How should I use these Scenario practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Scenario questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Scenario domain.

LPIC-2 · topic practice

Scenario practice questions

Practise Linux Professional Institute Certification Level 2 LPIC-2 Scenario practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

10 questionsDomain: Scenario

Practice 10 questions Browse domain →

What the exam tests

What to know about Scenario

Scenario questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Scenario exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Scenario questions

10 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Review the full routing breakdown →

A Linux router is experiencing asymmetric routing issues. The network has two internet connections (ISP1 and ISP2) with default routes. The administrator wants to ensure that traffic originating from a specific source IP uses ISP1 for both incoming and outgoing packets. Which ip rule configuration achieves this?

Trap 1: ip rule add from 10.0.0.10 to 0/0 table isp1; ip route add default…

Extra rule for incoming traffic is unnecessary; rp_filter still may drop packets.

Trap 2: ip rule add from 10.0.0.10 table isp1; ip route add default via…

Missing sysctl tuning; reverse path filtering will drop return packets arriving on a different interface.

Trap 3: ip rule add from 10.0.0.10 table isp1; ip route add default via…

Default route not added to custom table; also no rp_filter adjustment.

Study all Scenario common traps →

A
ip rule add from 10.0.0.10 to 0/0 table isp1; ip route add default via 1.1.1.1 table isp1; ip rule add to 10.0.0.10 table isp1
Why wrong: Extra rule for incoming traffic is unnecessary; rp_filter still may drop packets.
B
ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1 table isp1; sysctl -w net.ipv4.conf.all.rp_filter=0
Policy routing with table-specific default and disabled rp_filter allows asymmetric routing.
C
ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1 table isp1
Why wrong: Missing sysctl tuning; reverse path filtering will drop return packets arriving on a different interface.
D
ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1
Why wrong: Default route not added to custom table; also no rp_filter adjustment.

Full breakdown with real-world context →

Question 2easymultiple choice

Read the full Scenario explanation →

A system administrator wants to combine two 1 Gbps Ethernet interfaces into a single logical bonded interface to increase throughput and provide redundancy. Which mode of bonding will provide both load balancing and fault tolerance without requiring switch configuration?

Trap 1: mode 2 (balance-xor)

XOR balancing typically requires the switch to be configured for static link aggregation to work correctly.

Trap 2: mode 1 (active-backup)

Active-backup provides redundancy but does not provide load balancing across interfaces.

Trap 3: mode 0 (balance-rr)

Round-robin mode may cause out-of-order packets and requires the switch to treat both ports as separate, potentially causing issues.

Study all Scenario common traps →

A
mode 6 (balance-alb)
Adaptive load balancing (balance-alb) provides load balancing and fault tolerance without switch configuration.
B
mode 2 (balance-xor)
Why wrong: XOR balancing typically requires the switch to be configured for static link aggregation to work correctly.
C
mode 1 (active-backup)
Why wrong: Active-backup provides redundancy but does not provide load balancing across interfaces.
D
mode 0 (balance-rr)
Why wrong: Round-robin mode may cause out-of-order packets and requires the switch to treat both ports as separate, potentially causing issues.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Scenario explanation →

A system administrator notices that external clients cannot resolve the company's primary website (www.example.com) but internal clients can. What is the most likely cause?

Trap 1: The internal DNS server is not authoritative for the zone.

An internal server can be authoritative; the problem is external resolution.

Trap 2: The firewall is blocking port 53 UDP to the internal DNS server.

This would affect internal clients as well, not just external.

Trap 3: The internal DNS server is not configured for recursion.

Recursion is not needed for authoritative name resolution; internal clients may still resolve if the server is authoritative.

Study all Scenario common traps →

A
The internal DNS server is not authoritative for the zone.
Why wrong: An internal server can be authoritative; the problem is external resolution.
B
The firewall is blocking port 53 UDP to the internal DNS server.
Why wrong: This would affect internal clients as well, not just external.
C
The external DNS server has a missing A record for www.example.com.
External clients query the external authoritative server; if the A record is missing, resolution fails.
D
The internal DNS server is not configured for recursion.
Why wrong: Recursion is not needed for authoritative name resolution; internal clients may still resolve if the server is authoritative.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full Scenario explanation →

A user reports that an external USB hard drive is not detected when plugged in. The system uses a standard kernel with USB support. What is the most likely reason?

Exhibit

Refer to the exhibit.

$ cat /etc/modprobe.d/blacklist.conf
# Disable USB storage to prevent unauthorized devices
blacklist usb_storage

Trap 1: The USB driver is not installed.

The driver is present but blacklisted; it would be installed by default.

Trap 2: The external drive is incompatible.

Incompatibility would cause errors in dmesg, not a silent failure; blacklist is more likely for a standard drive.

Trap 3: The kernel lacks USB support.

USB support is present; the system would not even see the device if kernel lacked it.

Study all Scenario common traps →

A
The USB driver is not installed.
Why wrong: The driver is present but blacklisted; it would be installed by default.
B
The external drive is incompatible.
Why wrong: Incompatibility would cause errors in dmesg, not a silent failure; blacklist is more likely for a standard drive.
C
The kernel lacks USB support.
Why wrong: USB support is present; the system would not even see the device if kernel lacked it.
D
The usb_storage module is blacklisted.
The blacklist directive prevents the module from loading automatically.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full Scenario explanation →

A Linux server with two NICs bonded in mode 1 (active-backup) was working correctly until a switch was replaced. Now, although both interfaces are up, the bond always shows only one active slave, and if that slave fails, traffic does not fail over. The bonding configuration uses miimon=100 and neither arp_interval nor arp_ip_target is set. You run 'cat /proc/net/bonding/bond0' and see that the MII status of both slaves is 'up' but the link failures count is 0 for the backup slave. What is the most likely cause, and which parameter should be adjusted?

Trap 1: Change bonding mode to mode 4 (802.3ad) with LACP.

Mode change will not solve link monitoring; it's a different aggregation method.

Trap 2: Use ifenslave to manually reassign the backup slave.

Manual reassignment defeats automatic failover.

Trap 3: Decrease miimon to 50 for faster detection.

MII cannot detect failures where link remains electrically up but data stops.

Study all Scenario common traps →

A
Change bonding mode to mode 4 (802.3ad) with LACP.
Why wrong: Mode change will not solve link monitoring; it's a different aggregation method.
B
Use ifenslave to manually reassign the backup slave.
Why wrong: Manual reassignment defeats automatic failover.
C
Decrease miimon to 50 for faster detection.
Why wrong: MII cannot detect failures where link remains electrically up but data stops.
D
Configure arp_interval and arp_ip_target to enable ARP monitoring.
ARP monitoring can detect reachability of a gateway, catching switch-level issues.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Scenario explanation →

An administrator is troubleshooting network isolation in a Linux container environment. The container should have its own network stack, but it appears to be using the host's interfaces. Which command correctly runs a command inside a network namespace named 'ns1' to verify its network configuration?

Trap 1: nsenter -t 1234 -n ip addr show

Requires process PID; not for named namespace.

Trap 2: unshare -n ip addr show

Creates new namespace, does not use existing one.

Trap 3: ip netns add ns1

Only adds namespace, does not execute command.

Study all Scenario common traps →

A
nsenter -t 1234 -n ip addr show
Why wrong: Requires process PID; not for named namespace.
B
ip netns exec ns1 ip addr show
Executes command in named network namespace.
C
unshare -n ip addr show
Why wrong: Creates new namespace, does not use existing one.
D
ip netns add ns1
Why wrong: Only adds namespace, does not execute command.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full DHCP explanation →

Refer to the exhibit. The output shows a DHCP exchange between a client (MAC 00:1a:2b:3c:4d:5e) and a server (192.168.1.1). The client is not obtaining an IP address. What is the most likely reason?

Exhibit

Refer to the exhibit.

Output of `tcpdump -i eth0 port 67 or port 68`:

```
13:10:05.123456 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:1a:2b:3c:4d:5e, length 300
13:10:05.123789 IP 192.168.1.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 300
```

Trap 1: The DHCP server did not receive the client's request.

The server sent a reply, so it received the request.

Trap 2: The DHCP server is not reachable from the client.

The server replied, so it is reachable.

Trap 3: The client's MAC address is not authorized on the DHCP server.

If unauthorized, the server would not reply with an offer; but it did reply.

Study all Scenario common traps →

A
The client's /etc/dhcp/dhclient.conf contains a 'reject' statement that rejects offers from this server.
If the client rejects the server, it will ignore the offer and continue sending requests.
B
The DHCP server did not receive the client's request.
Why wrong: The server sent a reply, so it received the request.
C
The DHCP server is not reachable from the client.
Why wrong: The server replied, so it is reachable.
D
The client's MAC address is not authorized on the DHCP server.
Why wrong: If unauthorized, the server would not reply with an offer; but it did reply.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Scenario explanation →

An administrator needs to encrypt a large file using GPG with a symmetric cipher and then decrypt it on another system. Which command encrypts the file using AES256 and prompts for a passphrase?

Trap 1: gpg --clearsign --cipher-algo AES256 file.txt

--clearsign creates a clearsign signature.

Trap 2: gpg --encrypt --cipher-algo AES256 file.txt

--encrypt requires a recipient key; prompts for key not passphrase.

Trap 3: gpg --sign --cipher-algo AES256 file.txt

--sign creates a signature, not encryption.

Study all Scenario common traps →

A
gpg --clearsign --cipher-algo AES256 file.txt
Why wrong: --clearsign creates a clearsign signature.
B
gpg --encrypt --cipher-algo AES256 file.txt
Why wrong: --encrypt requires a recipient key; prompts for key not passphrase.
C
gpg --sign --cipher-algo AES256 file.txt
Why wrong: --sign creates a signature, not encryption.
D
gpg --symmetric --cipher-algo AES256 file.txt
Symmetric encryption prompts for passphrase; uses AES256.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full Scenario explanation →

A company requires link aggregation between a Linux server and a switch to increase throughput and provide redundancy. The switch supports only standard 802.3ad (LACP). Which bonding mode should be configured on the Linux server?

Trap 1: mode=2 (balance-xor)

May work but not standard 802.3ad; could cause packet misordering.

Trap 2: mode=1 (active-backup)

Provides only redundancy, no load balancing.

Trap 3: mode=3 (broadcast)

Transmits on all slaves, suitable only for specific use cases.

Study all Scenario common traps →

A
mode=2 (balance-xor)
Why wrong: May work but not standard 802.3ad; could cause packet misordering.
B
mode=1 (active-backup)
Why wrong: Provides only redundancy, no load balancing.
C
mode=3 (broadcast)
Why wrong: Transmits on all slaves, suitable only for specific use cases.
D
mode=0 (balance-rr)
Why wrong: Requires switch support for link aggregation, often proprietary.
E
mode=4 (802.3ad)
Standard LACP mode for switch configuration.

Full breakdown with real-world context →

Question 10mediummultiple choice

Read the full Scenario explanation →

A user in group staff (but not admin) tries to write to the share. What is the most likely error?

Exhibit

Refer to the exhibit.

[global]
   workgroup = EXAMPLE
   security = user
   passdb backend = tdbsam

[data]
   path = /srv/samba/data
   valid users = @staff
   write list = @admin
   read only = yes

Trap 1: NT_STATUS_BAD_NETWORK_NAME

Indicates share not found, but share exists.

Trap 2: NT_STATUS_ACCESS_DENIED

Access denied would occur if not in valid users; but here valid includes staff.

Trap 3: NT_STATUS_OBJECT_NAME_NOT_FOUND

Indicates path not found.

Study all Scenario common traps →

A
NT_STATUS_BAD_NETWORK_NAME
Why wrong: Indicates share not found, but share exists.
B
NT_STATUS_ACCESS_DENIED
Why wrong: Access denied would occur if not in valid users; but here valid includes staff.
C
Connection successful but cannot write
The user can connect (valid includes staff) but write fails due to read only and no write list.
D
NT_STATUS_OBJECT_NAME_NOT_FOUND
Why wrong: Indicates path not found.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Scenario sessions

Start a Scenario only practice session

Every question in these sessions is drawn from the Scenario domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Scenario questions →Mixed LPIC-2 session

Frequently asked questions

What does the LPIC-2 exam test about Scenario?: Scenario questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Scenario questions in a focused session?: Yes — the session launcher on this page draws every question from the Scenario domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other LPIC-2 topics?: Use the topic links above to move to related areas, or go back to the LPIC-2 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the LPIC-2 exam covers. They are not copied from any real exam or dump site.

Scenario only

10 questions 20 questions 30 questions 50 questions

Mixed LPIC-2 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All LPIC-2 questions Scenario domain overview LPIC-2 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Scenario practice questions

What to know about Scenario

Common Scenario exam traps

Scenario questions

A system administrator wants to combine two 1 Gbps Ethernet interfaces into a single logical bonded interface to increase throughput and provide redundancy. Which mode of bonding will provide both load balancing and fault tolerance without requiring switch configuration?

A system administrator notices that external clients cannot resolve the company's primary website (www.example.com) but internal clients can. What is the most likely cause?

A user reports that an external USB hard drive is not detected when plugged in. The system uses a standard kernel with USB support. What is the most likely reason?

Exhibit

Refer to the exhibit. The output shows a DHCP exchange between a client (MAC 00:1a:2b:3c:4d:5e) and a server (192.168.1.1). The client is not obtaining an IP address. What is the most likely reason?

Exhibit

An administrator needs to encrypt a large file using GPG with a symmetric cipher and then decrypt it on another system. Which command encrypts the file using AES256 and prompts for a passphrase?

A company requires link aggregation between a Linux server and a switch to increase throughput and provide redundancy. The switch supports only standard 802.3ad (LACP). Which bonding mode should be configured on the Linux server?

A user in group staff (but not admin) tries to write to the share. What is the most likely error?

Exhibit

Track your progress over time

Start a Scenario only practice session

Related LPIC-2 topic practice pages

Linux Kernel and System Startup practice questions

Block Devices, Filesystems and Advanced Storage practice questions

Advanced Networking Configuration practice questions

DNS, Web and Mail Services practice questions

File Sharing and Samba practice questions

System Security practice questions

Network Client Management practice questions

LPIC-2 fundamentals practice questions

LPIC-2 scenario practice questions

LPIC-2 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid