LPIC 2 202-450 Practice Questions with Explanations

Correct answer: C

The /etc/sysctl.conf file is the standard configuration file for persistent sysctl settings on Linux systems. Setting net.ipv4.ip_forward = 1 in this file ensures the kernel parameter is applied at boot time through the sysctl service. This is the proper, persistent method endorsed by Linux distributions for maintaining kernel parameters across reboots.

Why the other options are wrong:

• A. Login scripts only execute when a user logs in, not at system boot, and root may not always log in.
• B. Relying on user login scripts is unreliable and won't execute if no user logs in after boot.
• D. The /etc/rc.local syntax is incorrect; it should use sysctl format (net.ipv4.ip_forward = 1) but sysctl.conf is the proper location.
• E. The iptables-config file is for iptables-specific settings, not general kernel parameters, and the syntax is wrong.

Correct answer: D

The 'nobind' option in OpenVPN client configuration tells the client to not bind to a fixed local port, allowing it to use dynamic source ports when making connections to peers. This is the correct option for enabling dynamic source port allocation in OpenVPN clients.

Why the other options are wrong:

• A. src-port is not a valid OpenVPN configuration option.
• B. remote specifies the peer address and port, not the local source port behavior.
• C. source-port is not a valid OpenVPN configuration option.
• E. dynamic-bind is not a valid OpenVPN configuration option.

Correct answer: E

The vsftpd daemon uses the Linux user specified in the ftp_username configuration option (typically 'ftp') to perform file system operations on behalf of anonymous FTP users. This configuration option explicitly defines which user account vsftpd impersonates when handling anonymous connections, allowing administrators to control file permissions and access.

Why the other options are wrong:

• A. The vsftpd process typically runs as root or a dedicated service user, not the user for anonymous operations.
• B. The FTP root directory owner is not necessarily the user used for anonymous operations.
• C. Anonymous users don't have Linux usernames; they're mapped to a single configured user.
• D. vsftpd does not rely on root access with special file permissions for anonymous users; it uses a dedicated ftp user account.

Correct answer: C

When the INPUT chain policy is DROP, a rule allowing localhost traffic is necessary because many applications use the localhost interface (127.0.0.1 and ::1) to communicate with other local applications or services. Without allowing loopback traffic, essential inter- process communication breaks, causing applications and system services to malfunction. This is a fundamental networking principle that applies regardless of netfilter's specific implementation.

Why the other options are wrong:

• A. While true, this is too vague and doesn't explain the specific technical reason why it's necessary.
• B. Netfilter absolutely affects localhost traffic; packets addressed to localhost travel through the network stack and are subject to iptables rules.
• D. While syslogd may use localhost, this is too specific; the general principle applies to many applications.
• E. iptables is a userspace utility; netfilter is the kernel subsystem. The management daemon netfilterd doesn't exist; iptables communicates directly with the kernel.

Correct answer: C

To enable SSH key-based login to a remote server, the public key (id_rsa.pub) from the local client must be transmitted and added to the remote server's ~/.ssh/authorized_keys file. The public key is the only component that should be shared with remote systems; it is used by the server to verify that the client possesses the corresponding private key.

Why the other options are wrong:

• A. authorized_keys is the destination file on the remote server where the public key is placed, not the file to be transmitted from the local client.
• B. config is a local SSH client configuration file that specifies connection preferences and has no role in key authentication.
• D. id_rsa is the private key and must never be transmitted or shared with any remote system.
• E. known_hosts stores fingerprints of remote servers the client has connected to, unrelated to authentication key setup.

Correct answer: B

OpenVAS (Open Vulnerability Assessment System) is a network security scanner project built around a server with a collection of network vulnerability tests. It performs comprehensive vulnerability scanning and assessment on network hosts and services.

Why the other options are wrong:

• A. NetMap is not a recognized network vulnerability scanning framework or project.
• C. Smartscan is not a standard or widely recognized network vulnerability assessment tool.
• D. Wireshark is a packet analyzer and network protocol analyzer, not a vulnerability scanner with tests.

Correct answer: C

In fail2ban, a 'jail' is a combination of a filter definition (which identifies attack patterns in log files) and one or more actions (such as banning or alerting) that are executed when the filter conditions are matched. Jails are the fundamental operational units in fail2ban.

Why the other options are wrong:

• A. While jails may result in netfilter rules being applied, a jail itself is not defined as a netfilter chain.
• B. A jail is specific to a service or log file pattern, not a group of similar services, though multiple jails can be configured.
• D. Fail2ban does not run in a chroot environment; jails are not related to chroot isolation.

Correct answer: C

In Samba, 'writeable=no' is functionally identical to 'read only=yes'. Both parameters serve the same purpose of making a share read-only, preventing clients from writing or modifying files on that share.

Why the other options are wrong:

• A. browseable=no controls whether a share appears in browse lists, not whether it is read-only.
• B. read write=no is not a standard Samba parameter.
• D. write only=no is not a standard Samba parameter and is not a valid configuration option.
• E. write access=no is not a standard Samba parameter for controlling share permissions.

Correct answer: D

Samba cannot directly use /etc/passwd and /etc/shadow files for CIFS password authentication. Samba requires its own password database (typically smbpasswd or tdbsam) because it needs to store password hashes in a format compatible with the SMB/CIFS protocol, which differs from Unix crypt or shadow formats. This is a fundamental architectural limitation of Samba.

Why the other options are wrong:

• A. Setting these parameters alone does not enable /etc/passwd and /etc/shadow usage; Samba cannot authenticate against them.
• B. Even with these parameters and algorithm specification, Samba cannot directly authenticate against /etc/passwd and /etc/shadow.
• C. Creating symbolic links does not work because Samba cannot parse the shadow file format for CIFS authentication.
• E. smbpasswd is used to maintain Samba's own password database, not to convert Unix password files for Samba use.

Correct answer: B

The 'print$' share is the standard CIFS share where printer drivers must be placed to enable Point'n'Print driver deployment on Windows clients. This is a well-defined convention in Samba for managing printer driver distribution.

Why the other options are wrong:

• A. winx64drv$ is not a standard Samba share for printer driver deployment.
• C. While Samba allows configuration options, the standard and expected share for Point'n'Print is print$, not a custom-named share.
• D. pnpdrivers$ is not a recognized Samba share name for printer driver storage.
• E. NETLOGON is used for logon scripts and domain policies, not for printer driver distribution.

Correct answer: A

The winbindd service handles the membership of a file server in an Active Directory domain. It manages user and group information from Active Directory, performs domain authentication, and provides name service switching integration for AD users and groups.

Why the other options are wrong:

• B. nmbd handles NetBIOS name registration and browsing, not Active Directory domain membership.
• C. msadd is not a recognized Samba service.
• D. admemb is not a recognized Samba service.
• E. samba (the main daemon) handles file sharing and printing, not specifically AD domain membership management.

Correct answer: B

The NFSv4 pseudo file system is a virtual namespace on the NFS server that usually contains bind mounts of the directory trees to be exported. These bind mounts present the actual exported directories within a unified namespace that NFSv4 clients see as a single coherent file system hierarchy.

Why the other options are wrong:

• A. The pseudo file system is not required to be named /exports; the name is configurable.
• C. The pseudo file system does not need to be a dedicated partition; it is typically a directory within the existing file system.
• D. The NFSv4 root is not defined in /etc/pathmapd.conf; it is configured in /etc/exports or /etc/nfs.conf.
• E. The pseudo file system uses bind mounts rather than symlinks to present the exported directory trees.

Correct answer: A

The 'exportfs' command is used to configure and manage which filesystems an NFS server makes available to clients. It reads the /etc/exports file and maintains the kernel's export table, allowing administrators to add, remove, or modify NFS exports without restarting the service.

Why the other options are wrong:

• B. mkfs.nfs creates filesystems and is unrelated to NFS export configuration
• C. mount is used to mount filesystems locally, not to configure NFS server exports
• D. nfsservctl (or similar) is not a standard command for configuring NFS exports
• E. telinit is used to change runlevels and is unrelated to NFS configuration

Correct answer: A

The 'dig' command provides the most detailed and comprehensive output for DNS queries without any options. It displays full DNS response data including headers, sections, and query details, making it superior to nslookup and host for diagnostic purposes.

Why the other options are wrong:

• B. nslookup provides less detailed output than dig and is considered legacy
• C. host provides only basic DNS lookup information with minimal details
• D. named-checkconf validates BIND configuration files, not a query tool
• E. named-checkzone validates zone files, not a DNS query tool

Correct answer: C

The PTR record in the ANSWER SECTION shows 'PTR linuserv.example.net.123.168.192.in-addr.arpa' which is incorrect syntax. In reverse lookup zones, the PTR record's target (the hostname it points to) must be a fully qualified domain name (FQDN) ending with a dot. The correct format should be 'PTR linuserv.example.net.' (with a trailing dot) instead of what appears to be 'linuserv.example.net.123.168.192.in-addr.arpa' as the target. The missing dot after linuserv.example.net in the reverse lookup zone file prevents proper FQDN resolution, causing DNS lookup failures.

Why the other options are wrong:

• A. The forward lookup zone uses A records and NS records, not PTR records; PTR records exist only in reverse zones.
• B. The incomplete hostname 'linuserv' is not the issue; the problem is the FQDN terminator in the reverse zone file.
• D. The NS record definition 'linuserv.example.net.' is correctly formatted with a trailing dot and does not need modification.

Correct answer: E

The correct BIND option to disable recursive queries is 'recursion no;' in the global options section. This is the standard syntax used in named.conf to prevent the DNS server from performing recursive lookups on behalf of clients.

Why the other options are wrong:

• A. The syntax 'allow-recursive-query ( none; )' is not valid BIND configuration syntax
• B. The syntax 'allow-recursive-query off' is not the correct BIND option name or format
• C. The syntax 'recursion { disabled; }' uses invalid syntax; recursion uses a boolean value
• D. The syntax 'recursion { none; }' uses invalid syntax with braces instead of a boolean value

Correct answer: A

A glue record is an A record that provides the IP address of a nameserver, typically needed when the nameserver's hostname is within the zone being delegated. Option A (ns1.lab A 198.51.100.53) is an A record that maps a nameserver hostname to its IP address, which is the definition of a glue record.

Why the other options are wrong:

• B. An NS record cannot be used as a glue record; glue records must be A or AAAA records
• C. An NS record with an IP address is invalid syntax; NS records contain hostnames, not addresses
• D. The notation 'ns1.' (with trailing dot but no domain) is incomplete and invalid
• E. GLUE is not a valid DNS record type; glue records are A or AAAA records by definition

Correct answer: B

DNSSEC (DNS Security Extensions) is used for cryptographic authentication of DNS zones. It provides digital signatures and keys that allow DNS clients to verify that DNS responses originate from authoritative sources and have not been tampered with during transmission.

Why the other options are wrong:

• A. DNSSEC does not encrypt DNS queries; it provides authentication through digital signatures
• C. Secondary DNS queries are not related to DNSSEC functionality
• D. DNSSEC authenticates zones and servers, not individual users who initiate queries
• E. DNSSEC provides authentication, not encryption of queries and answers

Correct answer: D

In BIND's named.conf configuration file, the blank line before 'friends {' should contain the keyword 'acl' to define an access control list. The proper syntax is 'acl friends { ... };' which declares a named ACL called 'friends' containing the specified IP address ranges. This ACL is then referenced in the options block with 'allow-query { friends; };' to permit DNS queries from those networks.

Why the other options are wrong:

• A. networks is not a BIND configuration keyword for defining address groups
• B. net is not the correct BIND syntax for declaring access control lists
• C. list is not the BIND keyword; access control lists use 'acl' not 'list'
• E. group is not a BIND configuration statement; ACLs are declared with 'acl'

Correct answer: C

In a BIND zone file, the @ character is a special symbol that represents the name of the zone as it is defined in the zone statement in the named.conf configuration file. It serves as a shorthand to refer to the zone apex without having to type the full zone name repeatedly.

Why the other options are wrong:

• A. @ does not represent the fully qualified hostname of the DNS server
• B. @ is not an alias for the zone master's email address; that is specified separately in SOA records
• D. @ is not used to create aliases between CNAME entries; it simply represents the zone name

Correct answer: B

The 'allow-transfer' option in BIND is used to limit which IP addresses are permitted to initiate zone transfers from the master nameserver. This controls which slave (secondary) nameservers can pull zone data from the primary server.

Why the other options are wrong:

• A. allow-zone-transfer is not the correct BIND option name
• C. allow-secondary is not a standard BIND option for restricting zone transfers
• D. allow-slaves is not a standard BIND option for zone transfer control
• E. allow-queries restricts which addresses can perform DNS queries, not zone transfers

Correct answer: D

The .htaccess configuration correctly specifies Basic authentication with AuthUserFile pointing to .htpasswd. However, the .htpasswd file contains 'usera:S3cr3t' which is a plain text password, not a properly hashed password (htpasswd typically creates MD5, bcrypt, or other hashed formats). When a user attempts to log in as usera with password 's3cr3t', Apache will prompt for credentials but the authentication will fail because Apache compares the submitted password against the stored hash. Since 'S3cr3t' is stored as plaintext rather than a proper hash, the login attempt for usera will not succeed, even though the authentication mechanism itself is functioning and prompting for credentials.

Why the other options are wrong:

• A. usera cannot access the site because the password in .htpasswd is not properly hashed; plain text storage causes authentication to fail
• B. HTTP 442 is not a standard error code; Apache would return 401 Unauthorized for failed authentication, not 442
• C. There is no server configuration error here; the files are correctly processed and the syntax is valid, so no 500 error would occur
• E. The Require valid-user directive enforces authentication, so the directory is protected and will not be delivered without credentials

Correct answer: B

SSLEngine on is the correct Apache HTTPD directive that enables SSL/TLS (HTTPS) protocol support. This directive must be present in the Apache configuration, typically within a VirtualHost or Directory context, to activate SSL/TLS functionality for secure connections.

Why the other options are wrong:

• A. HTTPSEngine is not a valid Apache directive; the correct module is mod_ssl which uses SSLEngine.
• C. SSLEnable is not a valid Apache directive syntax.
• D. HTTPSEnable is not a valid Apache directive.
• E. StartTLS is used in LDAP and SMTP contexts, not Apache HTTPD configuration.