shows current Samba connections and locked files.

Why this answer

smbstatus is correct because it displays the current Samba connections, including active SMB sessions, open files, and locked files, which is essential for diagnosing who is accessing Samba shares and what resources are in use. It queries the Samba internal state via the smbd daemon, providing real-time diagnostic information about connected clients.

Exam trap

The trap here is that candidates may confuse general network troubleshooting tools (like netstat or ping) with Samba-specific diagnostic commands, assuming any network tool can diagnose Samba issues, but only commands that directly interact with Samba daemons or its configuration are valid for this purpose.

Full explanation →

457

MCQhard

A Samba server configured as an Active Directory domain member is unable to authenticate users from the domain. The administrator verifies that DNS resolution works, but `wbinfo -u` returns no output. What is the most likely cause?

A.The smb.conf file is missing the 'idmap config' lines.

B.The winbind service is not running.

C.The Kerberos ticket is expired.

D.The system clock is not synchronized with the domain controller.

AnswerB

If winbind is not running, `wbinfo -u` cannot retrieve domain users.

Why this answer

The `wbinfo -u` command queries the winbind service to list domain users. If it returns no output, the most likely cause is that the winbind service is not running, as it is responsible for resolving Windows domain users and groups on a Samba member server. Without winbind, Samba cannot authenticate domain users even if DNS and Kerberos are working correctly.

Exam trap

The trap here is that candidates assume DNS or Kerberos issues are the root cause because they are common in domain authentication problems, but the specific symptom of `wbinfo -u` returning no output directly points to the winbind service not running, not to higher-layer protocol failures.

How to eliminate wrong answers

Option A is wrong because missing 'idmap config' lines in smb.conf would cause issues with mapping domain users to UIDs/GIDs, but `wbinfo -u` would still return usernames if winbind is running and can contact the domain controller. Option C is wrong because an expired Kerberos ticket would cause authentication failures (e.g., 'kinit' errors), but `wbinfo -u` does not rely on a cached TGT; it uses the machine account credentials via winbind. Option D is wrong because clock skew with the domain controller would cause Kerberos authentication failures, but `wbinfo -u` would still work if winbind is running and the clock difference is within default tolerances (typically 5 minutes).

Full explanation →

458

MCQmedium

Refer to the exhibit. A DNS query for 'ftp.example.com' returns NXDOMAIN. What configuration change would best resolve this?

A.Add a CNAME record for ftp pointing to www.example.com.

B.Increase the serial number in the SOA record.

C.Ensure recursion is enabled on the server.

D.Add an A record for ftp pointing to an IP address.

AnswerD

Adding an A record directly answers the query for ftp.example.com.

Why this answer

An NXDOMAIN response means the queried domain name does not exist in the zone. To resolve 'ftp.example.com', a DNS record must be created that maps the name to an IP address. Option D adds an A record, which directly provides the IPv4 address for the host, making the query succeed.

Exam trap

The trap here is that candidates may confuse NXDOMAIN with a server configuration issue (like recursion) or think that a CNAME can substitute for a missing A record, but NXDOMAIN specifically means the name is absent from the zone, requiring a direct resource record addition.

How to eliminate wrong answers

Option A is wrong because a CNAME record creates an alias, but the target 'www.example.com' must itself resolve to an IP address; if 'ftp.example.com' does not exist at all, a CNAME does not create the required A record and may still result in NXDOMAIN if the target is also missing. Option B is wrong because increasing the serial number in the SOA record only triggers zone transfers and does not add any missing resource records; it has no effect on the existence of 'ftp.example.com'. Option C is wrong because recursion is a server setting that allows the DNS server to query other servers on behalf of clients; it does not add missing records to the zone, and NXDOMAIN is returned when the authoritative server has no record for the name, regardless of recursion.

Full explanation →

459

MCQhard

A DHCP server is configured to serve multiple subnets but only clients on one subnet receive IP addresses. The server is connected to a router that does not forward DHCP broadcasts. What should be configured to support the other subnets?

A.Add more subnet declarations to the DHCP server

B.Set up a DHCP relay agent on the other subnets

C.Add 'shared-network' declarations

D.Configure the router to act as a DHCP server

AnswerB

A relay forwards DHCP broadcasts across routers.

Why this answer

The router does not forward DHCP broadcasts, so clients on other subnets cannot reach the DHCP server. A DHCP relay agent (e.g., `dhcrelay` or `ip helper-address`) intercepts broadcast requests on those subnets and forwards them as unicast to the DHCP server, allowing the server to assign addresses from the appropriate subnet pools. This is the standard solution per RFC 1542 when routers do not support BOOTP forwarding.

Exam trap

The trap here is that candidates often think adding more subnet declarations or using shared-network directives will fix the issue, but the core problem is the lack of broadcast forwarding, which only a relay agent can solve.

How to eliminate wrong answers

Option A is wrong because adding more subnet declarations to the DHCP server does not solve the problem of broadcast packets not reaching the server from remote subnets; the server already has the necessary subnet declarations, but the clients cannot communicate. Option C is wrong because 'shared-network' declarations are used when multiple subnets share the same physical network segment (e.g., for load balancing), not for routing DHCP broadcasts across separate subnets. Option D is wrong because configuring the router to act as a DHCP server would change its role entirely and is unnecessary; the correct approach is to enable DHCP relay on the router or a separate agent to forward broadcasts, not to replace the existing server.

Full explanation →

460

MCQmedium

A Linux client is unable to resolve hostnames for external domains but can ping internal hosts by IP. The /etc/resolv.conf file is correctly configured with a valid DNS server. What is the most likely cause?

A.The /etc/hosts file contains an entry that overrides the DNS resolution for external domains.

B.The nmblookup service is not running.

C.The search domain in /etc/resolv.conf is incorrect, causing the resolver to append an inappropriate domain to queries.

D.The /etc/nsswitch.conf file is missing the 'dns' service in the 'hosts' line.

AnswerC

An incorrect search domain can cause the resolver to try invalid fully qualified domain names, leading to resolution failures for external hosts.

Why this answer

When a search domain is incorrectly configured in /etc/resolv.conf, the resolver appends that domain to single-label hostnames before querying the DNS server. For external fully qualified domain names (FQDNs), this can cause the resolver to send queries like 'externaldomain.com.incorrect.domain' instead of the intended domain, leading to resolution failures. Since internal IPs are reachable (bypassing DNS) and the DNS server itself is valid, the issue is most likely the resolver's domain search behavior.

Exam trap

The trap here is that candidates often assume a misconfigured /etc/resolv.conf means the DNS server is wrong or unreachable, but the question explicitly states it is correctly configured with a valid server, so the issue must be in how the resolver processes queries, specifically the search domain or ndots behavior.

How to eliminate wrong answers

Option A is wrong because /etc/hosts entries override DNS only for the specific hostnames listed; they do not block resolution of other external domains unless explicitly added. Option B is wrong because nmblookup is a NetBIOS name resolution tool for Windows networks, not relevant to standard DNS-based hostname resolution on a Linux client. Option D is wrong because if the 'hosts' line in /etc/nsswitch.conf were missing the 'dns' service, the resolver would not query DNS at all, making it impossible to resolve any external domain; the problem statement confirms external resolution fails but internal IPs work, indicating DNS is partially functional.

Full explanation →

461

Multi-Selectmedium

Which TWO of the following are effective methods to secure SSH access on a Linux server? (Choose two.)

Select 2 answers

A.Disable root login over SSH.

B.Use FTP over SSH (SFTP) for file transfers.

C.Disable password authentication and use only key-based authentication.

D.Require users to change their passwords every 30 days.

E.Change the default SSH port from 22 to a non-standard port.

AnswersC, E

Key-based authentication is much stronger against brute-force and phishing.

Why this answer

Disabling password authentication and enforcing key-based authentication eliminates the risk of brute-force password guessing attacks. SSH keys use asymmetric cryptography (RSA, ECDSA, or Ed25519) and are resistant to credential stuffing and dictionary attacks, provided private keys are kept secure. This is a foundational security hardening step recommended by the CIS Benchmarks for Linux.

Exam trap

The trap here is that candidates often think disabling root login (Option A) is one of the two correct answers, but the question specifically asks for two methods from the list, and the correct pair is C and E; disabling root login is a valid security measure but is not listed as correct in this particular question's answer set.

Full explanation →

462

MCQeasy

Which file on a Linux client determines the order in which different name resolution methods (e.g., hosts file, DNS, LDAP) are consulted?

A./etc/host.conf

B./etc/resolv.conf

C./etc/nsswitch.conf

D./etc/named.conf

AnswerC

This file defines the order of name resolution methods for various databases.

Why this answer

/etc/nsswitch.conf (Name Service Switch) controls the order and sources for system databases like 'hosts', 'passwd', and 'group'. For hostname resolution, the 'hosts' line specifies the lookup order (e.g., 'files dns ldap'), meaning the system checks /etc/hosts first, then DNS, then LDAP. This file is the central configuration for name resolution order on Linux systems.

Exam trap

The trap here is that candidates confuse /etc/resolv.conf (which only sets DNS servers and search domains) with the file that controls the overall resolution order, leading them to pick option B instead of C.

How to eliminate wrong answers

Option A is wrong because /etc/host.conf is a legacy file used by older glibc (before nsswitch) to control resolver behavior, but it is not the primary file for ordering multiple resolution methods like DNS and LDAP. Option B is wrong because /etc/resolv.conf only configures DNS resolver parameters (nameservers, search domains) and does not define the order of resolution methods (e.g., hosts vs. DNS vs.

LDAP). Option D is wrong because /etc/named.conf is the configuration file for the BIND DNS server (named), not a client-side file that determines resolution order on the client machine.

Full explanation →

463

MCQmedium

A user in group staff (but not admin) tries to write to the share. What is the most likely error?

A.NT_STATUS_BAD_NETWORK_NAME

B.NT_STATUS_ACCESS_DENIED

C.Connection successful but cannot write

D.NT_STATUS_OBJECT_NAME_NOT_FOUND

AnswerC

The user can connect (valid includes staff) but write fails due to read only and no write list.

Why this answer

The user is in group 'staff' but not 'admin', and the Samba share configuration likely has 'write list = @admin' or similar, restricting write access to the admin group. The connection succeeds (the share is visible and readable), but the write operation fails silently or returns a permission error at the filesystem level, not a network-level error. This matches the scenario where authentication passes but authorization for writing fails.

Exam trap

The trap here is that candidates confuse network-level errors (bad network name, object not found) with authorization errors, assuming any failure to write must produce a specific NT_STATUS code, when in practice Samba often returns a generic 'cannot write' message at the client level.

How to eliminate wrong answers

Option A is wrong because NT_STATUS_BAD_NETWORK_NAME indicates the share name itself is invalid or not found, which would prevent any connection, not just write access. Option B is wrong because NT_STATUS_ACCESS_DENIED is a generic error that could occur, but in Samba, when a user can connect but lacks write permissions, the client often reports 'cannot write' rather than a distinct NT_STATUS_ACCESS_DENIED; the question specifies 'most likely error' based on typical Samba behavior. Option D is wrong because NT_STATUS_OBJECT_NAME_NOT_FOUND means a specific file or directory within the share is missing, not that the user lacks write permission to the share root.

Full explanation →

464

Multi-Selecthard

Which TWO of the following are valid methods to configure a Linux system to use a specific DNS server for name resolution?

Select 2 answers

A.Add an entry to /etc/hosts with the DNS server's IP.

B.Write the DNS server IP to /etc/resolv.conf using systemd-resolved.

C.Set the 'hosts' line in /etc/nsswitch.conf to include 'dns'.

D.Use NetworkManager to set DNS servers for a connection.

E.Edit the /etc/resolv.conf file and add a nameserver line.

AnswersD, E

NetworkManager can manage DNS settings dynamically.

Why this answer

NetworkManager provides a centralized way to manage network connections, including DNS settings. When you configure DNS servers via NetworkManager (e.g., using `nmcli` or the GUI), it writes the appropriate `nameserver` lines to `/etc/resolv.conf` (or manages it via its own internal resolver), ensuring the system uses those DNS servers for name resolution. Option E is correct because directly editing `/etc/resolv.conf` and adding a `nameserver` line is the traditional, low-level method to specify DNS servers, which the resolver library reads directly.

Exam trap

The trap here is that candidates often confuse the role of `/etc/hosts` (static hostname-to-IP mapping) with DNS server configuration, or they think editing `/etc/nsswitch.conf` alone sets the DNS server, when it only defines the lookup order.

Full explanation →

465

MCQeasy

Refer to the exhibit. What is the root filesystem device as specified in the kernel command line?

A.Could not be determined

B./dev/sda1

C./dev/sda3

D./dev/sda2

AnswerD

The 'root=/dev/sda2' kernel parameter sets /dev/sda2 as the root filesystem.

Why this answer

The kernel command line includes the parameter `root=/dev/sda2`, which explicitly specifies the root filesystem device as `/dev/sda2`. This is the standard way to indicate the partition where the root filesystem is mounted during boot, making option D correct.

Exam trap

The trap here is that candidates may assume the root filesystem is always on the first partition (e.g., `/dev/sda1`) or confuse it with other partitions like swap, but the kernel command line explicitly overrides such assumptions with the `root=` parameter.

How to eliminate wrong answers

Option A is wrong because the kernel command line in the exhibit clearly shows `root=/dev/sda2`, so the root filesystem device can be determined. Option B is wrong because `/dev/sda1` is not referenced in the kernel command line; it might be a common misconception that the root filesystem is always on the first partition, but here it is explicitly set to `/dev/sda2`. Option C is wrong because `/dev/sda3` is not specified in the kernel command line; this could be confused with a swap or other partition, but the root device is explicitly `/dev/sda2`.

Full explanation →

466

MCQeasy

Which file is used to configure which users and groups are allowed to use the 'cron' daemon?

A./var/spool/cron/

B./etc/cron.d/

C./etc/crontab

D./etc/cron.allow

AnswerD

Lists users allowed to use cron.

Why this answer

The /etc/cron.allow file explicitly lists users and groups permitted to schedule cron jobs. If this file exists, only those entries can use crontab; all others are denied, regardless of /etc/cron.deny. This provides a whitelist-based access control mechanism for the cron daemon.

Exam trap

The trap here is that candidates confuse the access control files (/etc/cron.allow and /etc/cron.deny) with the directories or system crontab files that store or schedule jobs, such as /var/spool/cron/ or /etc/crontab.

How to eliminate wrong answers

Option A is wrong because /var/spool/cron/ is a directory containing individual user crontab files (e.g., /var/spool/cron/crontabs/), not a configuration file for access control. Option B is wrong because /etc/cron.d/ is a directory for system cron job fragments (e.g., hourly, daily tasks), not for user authorization. Option C is wrong because /etc/crontab is the system-wide crontab file used to define periodic system jobs, not to control which users can submit cron jobs.

Full explanation →

467

MCQhard

An LDAP client fails to authenticate users against an LDAP server. The /etc/nsswitch.conf includes 'passwd: files ldap' and the /etc/pam.d/system-auth has appropriate pam_ldap.so entries. However, 'getent passwd' shows only local users. Which command should the administrator run first to diagnose the issue?

A.View the contents of /etc/nsswitch.conf.

B.Run 'ldapsearch -x -H ldap://server -b dc=example,dc=com' to test connectivity.

C.Restart the nslcd service.

D.Check the syntax of /etc/ldap.conf with 'slaptest -f /etc/ldap.conf'.

AnswerB

Directly tests if client can bind to LDAP server.

Why this answer

The first step in diagnosing an LDAP authentication failure is to verify basic connectivity to the LDAP server. Running 'ldapsearch -x -H ldap://server -b dc=example,dc=com' tests whether the client can reach the server and perform a simple anonymous search. If this fails, no amount of configuration tweaking will resolve the issue, as the root cause is likely network or server availability.

Exam trap

The trap here is that candidates often jump to restarting services or checking configuration files, but the LPIC-2 exam emphasizes a systematic troubleshooting approach where connectivity testing (ldapsearch) is the first logical step before assuming configuration or service issues.

How to eliminate wrong answers

Option A is wrong because viewing /etc/nsswitch.conf again is redundant; the question already states it includes 'passwd: files ldap', so the configuration is correct and rechecking it does not diagnose the connectivity issue. Option C is wrong because restarting nslcd would only help if the service is misconfigured or hung, but the problem is that 'getent passwd' shows only local users, indicating nslcd may not be running or cannot reach the server; however, the first diagnostic step should be a direct connectivity test, not a service restart. Option D is wrong because 'slaptest' is a tool for OpenLDAP's slapd configuration, not for the client-side /etc/ldap.conf file; checking syntax of /etc/ldap.conf is done manually or with other tools, and syntax errors are less likely than connectivity issues.

Full explanation →

468

MCQhard

A user alice is connected to the 'data' share via smbd, but a file is locked. Which command can forcibly close the file?

A.smbpasswd -L -e alice

B.smbcontrol smbd close-share data

C.systemctl restart nmbd

D.kill -9 $(pgrep smbd)

AnswerB

smbcontrol can interact with smbd to close a share.

Why this answer

`smbcontrol smbd close-share data` sends a message to the smbd process to forcibly close all open files on the 'data' share, releasing any locks held by users like alice. This command directly targets the Samba daemon's internal state without disrupting the entire service or other shares.

Exam trap

The trap here is that candidates may confuse `smbcontrol` with other Samba utilities or think that restarting the entire Samba service (nmbd or smbd) is the only way to clear locks, overlooking the targeted `close-share` command.

How to eliminate wrong answers

Option A is wrong because `smbpasswd -L -e alice` enables a local Samba user account but does not affect file locks or close open files. Option C is wrong because `systemctl restart nmbd` restarts the NetBIOS name service daemon, which handles name resolution, not file locking or share connections. Option D is wrong because `kill -9 $(pgrep smbd)` forcefully terminates all smbd processes, which would close all files but also disconnect all users and disrupt Samba services, whereas the question asks for a command that forcibly closes a specific file without unnecessary disruption.

Full explanation →

469

Multi-Selecteasy

An administrator wants to configure Samba to allow only specific users to access a share. Which TWO configuration parameters in smb.conf can be used to restrict access based on usernames?

Select 2 answers

A.hosts allow

B.invalid users

C.write list

D.valid users

E.read list

AnswersB, D

Specifies which users are denied access to the share.

Why this answer

(invalid users) is correct because it explicitly lists usernames that are denied access to a share, overriding any other access controls. Option D (valid users) is correct because it restricts access to only the specified usernames, denying all others. Both parameters operate at the Samba share level and directly filter based on usernames.

Exam trap

The trap here is that candidates often confuse 'valid users' and 'invalid users' with access control lists (ACLs) or think they only affect write permissions, when in fact they control all access (read and write) to the share.

Full explanation →

470

MCQmedium

Refer to the exhibit. The system boots successfully, but the root filesystem is mounted as read-only even after the boot process completes. Which of the following is the most likely cause?

A.The kernel command line contains the 'ro' parameter, which remains in effect.

B.The root device /dev/mapper/vg-root does not exist.

C.The root filesystem is damaged and forces read-only mount.

D.SELinux is enforcing and prevents write access to the root filesystem.

AnswerA

The 'ro' parameter causes the root filesystem to be mounted read-only unless remounted rw by init.

Why this answer

The most likely cause is that the kernel command line contains the 'ro' parameter. This parameter explicitly requests a read-only root mount, which persists after boot if no remount (e.g., by init or systemd) is performed. Option C is not the most likely because a damaged filesystem usually causes boot failures or drops to emergency mode, not a successful boot with a read-only root.

Exam trap

Candidates often assume a successful boot implies the root filesystem is automatically remounted read-write, overlooking that the 'ro' kernel parameter persists unless explicitly overridden. They may also mistakenly attribute a read-only root to filesystem damage or SELinux, but a damaged filesystem would cause boot failures or emergency mode, and SELinux does not enforce read-only mounts.

How to eliminate wrong answers

Option B is wrong because if the root device /dev/mapper/vg-root did not exist, the system would fail to mount the root filesystem entirely, resulting in a kernel panic or boot failure, not a successful boot with a read-only mount. Option C is wrong because a damaged filesystem typically triggers a forced fsck and may be remounted read-only if corruption is detected, but the system would not complete a normal boot without intervention; the question states the system boots successfully, implying no critical damage. Option D is wrong because SELinux enforcing mode controls access control policies but does not force the root filesystem to be mounted read-only; it can prevent writes based on security contexts, but the mount state itself is determined by the kernel mount options, not SELinux.

Full explanation →

471

MCQmedium

The following output is displayed when running network configuration commands on a Linux system: ``` $ ip link show ... 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel master br0 state UP ... 3: eth0.10@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP ... 4: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP ... $ brctl show bridge name bridge id STP enabled interfaces br0 8000.000000000000 no eth0 ``` Based on this output, what is the configuration of the network interfaces?

A.eth0 is directly connected to a bridge; eth0.10 is a separate physical interface; br0 uses VLAN tagging.

B.eth0 is a VLAN ID 10 access port; eth0.10 is a separate link.

C.eth0 is a member of VLAN 1 only; eth0.10 is a bridge port.

D.eth0 is a VLAN trunk port with native VLAN 1; eth0.10 is a VLAN interface for VLAN 10; br0 is a bridge containing eth0.

AnswerD

Correct interpretation of the exhibit.

Why this answer

In the typical Linux network configuration shown in these outputs, the physical interface eth0 is added to the bridge br0 (as seen with brctl show or ip link set master), making it a bridge port. The native VLAN on eth0 is VLAN 1, meaning untagged traffic on eth0 belongs to VLAN 1 and is bridged through br0. The VLAN subinterface eth0.10 is configured for VLAN 10 (e.g., using ip link add link eth0 name eth0.10 type vlan id 10), which handles tagged traffic for VLAN 10.

This setup is consistent with a trunk port carrying multiple VLANs, where the native VLAN is untagged and other VLANs use subinterfaces.

Exam trap

The trap here is that candidates often confuse VLAN subinterfaces with separate physical interfaces or assume eth0 is an access port, failing to recognize that a trunk port with a native VLAN and subinterfaces is the standard configuration for carrying multiple VLANs over a single link.

How to eliminate wrong answers

Option A is wrong because eth0.10 is not a separate physical interface; it is a VLAN subinterface created on eth0. Option B is wrong because eth0 is not an access port for VLAN 10; it is a trunk port with native VLAN 1, and eth0.10 is not a separate link but a logical interface. Option C is wrong because eth0 is not a member of VLAN 1 only; it carries multiple VLANs as a trunk, and eth0.10 is not a bridge port but a VLAN subinterface.

Full explanation →

472

Multi-Selecthard

Which THREE of the following tools can be used to implement file integrity checking on a Linux system?

Select 3 answers

A.AIDE

B.Logwatch

C.Nmap

D.Tripwire

E.sha256sum

AnswersA, D, E

Advanced Intrusion Detection Environment checks file integrity.

Why this answer

AIDE (Advanced Intrusion Detection Environment) is a file integrity checking tool that creates a database of file hashes and attributes (e.g., permissions, timestamps) from a baseline scan. It then periodically compares the current state of the filesystem against this database to detect unauthorized modifications, making it a correct choice for implementing file integrity checking on a Linux system.

Exam trap

The trap here is that candidates may confuse log monitoring or network scanning tools (Logwatch, Nmap) with file integrity checkers, or overlook that `sha256sum` is a valid but lower-level tool for integrity checking, while AIDE and Tripwire are dedicated solutions.

Full explanation →

473

MCQmedium

A Samba server provides printer sharing using CUPS. Which three global parameters are essential for CUPS integration? (Select THREE)

A.printing = cups

B.cups server = localhost

C.printcap name = cups

D.load printers = yes

E.cups options = "raw"

AnswerA, C, D

Specifies CUPS as the printing system.

Why this answer

The `printing = cups` parameter explicitly tells Samba to use CUPS as its printing subsystem, enabling communication between Samba and CUPS via the CUPS API. Option C is correct because `printcap name = cups` tells Samba to retrieve the printer list from CUPS, which is necessary for automatic printer discovery. Option D is correct because `load printers = yes` instructs Samba to populate the printer list from the printcap file (or CUPS), making printers available to clients.

Together, these three parameters are essential for seamless CUPS integration.

Exam trap

The trap here is that candidates often assume `cups server = localhost` is required for local CUPS integration, but it is actually the default and only needed for remote CUPS servers, while `cups options = "raw"` is a common but non-essential tuning parameter, not a core requirement.

How to eliminate wrong answers

Option B is wrong because `cups server = localhost` is not a required global parameter; Samba defaults to connecting to CUPS on localhost, and this setting is only needed if CUPS runs on a different host. Option E is wrong because `cups options = "raw"` is not a global parameter for basic CUPS integration; it is an optional per-printer or global setting used to bypass CUPS filtering (e.g., for sending raw data to printers), and it is not essential for enabling CUPS support.

Full explanation →

474

Multi-Selecthard

An administrator is configuring netfilter rules to implement a stateful firewall. Which TWO of the following commands are necessary to allow the firewall to correctly forward TCP traffic from internal to external networks (assuming proper default policies)?

Select 2 answers

A.iptables -A FORWARD -m state --state NEW -j ACCEPT

B.iptables -A FORWARD -m state --state ESTABLISHED -j ACCEPT

C.iptables -A FORWARD -j ACCEPT

D.iptables -A FORWARD -m state --state RELATED -j ACCEPT

E.iptables -A FORWARD -m state --state NEW -p tcp --dport 80 -j ACCEPT

AnswersB, D

This allows established connections, crucial for stateful firewall.

Why this answer

A stateful firewall must allow packets belonging to already established connections to pass through the FORWARD chain. The `-m state --state ESTABLISHED` match ensures that any packet that is part of an existing TCP connection (i.e., has seen the three-way handshake) is accepted, which is essential for forwarding return traffic from external networks back to internal hosts.

Exam trap

The trap here is that candidates often think only the `ESTABLISHED` rule is needed, forgetting that `RELATED` is also required for protocols like FTP or ICMP error messages that are associated with an existing connection but are not part of the same TCP stream.

Full explanation →

475

MCQhard

An administrator configures AIDE to monitor /etc. After initializing the database, what command updates the database with current file hashes without removing old entries?

A.aide --update

B.aide --init

C.aide --compare

D.aide --check

AnswerA

This updates the database with current file hashes while preserving unchanged entries.

Why this answer

AIDE's --update option performs a check and then updates the database with any new or changed file hashes while preserving existing entries. This is the correct way to refresh the database after legitimate changes to monitored files, as it combines --check and --init in a single operation without losing the baseline.

Exam trap

The trap here is that candidates confuse --update with --init, thinking both reset the database, but --update preserves old entries while --init destroys them.

How to eliminate wrong answers

Option B is wrong because --init creates a brand new database from scratch, overwriting any existing database and losing all previous entries. Option C is wrong because --compare compares the current files against the database but does not update the database itself. Option D is wrong because --check runs a verification against the database and reports changes but never modifies the database.

Full explanation →

476

MCQeasy

A new network card driver module is not being loaded at boot. The administrator wants to ensure the module is loaded automatically without modifying the kernel command line. Which file should be used?

A./etc/modules-load.d/<name>.conf

B./lib/modules/$(uname -r)/modules.builtin

C./etc/modprobe.d/<name>.conf

D./etc/rc.local

AnswerA

This directory is used by systemd to load kernel modules at boot. Adding the module name to a new file here will load it automatically.

Why this answer

/etc/modules-load.d/<name>.conf is the standard configuration directory used by systemd-modules-load.service to load kernel modules at boot without modifying the kernel command line. Files in this directory list module names (one per line) that are loaded automatically during early boot, making it the proper mechanism for ensuring a network card driver module is loaded.

Exam trap

The trap here is confusing /etc/modprobe.d/ (for module options and aliases) with /etc/modules-load.d/ (for specifying modules to load at boot), leading candidates to incorrectly choose option C.

How to eliminate wrong answers

Option B is wrong because /lib/modules/$(uname -r)/modules.builtin is a file that lists modules compiled directly into the kernel (built-in), not loadable modules; it is generated by the kernel build process and cannot be edited to force module loading. Option C is wrong because /etc/modprobe.d/<name>.conf is used to set module parameters or aliases (via modprobe), not to specify which modules to load at boot; it affects how modules are loaded but does not trigger automatic loading. Option D is wrong because /etc/rc.local is a legacy script for local startup commands, but it runs late in the boot process (after network services) and is not the standard mechanism for early module loading; systemd-based systems often disable it by default.

Full explanation →

477

MCQeasy

A system administrator wants to ensure that only key-based authentication is allowed for SSH and password authentication is disabled. Which configuration change is required in /etc/ssh/sshd_config?

A.PasswordAuthentication yes and PubkeyAuthentication yes

B.PasswordAuthentication no and PubkeyAuthentication no

C.PasswordAuthentication no and PubkeyAuthentication yes

D.PasswordAuthentication no

AnswerC

This disables password logins and enables key-based authentication, meeting the requirement.

Why this answer

Setting `PasswordAuthentication no` disables password-based login, while `PubkeyAuthentication yes` enables public key authentication. Together, these directives ensure that only users with a valid SSH key pair can authenticate, meeting the requirement to disable password authentication entirely.

Exam trap

The trap here is that candidates may think disabling password authentication alone is sufficient (Option D), forgetting that explicitly enabling public key authentication is necessary to ensure key-based login works and to avoid ambiguity in environments where defaults may differ.

How to eliminate wrong answers

Option A is wrong because `PasswordAuthentication yes` explicitly allows password-based login, which contradicts the goal of disabling it. Option B is wrong because `PubkeyAuthentication no` disables key-based authentication, leaving no viable authentication method and potentially locking out all users. Option D is wrong because it only disables password authentication but does not explicitly enable public key authentication; while `PubkeyAuthentication` defaults to `yes` in most SSH implementations, explicitly setting it ensures the configuration is clear and avoids reliance on default behavior.

Full explanation →

478

Multi-Selecteasy

Which TWO of the following are valid methods to modify kernel parameters at runtime without rebooting?

Select 2 answers

A.Using modprobe to load kernel modules with parameters

B.Editing /etc/sysctl.conf and running sysctl --system

C.Writing to files in /proc/sys/ using echo

D.Using the sysctl command to set parameters

E.Adding parameters to the kernel command line in /etc/default/grub

AnswersC, D

Writing directly to /proc/sys/ files changes parameters immediately.

Why this answer

The /proc/sys/ directory exposes kernel tunable parameters as virtual files, and writing a new value to these files (e.g., echo 1 > /proc/sys/net/ipv4/ip_forward) immediately changes the corresponding kernel parameter at runtime without requiring a reboot. This is a direct interface to the kernel's sysctl mechanism.

Exam trap

The trap here is that candidates confuse persistent configuration methods (like editing /etc/sysctl.conf or kernel command line) with runtime modification methods, or they mistakenly think loading a module with modprobe is equivalent to modifying kernel parameters.

Full explanation →

479

MCQeasy

A user reports they cannot obtain an IP address via DHCP. The DHCP server logs show no client activity, but the network cable is connected. Which configuration is most likely missing on the DHCP server?

A.deny unknown-clients

B.default-lease-time

C.option domain-name

D.subnet declaration

AnswerD

A subnet declaration is required to define the pool of addresses.

Why this answer

The DHCP server logs show no client activity, meaning the server is not receiving DHCPDISCOVER packets from the client. The most likely missing configuration is a subnet declaration, which defines the network segment the DHCP server should listen on and allocate addresses from. Without a matching subnet declaration in the DHCP configuration (e.g., /etc/dhcp/dhcpd.conf), the server will ignore requests from that subnet, even if the physical cable is connected.

Exam trap

The trap here is that candidates often focus on client-side issues or access control (like deny unknown-clients) when the logs show no activity, but the real cause is the server not being configured to listen on the client's subnet at all.

How to eliminate wrong answers

Option A is wrong because 'deny unknown-clients' would cause the server to reject clients not in a host declaration, but the server logs would still show client activity (e.g., DHCPDISCOVER received and denied). Option B is wrong because 'default-lease-time' only affects the lease duration offered to clients; its absence does not prevent the server from receiving or responding to DHCP requests. Option C is wrong because 'option domain-name' is an optional parameter that provides a DNS domain suffix; its absence does not block DHCP communication or cause a complete lack of client activity in the logs.

Full explanation →

480

MCQhard

A Linux administrator is setting up an IPsec VPN between two sites using strongSwan. The VPN established successfully, but traffic between the sites is not being encrypted. What is the most probable cause?

A.The IPsec policies are not configured to match the traffic.

B.The firewall is blocking UDP port 500.

C.The kernel does not support IPsec (net.ipv4.ip_forward=0).

D.The IPsec daemon is not started.

AnswerA

The SPD defines which traffic should be encrypted; without matching policies, traffic flows in plain text.

Why this answer

The most probable cause for traffic not being encrypted after a successful IPsec tunnel establishment is that the IPsec policies (e.g., strongSwan's `ipsec.conf` `conn` section with `leftsubnet`/`rightsubnet`) do not match the actual traffic flows. Even if the IKE/SA is up, strongSwan only applies encryption to packets that match the configured selectors; mismatched subnets or protocols result in cleartext traffic bypassing the tunnel.

Exam trap

The trap here is that candidates assume a successful IKE/SA establishment guarantees encryption for all traffic, but LPIC-2 tests the understanding that IPsec policies (SPD selectors) independently control which packets are encrypted, and a mismatch leaves traffic unencrypted.

How to eliminate wrong answers

Option B is wrong because if the firewall were blocking UDP port 500 (IKE), the VPN would not have established successfully—IKE negotiation would fail. Option C is wrong because `net.ipv4.ip_forward=0` disables IP forwarding between interfaces, which would prevent any traffic flow (encrypted or not) between sites, but the question states traffic flows unencrypted, so forwarding must be enabled. Option D is wrong because if the IPsec daemon (strongSwan's `charon`) were not started, the VPN could not have established at all; the successful establishment proves the daemon is running.

Full explanation →

481

MCQmedium

A network administrator notices that VLAN tagging is not working on a Linux bridge. The bridge interface br0 has member ports eth0 and eth1. The administrator runs 'bridge vlan show' and sees that only the default VLAN 1 is present. What is the most likely cause?

A.The bridge is not enabled for VLAN filtering

B.The kernel module for VLAN is not loaded

C.The VLAN protocol is not set to 802.1Q

D.Ports eth0 and eth1 are not set to promiscuous mode

AnswerA

Without enabling VLAN filtering on the bridge, only the default VLAN (VLAN 1) is allowed.

Why this answer

The 'bridge vlan show' command only displays VLAN filtering information when VLAN filtering is enabled on the bridge. By default, Linux bridges operate in a simple switching mode without VLAN awareness, meaning all frames are forwarded regardless of VLAN tags. The administrator must explicitly enable VLAN filtering using 'ip link set dev br0 type bridge vlan_filtering 1' to activate per-VLAN forwarding and filtering, which is why only the default untagged VLAN 1 appears.

Exam trap

The trap here is that candidates assume VLAN tagging works automatically on a Linux bridge because they are familiar with VLAN interfaces or managed switches, but Linux bridges require explicit VLAN filtering configuration to process 802.1Q tags.

How to eliminate wrong answers

Option B is wrong because the kernel module for VLAN (8021q) is only required for creating VLAN interfaces (e.g., eth0.10) or for the host to process VLAN tags at the network layer; the bridge itself handles VLAN tagging natively when VLAN filtering is enabled, without needing the 8021q module. Option C is wrong because the VLAN protocol is implicitly 802.1Q in Linux bridges; there is no separate configuration to set the protocol, and the issue is not about protocol mismatch but about the bridge not being configured to filter VLANs. Option D is wrong because promiscuous mode is not required for VLAN tagging on a bridge; promiscuous mode allows a NIC to receive all packets, but VLAN filtering is a bridge-level feature independent of promiscuous mode on member ports.

Full explanation →

482

MCQhard

A company wants to set up a Linux bridge to connect a wireless interface (wlan0) to a wired interface (eth0) to allow devices on the wired network to access the internet through the wireless uplink. The Linux server runs Debian with hostapd to create an access point on wlan0. The administrator creates a bridge br0 using brctl and adds eth0 and wlan0 as ports. They assign IP 192.168.10.1/24 to br0 and start hostapd. Clients on the wired network can access the internet, but cannot ping clients on the wireless network, and vice versa. The administrator verifies that both interfaces are enslaved to br0 (brctl show shows both). They also confirm that IP forwarding is enabled and there are no iptables rules blocking anything. Which of the following is the most likely cause?

A.The wireless interface wlan0 is not set to 4-address mode (WDS) to allow bridging.

B.The DHCP server is only listening on the bridge interface, not on the individual interfaces.

C.The hostapd configuration is missing the 'bridge' parameter to bind to the bridge.

D.The iptables firewall is blocking broadcast traffic between bridge ports.

AnswerA

Bridging requires 4-address frames on wireless interfaces.

Why this answer

A is correct because a standard wireless interface (station mode) uses 3-address frames (source, destination, BSSID) and drops frames with a fourth address, which is required for bridging. When a bridge forwards a frame from the wired side to the wireless side, it uses the MAC addresses of the original source and destination, but the wireless medium requires the fourth address (the transmitter address) to identify the bridge itself. Without enabling 4-address mode (WDS) on wlan0, the wireless driver will reject these bridged frames, preventing communication between wired and wireless clients.

Exam trap

The trap here is that candidates assume bridging works identically on wireless and wired interfaces, overlooking the 802.11 frame format limitation that requires 4-address mode for transparent bridging.

How to eliminate wrong answers

Option B is wrong because DHCP server scope does not affect Layer 2 bridging; clients on different sides of the bridge can still ping each other if the bridge forwards frames correctly, regardless of DHCP configuration. Option C is wrong because the 'bridge' parameter in hostapd is used to integrate with a bridge for DHCP forwarding and client isolation, but its absence does not prevent the bridge from forwarding frames between ports at Layer 2. Option D is wrong because the administrator explicitly confirmed there are no iptables rules blocking anything, and iptables does not filter traffic between bridge ports by default unless ebtables or netfilter bridge rules are configured.

Full explanation →

483

MCQeasy

An administrator wants to implement network bonding for redundancy on a Linux server running RHEL 8. The server has two physical interfaces em1 and em2. The administrator creates a bond interface bond0 with mode active-backup (mode 1) and adds the slaves em1 and em2. They assign IP address 192.168.50.10/24 to bond0 and bring up the bond. The bond appears to work initially, with one slave active. However, when they disconnect the cable from the active slave, the bond does not fail over to the other slave. The administrator checks /proc/net/bonding/bond0 and sees that the link status for both slaves shows 'up' even after the disconnection. They confirm the bonding module is loaded and the mode is correct. Which of the following is the most likely missing configuration?

A.The MII monitoring interval (miimon) is not configured.

B.The bond interface requires a specific kernel module that is missing.

C.The slave interfaces were not set to 'down' before enslaving.

D.The bond mode is set to mode 0 instead of mode 1.

AnswerA

miimon is required for link monitoring.

Why this answer

In active-backup bonding mode (mode 1), the kernel bonding driver requires the MII (Media Independent Interface) monitoring interval (miimon) to be configured in order to detect link failures. Without miimon, the driver never polls the slave interfaces for link state changes, so even when a cable is disconnected, the driver continues to see the link as 'up' and does not trigger a failover. The administrator must set miimon=100 (or another value in milliseconds) in the bond configuration to enable periodic link monitoring.

Exam trap

The trap here is that candidates often assume active-backup mode automatically handles failover without additional configuration, but the LPIC-2 exam tests the understanding that link monitoring (miimon) must be explicitly configured for the bonding driver to detect physical link loss.

How to eliminate wrong answers

Option B is wrong because the bonding module is already loaded and the bond interface works initially, indicating the required kernel module (bonding) is present; a missing module would prevent the bond from working at all. Option C is wrong because setting slave interfaces to 'down' before enslaving is not a requirement for bonding; the bonding driver can enslave interfaces that are up, and the bond will manage their state. Option D is wrong because the administrator confirmed the mode is active-backup (mode 1), and the symptom of no failover despite correct mode points to a missing monitoring mechanism, not a mode mismatch.

Full explanation →

484

MCQhard

A new client with IP 10.0.1.15 tries to connect to HTTPS on the server. Based on the exhibit, what happens?

A.The connection is dropped by rule 5.

B.The connection is rejected with an ICMP error.

C.The connection is accepted only if state RELATED.

D.The connection is accepted because 10.0.1.15 is in 10.0.0.0/8.

AnswerD

Matches rule 4, accepting HTTPS.

Why this answer

The iptables rule set includes a rule that accepts traffic from the 10.0.0.0/8 subnet. The client IP 10.0.1.15 falls within this range, so the HTTPS connection matches the rule and is accepted. This occurs before any later rules that might drop or reject the traffic.

Exam trap

The trap here is that candidates may assume a later DROP rule (e.g., for 10.0.1.0/24) applies, forgetting that iptables processes rules sequentially and an earlier ACCEPT rule for a larger subnet (10.0.0.0/8) will match first, bypassing the more specific drop rule.

How to eliminate wrong answers

Option A is wrong because rule 5 drops traffic from 10.0.1.0/24, but 10.0.1.15 is within 10.0.0.0/8, which is matched by an earlier accept rule, so rule 5 is never reached. Option B is wrong because an ICMP error (e.g., port unreachable) would only be sent if a REJECT target were used, but the rule set uses DROP, which silently discards packets without sending any ICMP response. Option C is wrong because the state RELATED rule applies to traffic that is part of an established connection’s related sessions (e.g., FTP data), but a new HTTPS connection from a client is not RELATED; it would be NEW or ESTABLISHED, and the rule set does not have a state NEW accept rule for this source.

Full explanation →

485

MCQmedium

An administrator notices that clients are unable to obtain IP addresses from the DHCP server. The server logs show 'no free leases' error. What is the most likely cause?

A.The DHCP server's subnet declaration does not match the client's network.

B.The DHCP server's address range is exhausted.

C.The dhcpd.conf file has invalid syntax.

D.The DHCP relay agent is misconfigured.

AnswerB

Directly matches the error message.

Why this answer

The 'no free leases' error indicates that the DHCP server has exhausted all available IP addresses in its configured pool. This occurs when the address range defined in the dhcpd.conf file has been fully allocated to clients and no leases are available for new requests. The server logs confirm this specific condition, making address exhaustion the most likely cause.

Exam trap

The trap here is that candidates may confuse 'no free leases' with configuration or relay issues, but the error message directly points to address pool exhaustion, not connectivity or syntax problems.

How to eliminate wrong answers

Option A is wrong because a subnet declaration mismatch would typically result in 'no subnet declaration' or 'not authoritative' errors, not 'no free leases'. Option C is wrong because invalid syntax in dhcpd.conf would cause the DHCP daemon to fail to start or report a configuration parse error, not a runtime lease exhaustion error. Option D is wrong because a misconfigured relay agent would prevent DHCP discover packets from reaching the server, resulting in no response or timeout, not a 'no free leases' error from the server.

Full explanation →

486

MCQhard

A company is migrating from Apache HTTPD 2.2 to 2.4 and needs to configure SSL for a virtual host. The administrator wants to use modern security practices. Which of the following configurations is the most secure and recommended for Apache 2.4?

A.SSLEngine on; SSLProtocol -SSLv2 -SSLv3; SSLCipherSuite MEDIUM:!aNULL

B.SSLEngine on; SSLProtocol TLSv1.2 TLSv1.3; SSLCipherSuite ECDHE+AESGCM

C.SSLEngine on; SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1; SSLCipherSuite HIGH:!aNULL:!MD5

D.SSLEngine on; SSLProtocol all; SSLCipherSuite DEFAULT

AnswerC

Disables all insecure protocols and uses a strong, widely compatible cipher suite.

Why this answer

It explicitly enables only TLS 1.2 and TLS 1.3 (by disabling SSLv3, TLSv1.0, and TLSv1.1) and uses the HIGH cipher suite with exclusion of aNULL (anonymous NULL ciphers) and MD5 (weak hash). This aligns with modern security standards (e.g., PCI DSS, NIST) and Apache 2.4's recommended hardening practices, avoiding deprecated protocols and weak ciphers.

Exam trap

Candidates often choose Option B because it explicitly specifies TLS 1.2 and TLS 1.3, which appears modern. However, the cipher suite 'ECDHE+AESGCM' is too restrictive—it only allows ECDHE key exchange and AES-GCM encryption, excluding other secure options like DHE or ChaCha20-Poly1305. While not insecure, it is not the recommended practice for Apache 2.4.

Option C uses a more balanced cipher suite (HIGH:!aNULL:!MD5) that provides strong security with broader compatibility, and its protocol setting effectively disables all obsolete versions.

How to eliminate wrong answers

Option A is wrong because it uses 'MEDIUM:!aNULL' which includes ciphers of only medium strength (e.g., 128-bit) and does not explicitly disable TLSv1.0 or TLSv1.1, leaving older, less secure protocols enabled; also, it lacks explicit TLSv1.2/TLSv1.3 support. Option B is wrong because 'ECDHE+AESGCM' is not a valid SSLCipherSuite syntax in Apache — it should use OpenSSL cipher string format like 'ECDHE+AESGCM:!aNULL:!MD5' and it omits disabling older protocols beyond TLSv1.2/TLSv1.3 (though it does specify them, it fails to exclude weak ciphers like those with MD5 or anonymous DH). Option D is wrong because 'SSLProtocol all' enables all protocols including SSLv2, SSLv3, TLSv1.0, and TLSv1.1, which are insecure; 'SSLCipherSuite DEFAULT' uses Apache's default cipher list, which may include weak or deprecated ciphers (e.g., RC4, 3DES) and does not enforce modern security.

Full explanation →

487

MCQhard

A Linux router running FRR (Free Range Routing) needs to participate in OSPF with adjacent Cisco routers. Which configuration file should be modified to enable OSPF?

A./etc/quagga/ospfd.conf

B./etc/network/interfaces

C./etc/frr/frr.conf

D./etc/ospfd.conf

AnswerC

FRR main configuration file where OSPF, BGP, etc. are defined.

Why this answer

FRR (Free Range Routing) stores its unified routing protocol configuration in /etc/frr/frr.conf. This file is the primary configuration file for all FRR daemons, including OSPF, and is read by the frr service at startup. Modifying this file and then reloading FRR enables OSPF on the Linux router to peer with adjacent Cisco routers.

Exam trap

The trap here is that candidates familiar with the older Quagga project may assume the configuration file is still /etc/quagga/ospfd.conf, but FRR has replaced Quagga and uses /etc/frr/frr.conf as the single configuration file for all routing protocols.

How to eliminate wrong answers

Option A is wrong because /etc/quagga/ospfd.conf is the configuration file for the older Quagga project, not FRR; FRR is a fork of Quagga and uses its own directory structure. Option B is wrong because /etc/network/interfaces is used by Debian/Ubuntu for basic network interface configuration (IP addresses, routes) and does not control OSPF routing daemon settings. Option D is wrong because /etc/ospfd.conf is not a standard path for any routing suite; FRR does not use a separate ospfd.conf file and instead consolidates all protocol configurations into frr.conf.

Full explanation →

488

MCQmedium

A company has multiple subnets and wants to implement policy-based routing to direct traffic from a specific development subnet (192.168.10.0/24) through a specialized firewall for content filtering, while all other traffic uses the default gateway. Which of the following steps is required to achieve this using iproute2 tools?

A.Use iptables to mark packets from the development subnet and then use ip rule to use the main table for marked packets.

B.Add an ip rule to route traffic from 192.168.10.0/24 to the firewall without creating a new table.

C.Add a static route to the main routing table for 192.168.10.0/24 pointing to the firewall.

D.Create a new routing table (e.g., table 100), add a default route via the firewall in that table, and add an ip rule to use table 100 for traffic from 192.168.10.0/24.

AnswerD

This correctly implements policy-based routing by using a separate routing table and a rule.

Why this answer

Policy-based routing (PBR) with iproute2 requires creating a separate routing table, adding a default route via the firewall in that table, and then using an ip rule to match traffic from the source subnet (192.168.10.0/24) and direct it to that custom table. This allows traffic from the development subnet to follow a different path than the default gateway, while all other traffic continues to use the main routing table.

Exam trap

The trap here is that candidates often confuse destination-based static routing (which affects where traffic goes) with source-based policy routing (which affects how traffic leaves), leading them to choose Option C or B instead of recognizing the need for a separate routing table and ip rule.

How to eliminate wrong answers

Option A is wrong because iptables marking is not required for source-based PBR; ip rule can match directly on source address without marks, and using the main table for marked packets would not route them through the firewall. Option B is wrong because ip rule without a custom table cannot override the default route; the rule must reference a distinct routing table that contains the desired default route via the firewall. Option C is wrong because adding a static route to the main routing table for 192.168.10.0/24 would only affect traffic destined to that subnet, not traffic originating from it; policy routing requires source-based rules, not destination-based routes.

Full explanation →

489

MCQeasy

A security policy requires that all users must change their passwords every 90 days. Which command enforces maximum password age for an existing user 'jdoe'?

A.chage -M 90 jdoe

B.passwd -f jdoe

C.usermod -e 90 jdoe

D.chage -E 90 jdoe

AnswerA

Sets maximum number of days a password is valid.

Why this answer

The `chage -M 90 jdoe` command sets the maximum number of days a password is valid for user 'jdoe' to 90 days, enforcing the security policy. The `-M` option directly controls the password aging parameter that defines when the password must be changed, as stored in `/etc/shadow`.

Exam trap

The trap here is confusing the `-M` (maximum password age) option with the `-E` (account expiration) option, as both use a numeric argument but control entirely different aspects of user account lifecycle.

How to eliminate wrong answers

Option B is wrong because `passwd -f jdoe` forces a password change at the next login but does not set a maximum age limit; it only sets the 'force change' flag. Option C is wrong because `usermod -e 90 jdoe` sets the account expiration date to 90 days from the epoch (January 1, 1970), which would immediately expire the account, not enforce a 90-day password rotation. Option D is wrong because `chage -E 90 jdoe` sets the account expiration date to 90 days from the epoch, not the maximum password age; `-E` controls account expiry, not password aging.

Full explanation →

490

MCQhard

A company is migrating from a workgroup environment to an Active Directory domain. The Samba server is already configured as a domain member using winbind. The administrator wants to ensure that files created by domain users on the Samba server are owned by the corresponding UNIX user accounts derived from the domain. Which idmap backend and configuration is recommended for this purpose?

A.idmap config * : backend = ad

B.idmap config * : backend = tdb

C.idmap config * : backend = autorid

D.idmap config * : backend = rid

AnswerD

This derives UIDs from RIDs for consistent mapping.

Why this answer

The `rid` backend (option D) is recommended because it generates UNIX UIDs/GIDs deterministically from the Windows RID (Relative Identifier) portion of the user's SID, ensuring that files created by domain users on the Samba server are consistently owned by the same UNIX user accounts derived from the domain. This backend does not require an RFC 2307 schema or LDAP attributes, making it ideal for simple domain member setups where automatic UID/GID mapping is needed.

Exam trap

LPI often tests the misconception that `ad` backend is the default or best choice for any domain member, but the question specifically requires deterministic mapping without schema extensions, making `rid` the correct answer.

How to eliminate wrong answers

Option A is wrong because `idmap config * : backend = ad` requires the Active Directory schema to be extended with RFC 2307 attributes (uidNumber, gidNumber) and is typically used for domain controllers or when explicit UID/GID assignment is needed, not for automatic mapping from RIDs. Option B is wrong because `tdb` is a local, file-based backend that stores mappings in a TDB file, which is not suitable for a domain member with many users as it does not provide deterministic or scalable mapping from domain SIDs. Option C is wrong because `autorid` is designed for environments with multiple trusted domains and allocates ranges automatically, but it can lead to non-deterministic UID/GID mappings across reboots or reconfigurations, making it less reliable for consistent ownership of files.

Full explanation →

491

MCQmedium

A company uses BIND9 as the authoritative name server for its public zone example.com. External users report that they cannot resolve the MX record for the domain, but internal users can. What is the most likely cause?

A.The zone file lacks an MX record.

B.The allow-query ACL restricts queries to the internal network.

C.The server is behind a firewall that blocks UDP port 53.

D.The recursion is set to no.

AnswerB

If allow-query limits to internal IPs, external queries are rejected, causing resolution failures for external users.

Why this answer

The allow-query ACL in BIND9 restricts which source IP addresses are permitted to send queries to the server. If it is set to allow only the internal network (e.g., 192.168.0.0/16), external users' queries are rejected, causing resolution failures for MX records and all other records. Internal users succeed because their IPs match the ACL, while external users receive a REFUSED response or no answer.

Exam trap

The trap here is that candidates often confuse allow-query (which controls who can send queries) with allow-transfer (zone transfers) or recursion settings, or they assume a missing record is the cause when the symptom is selective failure based on client location.

How to eliminate wrong answers

Option A is wrong because if the zone file lacked an MX record, internal users would also fail to resolve it, but the problem states internal users can resolve it. Option C is wrong because a firewall blocking UDP port 53 would prevent all DNS traffic (both internal and external) from reaching the server, yet internal users succeed. Option D is wrong because setting recursion to no only prevents the server from performing recursive queries on behalf of clients; it does not affect the server's ability to answer authoritative queries for its own zones, such as the MX record for example.com.

Full explanation →

492

Multi-Selecteasy

Which THREE of the following actions are recommended as initial security hardening steps after installing a new Linux server? (Choose three.)

Select 3 answers

A.Update all packages using the package manager.

B.Disable root login via SSH.

C.Install a graphical desktop environment for easier administration.

D.Enable and configure a firewall (e.g., iptables or firewalld).

E.Set up a web server to monitor system status.

AnswersA, B, D

Ensures the latest security patches are applied.

Why this answer

Immediately updating all packages via the package manager (e.g., `apt upgrade` or `yum update`) applies the latest security patches to the kernel, libraries, and services, closing known vulnerabilities that could be exploited by attackers. This is a foundational step in the initial hardening process, as a newly installed system often ships with outdated packages that have published CVEs.

Exam trap

The trap here is that candidates may confuse 'initial hardening steps' with optional or convenience-based actions, such as installing a desktop environment or a web server, which actually weaken security rather than strengthen it.

Full explanation →

493

MCQmedium

A firewall rule set is implemented using iptables. The administrator wants to allow incoming SSH connections only from the 192.168.1.0/24 subnet, while all other incoming traffic is dropped. Which set of rules achieves this?

A.iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -j DROP

B.iptables -A INPUT -p tcp --sport 22 -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -j DROP

C.iptables -A INPUT -p tcp --dport 22 -j DROP iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT

D.iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j DROP

E.iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -j DROP

AnswerA

Allows SSH from subnet, then drops all other input.

Why this answer

It first adds a rule to accept TCP traffic on port 22 (SSH) from the 192.168.1.0/24 subnet, then adds a default DROP rule for all other incoming traffic. Since iptables processes rules in order, the ACCEPT rule matches allowed SSH connections first, and the subsequent DROP rule catches all other incoming packets, effectively dropping everything else including SSH from other sources.

Exam trap

The trap here is that candidates often confuse source and destination ports (--sport vs --dport) or place rules in the wrong order, mistakenly thinking that a DROP rule placed before an ACCEPT rule can be overridden by a later rule, when in fact iptables stops processing after the first match.

How to eliminate wrong answers

Option B is wrong because it uses --sport 22 (source port) instead of --dport 22 (destination port); SSH servers listen on destination port 22, so this rule would incorrectly match packets originating from port 22 on the client, not incoming SSH connections. Option C is wrong because the DROP rule for SSH is placed before the ACCEPT rule, so all SSH traffic (including from 192.168.1.0/24) is dropped first, making the ACCEPT rule unreachable. Option D is wrong because the first rule accepts all SSH traffic from any source, then the second rule attempts to drop SSH from 192.168.1.0/24, but the first rule already accepted it; this effectively allows SSH from everywhere, not just the subnet.

Option E is wrong because it accepts all SSH traffic from any source and then drops all other incoming traffic, which allows SSH from any IP address, not just 192.168.1.0/24.

Full explanation →

494

MCQmedium

A company wants to host multiple websites on a single Apache server with different domain names. Which approach is most appropriate?

A.Name-based virtual hosting

B.IP-based virtual hosting

C.Port-based virtual hosting

D.Using mod_rewrite for each domain

AnswerA

Allows multiple domain names on a single IP/port using the Host header.

Why this answer

Name-based virtual hosting allows a single Apache server to serve multiple websites using the same IP address and port by relying on the HTTP Host header sent by the client. This is the most efficient and commonly used method for hosting multiple domains on one server, as it conserves IP addresses and requires minimal configuration via the `<VirtualHost *:80>` directive.

Exam trap

The trap here is that candidates often confuse name-based virtual hosting with IP-based hosting, assuming each domain needs its own IP address, or mistakenly think mod_rewrite can handle domain routing without virtual host containers.

How to eliminate wrong answers

Option B is wrong because IP-based virtual hosting requires a separate IP address for each domain, which is wasteful and often impractical given IPv4 address scarcity. Option C is wrong because port-based virtual hosting uses different TCP ports (e.g., 8080, 8081) for each site, which is not user-friendly as users would need to specify non-standard ports in URLs. Option D is wrong because mod_rewrite is a URL rewriting engine, not a virtual hosting mechanism; it cannot serve different content based solely on the domain name without additional virtual host containers.

Full explanation →

495

MCQhard

An administrator wants to create a chroot environment for a potentially compromised service. The service needs to read /etc/resolv.conf and /etc/hosts, and run from a directory /chroot/service. Which of the following steps is essential to ensure the chroot environment is secure and functional?

A.Set the chroot directory to be read-only.

B.Mount /proc within the chroot jail.

C.Copy only the service binaries and configuration files into the chroot.

D.Create /dev/null and /dev/random inside the chroot using mknod.

AnswerD

Device files are required for many system calls; without them, the service may crash or hang.

Why this answer

A chroot environment typically lacks device nodes, and many services require /dev/null and /dev/random for basic I/O operations and entropy. Without these, the service may fail to start or behave unpredictably. Creating them with mknod ensures the service can function securely within the jail.

Exam trap

The trap here is that candidates assume copying binaries and configs is sufficient, overlooking the need for device nodes that are part of the filesystem but not present in a minimal chroot.

How to eliminate wrong answers

Option A is wrong because setting the chroot directory read-only would prevent the service from writing logs, temporary files, or runtime data, breaking functionality; chroot jails are not inherently read-only. Option B is wrong because mounting /proc is not essential for reading /etc/resolv.conf and /etc/hosts; /proc is needed for process information but not for the stated file access. Option C is wrong because copying only binaries and configuration files ignores the need for device nodes like /dev/null and /dev/random, which are required by many services for standard I/O and random number generation.

Full explanation →

496

MCQmedium

Refer to the exhibit. What is the effect of this sudoers configuration?

A.Users alice and bob can run any software command on the localhost only.

B.Members of ADMINS can run any command as root on any host.

C.Users alice and bob can run apt-get and dpkg on any host as root, requiring a password.

D.Users alice and bob can run apt-get and dpkg without a password.

AnswerC

The configuration grants exactly that: the specified commands, on any host, with password prompt.

Why this answer

The sudoers configuration specifies that users alice and bob are allowed to run only the commands /usr/bin/apt-get and /usr/bin/dpkg as root on any host (ALL). The absence of the NOPASSWD tag means that a password is required for these commands. The syntax 'alice,bob ALL=(root) /usr/bin/apt-get, /usr/bin/dpkg' restricts the command set and requires authentication.

Exam trap

The trap here is that candidates often overlook the absence of the NOPASSWD tag and assume that any sudo entry implies passwordless execution, or they misread 'ALL' in the host field as meaning 'all commands' instead of 'all hosts'.

How to eliminate wrong answers

Option A is wrong because the configuration does not restrict commands to localhost only; it uses 'ALL' for the host part, meaning any host, and it only allows apt-get and dpkg, not any software command. Option B is wrong because there is no group named ADMINS defined in the given configuration; the entries are for individual users alice and bob, not a group. Option D is wrong because the configuration does not include the NOPASSWD tag, so a password is required for the specified commands.

Full explanation →

497

MCQhard

A Linux system administrator is tasked with upgrading the kernel on a server running a custom compiled kernel (version 4.19) with many in-house modules. The new kernel (5.10) has significant changes, including a different API for some module functions. After compiling the new kernel and the modules, the system boots but some modules fail to load with 'Unknown symbol' errors. The administrator needs to identify which symbols are missing and fix the modules. Which of the following is the most effective approach?

A.Check dmesg for each module load error and recompile modules one by one

B.Rename the missing symbols in the source code to match the new kernel's exported symbols

C.Run 'modprobe --dump-modversions mymodule.ko' and compare with 'cat /proc/kallsyms' to identify mismatches

D.Use 'nm mymodule.ko' to list all symbols and manually compare with the kernel's symbol table

AnswerC

This method systematically shows which symbols the module requires and whether they are present in the running kernel.

Why this answer

`modprobe --dump-modversions mymodule.ko` displays the symbol version (CRC) checksums for each symbol the module uses, and comparing these with `/proc/kallsyms` (which lists all symbols exported by the running kernel along with their CRC values) directly pinpoints which symbols have mismatched versions. This is the most efficient method to identify 'Unknown symbol' errors caused by API changes between kernel 4.19 and 5.10, as it reveals exactly which symbols need updating in the module source code.

Exam trap

The trap here is that candidates often assume symbol name matching is sufficient (Option D) or that recompiling blindly (Option A) will fix the issue, when in fact the kernel's symbol versioning (CRC) mechanism is what causes the failure, and only a version-aware comparison can diagnose it correctly.

How to eliminate wrong answers

Option A is wrong because checking dmesg for each module load error and recompiling modules one by one is a slow, trial-and-error approach that does not provide a systematic way to identify all missing or mismatched symbols at once. Option B is wrong because renaming missing symbols in the source code to match the new kernel's exported symbols is incorrect; the issue is not the symbol name but the version (CRC) mismatch due to API changes, and renaming would break the module's logic or cause further errors. Option D is wrong because `nm mymodule.ko` lists all symbols in the module but does not show the version (CRC) information needed to detect API mismatches; it only shows symbol names, which may be identical even when the underlying function signatures have changed.

Full explanation →

498

Matchingmedium

Match each system log to its typical content.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

General system messages (legacy)

System log on Debian-based systems

Authentication and security events

Kernel messages

Mail server logs

Why these pairings

Correct matches: /var/log/messages -> general system messages, /var/log/secure -> authentication logs, /var/log/maillog -> mail server logs, /var/log/cron -> cron job logs, /var/log/boot.log -> boot logs. Common confusions include swapping definitions of /var/log/messages and /var/log/secure.

Full explanation →

499

MCQhard

A Samba server is configured with 'security = ads' and joined to an Active Directory domain. Users can authenticate but cannot access shares. The smb.conf includes 'winbind use default domain = yes'. What could be the problem?

A.The 'winbind use default domain' option should be 'no'

B.The 'idmap backend' is not configured

C.The Samba server's time is not synchronized with the domain controller

D.The 'valid users' parameter uses domain prefix while default domain is set

AnswerD

If valid users expects 'DOMAIN\user' but winbind strips the domain, authentication fails.

Why this answer

When 'winbind use default domain = yes' is set, Winbind strips the domain prefix from usernames, so users authenticate as 'username' instead of 'DOMAIN\username'. If the 'valid users' parameter in a share definition explicitly uses the domain prefix (e.g., 'valid users = DOMAIN\username'), the stripped username will not match, and access is denied. This mismatch is the most direct cause of authentication succeeding but share access failing.

Exam trap

The trap here is that candidates assume authentication success means all Samba operations are fine, overlooking the subtle interaction between 'winbind use default domain' and share-level access control parameters like 'valid users'.

How to eliminate wrong answers

Option A is wrong because setting 'winbind use default domain = no' would require users to always specify the domain prefix, which does not resolve the mismatch if 'valid users' already uses a prefix; the core issue is the inconsistency between the default domain setting and the share's user specification. Option B is wrong because the 'idmap backend' configuration is essential for mapping SIDs to UIDs/GIDs, but a missing or misconfigured idmap backend typically causes authentication failures or inability to resolve user identities, not a scenario where users can authenticate but cannot access shares due to a 'valid users' mismatch. Option C is wrong because time synchronization with the domain controller is critical for Kerberos authentication; if time were out of sync, authentication itself would fail (with a clock skew error), not just share access.

Full explanation →

500

MCQhard

Refer to the exhibit. What is the most likely cause of this Apache error?

A.The filesystem containing the logs is full.

B.The server is out of memory.

C.The semaphore limit for the Apache user is exceeded.

D.The RewriteMap file specified is missing.

AnswerC

Apache uses semaphores for lock files; exhausting semaphore limits causes this error.

Why this answer

The Apache error 'semaphore limit exceeded' occurs when the number of semaphores allocated to the Apache user exceeds the system-wide or per-user semaphore limit. Apache uses semaphores for inter-process communication (IPC) in its prefork or worker MPMs to coordinate child processes. The correct answer is C because this error directly indicates that the kernel's semaphore limits (e.g., `SEMMSL`, `SEMMNS`, or `SEMOPM` in `/proc/sys/kernel/sem`) have been exhausted for the Apache user, often due to too many child processes or a misconfigured `MaxClients` directive.

Exam trap

The trap here is that candidates often confuse semaphore errors with disk space or memory issues, but LPIC-2 specifically tests knowledge of IPC resource limits and their impact on Apache MPM behavior.

How to eliminate wrong answers

Option A is wrong because a full filesystem containing logs would typically produce 'No space left on device' errors in Apache's error_log, not a semaphore-related error. Option B is wrong because out-of-memory conditions usually manifest as 'Cannot allocate memory' or 'fork: Cannot allocate memory' errors, not semaphore limit errors. Option D is wrong because a missing RewriteMap file would generate a configuration parsing error or 'RewriteMap: cannot open file' message during Apache startup or reload, not a runtime semaphore error.

Full explanation →

501

MCQhard

A database server experiences performance degradation. Analysis shows high I/O wait on a LVM logical volume that uses striping across two physical volumes. What is the most effective way to improve performance?

A.Add a cache layer using lvmcache on a fast SSD

B.Increase the stripe size and recreate the LV

C.Add an additional PV to the VG and extend the LV

D.Convert the LV to use linear mapping instead of striping

AnswerA

Caching with SSDs accelerates reads and writes, reducing I/O wait.

Why this answer

Adding a cache layer using lvmcache on a fast SSD is the most effective way to reduce high I/O wait because it places frequently accessed (hot) data on the faster SSD while keeping the bulk of data on the slower striped HDDs. This directly addresses the I/O bottleneck without requiring data migration or downtime, and it leverages the existing striped layout for sequential throughput while improving latency for random reads/writes.

Exam trap

The trap here is that candidates assume striping alone maximizes performance, but they overlook that high I/O wait is often due to random access latency, which a cache layer directly mitigates without requiring a disruptive reconfiguration.

How to eliminate wrong answers

Option B is wrong because increasing the stripe size and recreating the LV would require taking the volume offline and migrating all data, which is disruptive and may not reduce I/O wait if the bottleneck is random access latency rather than sequential throughput. Option C is wrong because adding an additional PV to the VG and extending the LV would increase total capacity but does not inherently improve I/O wait; it could even increase contention if the new PV is equally slow. Option D is wrong because converting the LV to linear mapping would eliminate the parallelism of striping, likely worsening performance for workloads that benefit from concurrent I/O across multiple disks.

Full explanation →

502

MCQeasy

An administrator wants to drop incoming TCP packets on port 22 from IP 10.0.0.5 using iptables. Which command is correct?

A.iptables -A INPUT -d 10.0.0.5 -p tcp --dport 22 -j DROP

B.iptables -A FORWARD -s 10.0.0.5 -p tcp --dport 22 -j DROP

C.iptables -A OUTPUT -s 10.0.0.5 -p tcp --dport 22 -j DROP

D.iptables -A INPUT -s 10.0.0.5 -p tcp --dport 22 -j DROP

AnswerD

This correctly matches incoming packets from 10.0.0.5 to port 22 and drops them.

Why this answer

It adds a rule to the INPUT chain, which processes packets destined for the local system. The `-s 10.0.0.5` flag specifies the source IP address, `-p tcp --dport 22` matches TCP packets destined for port 22 (SSH), and `-j DROP` silently discards matching packets. This configuration drops incoming SSH traffic from the specified host before it reaches any local service.

Exam trap

The trap here is that candidates often confuse the `-s` (source) and `-d` (destination) flags, or mistakenly apply the rule to the FORWARD or OUTPUT chain instead of the INPUT chain, failing to understand the packet flow through iptables chains.

How to eliminate wrong answers

Option A is wrong because it uses `-d 10.0.0.5` (destination IP) instead of `-s` (source IP), which would drop packets destined to 10.0.0.5 rather than from it. Option B is wrong because it targets the FORWARD chain, which only applies to packets routed through the system, not those destined for the local host. Option C is wrong because it uses the OUTPUT chain, which processes outgoing packets from the local system, not incoming packets from a remote host.

Full explanation →

503

MCQmedium

An administrator needs to add support for a new hardware device by compiling a kernel module. After compiling the module against the current kernel source, the module fails to load with 'modprobe: ERROR: could not insert 'mymod': Unknown symbol in module'. Which of the following is the most likely cause?

A.The module has not been signed for Secure Boot

B.The module was compiled against a different kernel version than the running kernel

C.The module's dependencies are missing

D.The module name conflicts with a built-in driver

AnswerB

Symbols exported by the kernel change between versions; the module must be compiled against the exact running kernel.

Why this answer

The error 'Unknown symbol in module' indicates that the module references a kernel symbol (function or variable) that is not present in the currently running kernel. This most commonly occurs when the module was compiled against a different kernel version or configuration than the running kernel, causing symbol version mismatches. The kernel's symbol versioning (CONFIG_MODVERSIONS) checks CRC values of exported symbols, and a mismatch prevents insertion.

Exam trap

The trap here is that candidates often confuse 'Unknown symbol' with missing dependencies (Option C), but the error specifically points to a symbol version mismatch, not a missing module dependency chain.

How to eliminate wrong answers

Option A is wrong because Secure Boot signature issues produce a different error (e.g., 'Required key not available' or 'Module has invalid ELF structures'), not 'Unknown symbol'. Option C is wrong because missing dependencies cause 'Unknown symbol' errors only if the dependency module itself is not loaded, but the error message would typically name the missing symbol; however, the primary cause here is version mismatch, not dependency order. Option D is wrong because a name conflict with a built-in driver would cause a different error (e.g., 'Module already present in kernel' or 'insmod: ERROR: could not insert module mymod: File exists'), not an unknown symbol error.

Full explanation →

504

MCQeasy

A system administrator wants to ensure that all commands executed by root are logged to a remote syslog server. Which rsyslog configuration directive should be used?

A.auth.* @192.168.1.100

B.authpriv.* @192.168.1.100

C.user.* @192.168.1.100

D.kern.* @192.168.1.100

AnswerB

authpriv facility logs security/authorization messages including sudo commands.

Why this answer

The `authpriv` facility in rsyslog is specifically designated for security and authorization messages, including all commands executed by root via `sudo` or direct login. The directive `authpriv.* @192.168.1.100` sends all messages from this facility to the remote syslog server at UDP port 514. This matches the requirement to log root's commands, as Linux systems typically log such events under the `authpriv` facility.

Exam trap

The trap here is confusing `auth` with `authpriv` — candidates often pick `auth.*` thinking it covers all authentication, but `authpriv` is the correct facility for privileged command logging and is a key distinction tested in LPIC-2.

How to eliminate wrong answers

Option A is wrong because `auth.*` covers general authentication events (e.g., login attempts) but not the detailed command logging from root's sessions, which is specifically assigned to `authpriv`. Option C is wrong because `user.*` is for generic user-level messages, not security-related command logs. Option D is wrong because `kern.*` captures kernel messages, not user command execution logs.

Full explanation →

505

MCQhard

An administrator configures an NIS client by running 'ypbind' and updating /etc/nsswitch.conf to include 'nis' for passwd, shadow, and group. However, 'getent passwd' still shows only local users. Which step is most likely missing?

A.Restart the ypserv service on the client.

B.Execute 'yppasswd' to initialize NIS client.

C.Edit /etc/yp.conf to specify the NIS server's domain and address.

D.Run 'make -C /var/yp' on the client.

AnswerC

ypbind needs this to locate the server.

Why this answer

The NIS client must know which NIS server to contact for domain information. This is configured in /etc/yp.conf, which specifies the NIS domain name and the server's hostname or IP address. Without this file, ypbind cannot locate a server, so getent falls back to local sources despite nsswitch.conf listing 'nis'.

Exam trap

The trap here is that candidates assume updating nsswitch.conf alone is sufficient, overlooking the mandatory /etc/yp.conf configuration that ypbind requires to discover and bind to an NIS server.

How to eliminate wrong answers

Option A is wrong because ypserv is the NIS server daemon, not a client service; restarting it on the client is meaningless and would not configure the client to find a server. Option B is wrong because yppasswd is used to change NIS passwords, not to initialize or enable NIS client functionality. Option D is wrong because 'make -C /var/yp' rebuilds the NIS server's maps (typically run on the server), not on the client, and has no effect on client-side resolution.

Full explanation →

506

Multi-Selecteasy

Which command can be used to trace the delegation path of a DNS domain?

Select 1 answer

A.dig +trace

B.nslookup -type=any

C.host -C

D.dig -x

E.whois

AnswersA

Correct: `dig +trace` performs iterative DNS resolution and displays each delegation step.

Why this answer

The `dig +trace` command performs a full iterative DNS resolution from the root nameservers down to the authoritative nameservers for the queried domain, showing each delegation step. The `host -C` command is not a delegation tracing tool; it only queries SOA records from authoritative servers and does not follow the delegation chain. Therefore, only `dig +trace` is correct.

Exam trap

Candidates often mistake `host -C` for a delegation tracing tool, but it only queries SOA records without following the delegation chain. `dig +trace` is the correct command for tracing the delegation path.

Full explanation →

507

Drag & Dropmedium

Order the steps to configure a Linux system as a router using iptables.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

When configuring a Linux system as a router using iptables, the proper order is: first enable IP forwarding (via sysctl), then set default iptables policies (e.g., DROP for FORWARD), then add NAT (e.g., MASQUERADE) and FORWARD rules, and finally save the iptables configuration to make it persistent. This sequence ensures the kernel is prepared for routing, policies are in place to control traffic flow, rules are applied correctly, and changes are saved.

Full explanation →

Linux Professional Institute Certification Level 2 LPIC-2 (LPIC-2) — Questions 451–507