How should I use these Scenario practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Scenario questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Scenario domain.

LPIC-2 · topic practice

Scenario practice questions

Practise Linux Professional Institute Certification Level 2 LPIC-2 Scenario practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

9 questionsDomain: Scenario

Practice 10 questions Browse domain →

What the exam tests

What to know about Scenario

Scenario questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Scenario exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Scenario questions

9 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Review the full routing breakdown →

A client on the internet sends a TCP SYN packet to 10.0.1.10:8080. The router receives it on eth0. According to the exhibit, what will happen to the packet?

Network Topology

Trap 1: The packet is dropped because the destination IP is not directly…

DNAT changes the destination to a directly connected network (10.0.2.0/24).

Trap 2: The packet is forwarded to 10.0.1.1 because it is the default…

After DNAT, the destination is 10.0.2.5, so routing will send it to that network, not the default gateway.

Trap 3: The packet is forwarded to 10.0.2.5:80 via eth1, with source IP…

MASQUERADE would only change source if the packet originated from 10.0.2.0/24.

Study all Scenario common traps →

A
The packet is dropped because the destination IP is not directly connected.
Why wrong: DNAT changes the destination to a directly connected network (10.0.2.0/24).
B
The packet is forwarded to 10.0.1.1 because it is the default gateway.
Why wrong: After DNAT, the destination is 10.0.2.5, so routing will send it to that network, not the default gateway.
C
The packet is forwarded to 10.0.2.5:80 via eth1, with source IP changed to 10.0.2.20.
Why wrong: MASQUERADE would only change source if the packet originated from 10.0.2.0/24.
D
The packet is forwarded to 10.0.2.5:80 via eth1, with source IP unchanged.
As described, DNAT changes destination, routing sends it to eth1, and no SNAT is applied.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Scenario explanation →

An administrator is troubleshooting network isolation in a Linux container environment. The container should have its own network stack, but it appears to be using the host's interfaces. Which command correctly runs a command inside a network namespace named 'ns1' to verify its network configuration?

Trap 1: nsenter -t 1234 -n ip addr show

Requires process PID; not for named namespace.

Trap 2: unshare -n ip addr show

Creates new namespace, does not use existing one.

Trap 3: ip netns add ns1

Only adds namespace, does not execute command.

Study all Scenario common traps →

A
nsenter -t 1234 -n ip addr show
Why wrong: Requires process PID; not for named namespace.
B
ip netns exec ns1 ip addr show
Executes command in named network namespace.
C
unshare -n ip addr show
Why wrong: Creates new namespace, does not use existing one.
D
ip netns add ns1
Why wrong: Only adds namespace, does not execute command.

Full breakdown with real-world context →

Question 3mediummultiple choice

Read the full Scenario explanation →

A web server is running in enforcing mode under SELinux. The administrator wants to allow Apache to connect to a remote database server. Which SELinux boolean needs to be set to allow httpd to make network connections?

Trap 1: httpd_enable_homedirs

This boolean allows Apache to access user home directories, not network connections.

Trap 2: httpd_can_network_connect_db

While this allows database connections, it is not the only boolean; the required one is httpd_can_network_connect.

Trap 3: httpd_unified

This boolean allows httpd to run in unified security context, not directly related to network.

Study all Scenario common traps →

A
httpd_enable_homedirs
Why wrong: This boolean allows Apache to access user home directories, not network connections.
B
httpd_can_network_connect_db
Why wrong: While this allows database connections, it is not the only boolean; the required one is httpd_can_network_connect.
C
httpd_can_network_connect
Setting this boolean to on allows httpd to initiate outbound network connections, including to databases.
D
httpd_unified
Why wrong: This boolean allows httpd to run in unified security context, not directly related to network.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full DHCP explanation →

Refer to the exhibit. The output shows a DHCP exchange between a client (MAC 00:1a:2b:3c:4d:5e) and a server (192.168.1.1). The client is not obtaining an IP address. What is the most likely reason?

Exhibit

Refer to the exhibit.

Output of `tcpdump -i eth0 port 67 or port 68`:

```
13:10:05.123456 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:1a:2b:3c:4d:5e, length 300
13:10:05.123789 IP 192.168.1.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 300
```

Trap 1: The DHCP server did not receive the client's request.

The server sent a reply, so it received the request.

Trap 2: The DHCP server is not reachable from the client.

The server replied, so it is reachable.

Trap 3: The client's MAC address is not authorized on the DHCP server.

If unauthorized, the server would not reply with an offer; but it did reply.

Study all Scenario common traps →

A
The client's /etc/dhcp/dhclient.conf contains a 'reject' statement that rejects offers from this server.
If the client rejects the server, it will ignore the offer and continue sending requests.
B
The DHCP server did not receive the client's request.
Why wrong: The server sent a reply, so it received the request.
C
The DHCP server is not reachable from the client.
Why wrong: The server replied, so it is reachable.
D
The client's MAC address is not authorized on the DHCP server.
Why wrong: If unauthorized, the server would not reply with an offer; but it did reply.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full NAT/PAT explanation →

A Linux router is experiencing asymmetric routing issues. The network has two internet connections (ISP1 and ISP2) with default routes. The administrator wants to ensure that traffic originating from a specific source IP uses ISP1 for both incoming and outgoing packets. Which ip rule configuration achieves this?

Trap 1: ip rule add from 10.0.0.10 to 0/0 table isp1; ip route add default…

Extra rule for incoming traffic is unnecessary; rp_filter still may drop packets.

Trap 2: ip rule add from 10.0.0.10 table isp1; ip route add default via…

Missing sysctl tuning; reverse path filtering will drop return packets arriving on a different interface.

Trap 3: ip rule add from 10.0.0.10 table isp1; ip route add default via…

Default route not added to custom table; also no rp_filter adjustment.

Study all Scenario common traps →

A
ip rule add from 10.0.0.10 to 0/0 table isp1; ip route add default via 1.1.1.1 table isp1; ip rule add to 10.0.0.10 table isp1
Why wrong: Extra rule for incoming traffic is unnecessary; rp_filter still may drop packets.
B
ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1 table isp1; sysctl -w net.ipv4.conf.all.rp_filter=0
Policy routing with table-specific default and disabled rp_filter allows asymmetric routing.
C
ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1 table isp1
Why wrong: Missing sysctl tuning; reverse path filtering will drop return packets arriving on a different interface.
D
ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1
Why wrong: Default route not added to custom table; also no rp_filter adjustment.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full Scenario explanation →

A system administrator wants to combine two 1 Gbps Ethernet interfaces into a single logical bonded interface to increase throughput and provide redundancy. Which mode of bonding will provide both load balancing and fault tolerance without requiring switch configuration?

Trap 1: mode 2 (balance-xor)

XOR balancing typically requires the switch to be configured for static link aggregation to work correctly.

Trap 2: mode 1 (active-backup)

Active-backup provides redundancy but does not provide load balancing across interfaces.

Trap 3: mode 0 (balance-rr)

Round-robin mode may cause out-of-order packets and requires the switch to treat both ports as separate, potentially causing issues.

Study all Scenario common traps →

A
mode 6 (balance-alb)
Adaptive load balancing (balance-alb) provides load balancing and fault tolerance without switch configuration.
B
mode 2 (balance-xor)
Why wrong: XOR balancing typically requires the switch to be configured for static link aggregation to work correctly.
C
mode 1 (active-backup)
Why wrong: Active-backup provides redundancy but does not provide load balancing across interfaces.
D
mode 0 (balance-rr)
Why wrong: Round-robin mode may cause out-of-order packets and requires the switch to treat both ports as separate, potentially causing issues.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full Scenario explanation →

A company requires link aggregation between a Linux server and a switch to increase throughput and provide redundancy. The switch supports only standard 802.3ad (LACP). Which bonding mode should be configured on the Linux server?

Trap 1: mode=2 (balance-xor)

May work but not standard 802.3ad; could cause packet misordering.

Trap 2: mode=1 (active-backup)

Provides only redundancy, no load balancing.

Trap 3: mode=3 (broadcast)

Transmits on all slaves, suitable only for specific use cases.

Study all Scenario common traps →

A
mode=2 (balance-xor)
Why wrong: May work but not standard 802.3ad; could cause packet misordering.
B
mode=1 (active-backup)
Why wrong: Provides only redundancy, no load balancing.
C
mode=3 (broadcast)
Why wrong: Transmits on all slaves, suitable only for specific use cases.
D
mode=0 (balance-rr)
Why wrong: Requires switch support for link aggregation, often proprietary.
E
mode=4 (802.3ad)
Standard LACP mode for switch configuration.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Scenario explanation →

A user in group staff (but not admin) tries to write to the share. What is the most likely error?

Exhibit

Refer to the exhibit.

[global]
   workgroup = EXAMPLE
   security = user
   passdb backend = tdbsam

[data]
   path = /srv/samba/data
   valid users = @staff
   write list = @admin
   read only = yes

Trap 1: NT_STATUS_BAD_NETWORK_NAME

Indicates share not found, but share exists.

Trap 2: NT_STATUS_ACCESS_DENIED

Access denied would occur if not in valid users; but here valid includes staff.

Trap 3: NT_STATUS_OBJECT_NAME_NOT_FOUND

Indicates path not found.

Study all Scenario common traps →

A
NT_STATUS_BAD_NETWORK_NAME
Why wrong: Indicates share not found, but share exists.
B
NT_STATUS_ACCESS_DENIED
Why wrong: Access denied would occur if not in valid users; but here valid includes staff.
C
Connection successful but cannot write
The user can connect (valid includes staff) but write fails due to read only and no write list.
D
NT_STATUS_OBJECT_NAME_NOT_FOUND
Why wrong: Indicates path not found.

Full breakdown with real-world context →

Question 9mediummultiple choice

Read the full Scenario explanation →

A Linux server with two NICs bonded in mode 1 (active-backup) was working correctly until a switch was replaced. Now, although both interfaces are up, the bond always shows only one active slave, and if that slave fails, traffic does not fail over. The bonding configuration uses miimon=100 and neither arp_interval nor arp_ip_target is set. You run 'cat /proc/net/bonding/bond0' and see that the MII status of both slaves is 'up' but the link failures count is 0 for the backup slave. What is the most likely cause, and which parameter should be adjusted?

Trap 1: Change bonding mode to mode 4 (802.3ad) with LACP.

Mode change will not solve link monitoring; it's a different aggregation method.

Trap 2: Use ifenslave to manually reassign the backup slave.

Manual reassignment defeats automatic failover.

Trap 3: Decrease miimon to 50 for faster detection.

MII cannot detect failures where link remains electrically up but data stops.

Study all Scenario common traps →

A
Change bonding mode to mode 4 (802.3ad) with LACP.
Why wrong: Mode change will not solve link monitoring; it's a different aggregation method.
B
Use ifenslave to manually reassign the backup slave.
Why wrong: Manual reassignment defeats automatic failover.
C
Decrease miimon to 50 for faster detection.
Why wrong: MII cannot detect failures where link remains electrically up but data stops.
D
Configure arp_interval and arp_ip_target to enable ARP monitoring.
ARP monitoring can detect reachability of a gateway, catching switch-level issues.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Scenario sessions

Start a Scenario only practice session

Every question in these sessions is drawn from the Scenario domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Scenario questions →Mixed LPIC-2 session

Frequently asked questions

What does the LPIC-2 exam test about Scenario?: Scenario questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Scenario questions in a focused session?: Yes — the session launcher on this page draws every question from the Scenario domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other LPIC-2 topics?: Use the topic links above to move to related areas, or go back to the LPIC-2 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the LPIC-2 exam covers. They are not copied from any real exam or dump site.

Scenario only

10 questions 20 questions 30 questions 50 questions

Mixed LPIC-2 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All LPIC-2 questions Scenario domain overview LPIC-2 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Scenario practice questions

What to know about Scenario

Common Scenario exam traps

Scenario questions

A client on the internet sends a TCP SYN packet to 10.0.1.10:8080. The router receives it on eth0. According to the exhibit, what will happen to the packet?

A web server is running in enforcing mode under SELinux. The administrator wants to allow Apache to connect to a remote database server. Which SELinux boolean needs to be set to allow httpd to make network connections?

Refer to the exhibit. The output shows a DHCP exchange between a client (MAC 00:1a:2b:3c:4d:5e) and a server (192.168.1.1). The client is not obtaining an IP address. What is the most likely reason?

Exhibit

A system administrator wants to combine two 1 Gbps Ethernet interfaces into a single logical bonded interface to increase throughput and provide redundancy. Which mode of bonding will provide both load balancing and fault tolerance without requiring switch configuration?

A company requires link aggregation between a Linux server and a switch to increase throughput and provide redundancy. The switch supports only standard 802.3ad (LACP). Which bonding mode should be configured on the Linux server?

A user in group staff (but not admin) tries to write to the share. What is the most likely error?

Exhibit

Track your progress over time

Start a Scenario only practice session

Related LPIC-2 topic practice pages

Linux Kernel and System Startup practice questions

Block Devices, Filesystems and Advanced Storage practice questions

Advanced Networking Configuration practice questions

DNS, Web and Mail Services practice questions

File Sharing and Samba practice questions

System Security practice questions

Network Client Management practice questions

LPIC-2 fundamentals practice questions

LPIC-2 scenario practice questions

LPIC-2 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid