- What This Cheat Sheet Covers (and What It Does Not)
- Exam Format Facts You Can Rely On
- Domain Name Server: BIND, Zones, and DNSSEC
- Web Services: Apache, Nginx, and Squid
- File Sharing: Samba and NFS
- Network Client Management: DHCP, PAM, and LDAP
- E-Mail Services: Postfix, Dovecot, and Sieve
- System Security: Firewalls, VPNs, and Hardening
- Scheduling the Six Domains Across Your Prep
- Last-Day Review Checklist
- Frequently Asked Questions
- Exam 202 has 60 multiple-choice and fill-in-the-blank questions in 90 minutes, so fill-in answers demand exact command and directive spelling.
- The six content areas are DNS, Web Services, File Sharing, Network Client Management, E-Mail Services, and System Security.
- Passing 202-450 alone does not award LPIC-2; you must also pass 201-450 and hold an active LPIC-1.
- Memorize config file paths and key directives for BIND, Apache, Samba, Postfix, and Dovecot before drilling practice questions.
What This Cheat Sheet Covers (and What It Does Not)
This page condenses the facts most worth memorizing for LPIC-2 Exam 202 (Part 2 of 2), version 4.5 (202-450), published by the Linux Professional Institute (LPI). It is built around the six content areas of the published objectives: Domain Name Server, Web Services, File Sharing, Network Client Management, E-Mail Services, and System Security. It is a review aid for candidates who have already studied, not a substitute for hands-on practice. If you are still building your plan, start with the LPIC-2 202-450 study guide and come back here for the final pass.
One caution up front: LPI publishes objectives with individual weights, not aggregate domain percentages. This sheet therefore does not claim that any one domain is worth a set share of the paper. Treat all six as testable, and use the complete guide to the six content areas for objective-level detail.
Exam Format Facts You Can Rely On
| Item | Fact |
|---|---|
| Issuer | Linux Professional Institute (LPI) |
| Exam | LPIC-2 Exam 202 (Part 2 of 2), version 4.5, code 202-450 |
| Questions | 60, multiple-choice and fill-in-the-blank |
| Time limit | 90 minutes |
| Prerequisite | Active LPIC-1 certification required to receive LPIC-2 |
| Award condition | Both 201-450 and 202-450 must be passed |
| Validity | 5 years |
| Pricing and delivery | Verify current regional pricing and delivery with LPI and Pearson VUE |
Ninety minutes for 60 questions gives you roughly 90 seconds per item on average, which is comfortable for recall questions and tight for scenarios that require reading a configuration snippet. Fill-in-the-blank items are the real trap: you type the answer, so named-checkconf versus named-checkconfig is the difference between credit and none. Details on eligibility are in the requirements guide, and the money side is broken down in the certification cost breakdown. The official passing score is not asserted here because a current value was not verified, so see the passing score page and LPI directly.
Domain Name Server: BIND, Zones, and DNSSEC
The DNS domain rewards candidates who have actually run a name server. Expect questions that show a zone file or named.conf fragment and ask what is broken.
Domain Name Server
Know how BIND is configured, how zones are defined, and how answers are secured.
- Main config:
named.conf, withoptions,zone, andaclstatements; validate withnamed-checkconfandnamed-checkzone. - Zone files: SOA fields (serial, refresh, retry, expire, negative TTL), plus NS, A, AAAA, MX, CNAME, PTR, and TXT records.
- Control:
rndcfor reload, reconfig, flush, and status. - Replication: master and slave (primary and secondary) zones, zone transfers,
allow-transfer, and NOTIFY. - Security: TSIG keys for transfers, split-horizon with views, running named in a chroot or as an unprivileged user, DNSSEC basics (DNSKEY, RRSIG, DS, key signing versus zone signing keys).
- Troubleshooting tools:
digandhostfor queries, including reverse lookups.
A frequent pitfall is forgetting to increment the SOA serial after editing a zone, which leaves secondaries serving stale data. Another is the trailing dot: an unqualified name in a zone file gets the origin appended, so mail.example.com without a final dot becomes mail.example.com.example.com.. Questions on delegation and reverse zones (in-addr.arpa) also appear, so be able to construct a reverse name from an address on sight.
Web Services: Apache, Nginx, and Squid
This area spans three server roles: the web server, the reverse proxy, and the forward proxy and cache.
Web Services
Be fluent in configuration structure and TLS, not just installation.
- Apache HTTPD: main config and included files,
VirtualHostblocks (name-based and IP-based),Listen,DocumentRoot,Directoryand.htaccessoverrides,AllowOverride, and module loading. - Access and authentication:
Requiredirectives, basic and digest auth,htpasswd, and per-directory restrictions. - TLS: certificate and key directives, certificate chains, and protocol and cipher restrictions; know where
SSLCertificateFileandSSLCertificateKeyFilebelong. - Nginx:
serverandlocationblocks, using it as a reverse proxy withproxy_pass, and basic load balancing across upstreams. - Squid:
http_port, ACL definitions, and the order ofhttp_accessrules, where the first match wins.
Expect scenario questions such as "which directive restricts this directory to one subnet?" or "why does this virtual host never get requests?" Apache's rule that the first matching name-based virtual host acts as the default is a classic source of wrong answers. For Squid, remember that rule order is everything: a broad allow placed above a specific deny silently defeats the deny.
File Sharing: Samba and NFS
File sharing questions test whether you can expose the right resource to the right client with the right identity mapping.
File Sharing
Samba for Windows interoperability, NFS for Unix-to-Unix sharing.
- Samba configuration:
smb.confwith[global],[homes], and[printers]sections; share options such aspath,valid users,read only, andbrowseable. - Samba tools:
testparmto validate,smbpasswdandpdbeditfor users,smbclientandsmbstatusfor testing and monitoring, andnetfor domain operations. - Samba roles: standalone server, domain member, and awareness of domain controller functionality.
- NFS server:
/etc/exports, export options likerw,ro,sync,root_squash, andno_root_squash; apply changes withexportfs. - NFS client:
mount -t nfs,/etc/fstabentries, and inspecting withshowmount.
Know why root_squash is the default and what it protects against: remote root being mapped to an unprivileged user on the server. For Samba, remember that a share can be reachable yet unusable when Unix file permissions disagree with Samba's own access settings, so a passing testparm does not prove a share works.
exportfs, testparm, named-checkzone, and postconf from memory, with correct spelling and no spaces, until it is automatic.Network Client Management: DHCP, PAM, and LDAP
This domain covers the services that configure and authenticate clients on a network.
Network Client Management
Automated addressing and centralized authentication.
- DHCP:
dhcpd.confwithsubnet,range,option routers,option domain-name-servers, lease times, and static assignments viahostblocks; DHCP relay for remote subnets; awareness of IPv6 address assignment. - PAM: files under
/etc/pam.d/, the four module types (auth, account, password, session), control flags such as required, requisite, sufficient, and optional, and how stack order changes outcomes. - LDAP: directory structure (DN, RDN, entries, attributes, objectClasses), LDIF format, and client tools such as
ldapsearch,ldapadd,ldapmodify, andldapdelete. - Server side: OpenLDAP configuration, access control, and using LDAP as an authentication backend for system logins.
PAM questions often present a short stack and ask what happens when a module fails. Memorize the behavior: requisite fails immediately, required fails at the end of the stack, and sufficient can short-circuit success when no earlier required module has failed. For LDAP, be able to read an LDIF record and identify the DN, the objectClass, and which attribute is being changed.
E-Mail Services: Postfix, Dovecot, and Sieve
Mail is usually where under-prepared candidates lose points, because it spans several cooperating programs.
E-Mail Services
Understand the path of a message from submission to mailbox.
- Postfix:
main.cfandmaster.cf; key parameters such asmyhostname,mydomain,myorigin,mydestination,mynetworks, andrelayhost; inspect withpostconf, manage the queue withpostqueueandpostsuper. - Aliases and maps:
/etc/aliaseswithnewaliases, virtual alias and domain maps, andpostmapfor building lookup tables. - Relay control: restrictions that stop the server becoming an open relay, and SMTP authentication for submitting users.
- Dovecot: IMAP and POP3 delivery to clients, mailbox formats (Maildir versus mbox), and authentication and TLS settings.
- Filtering: Sieve scripts for server-side rules, and awareness of spam and content filtering integration.
Keep the division of labor straight: Postfix moves mail between servers and accepts it for local delivery, while Dovecot lets users read it. A question about clients that can send but not read mail points to Dovecot, while one about mail rejected as relay denied points to mynetworks or authentication restrictions in Postfix. Remember that changes to /etc/aliases are not live until newaliases rebuilds the database.
System Security: Firewalls, VPNs, and Hardening
The security domain ties the rest together: protect the services you just configured.
System Security
Packet filtering, encrypted tunnels, and reducing exposure.
- Firewalling: iptables tables and chains (filter, nat, mangle; INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING), default policies, rule order, and saving and restoring rule sets; enabling IP forwarding for routers.
- Remote access: OpenSSH server configuration in
sshd_config, key-based authentication, disabling password and root login, and port forwarding or tunneling. - VPN: OpenVPN concepts including server and client configuration, certificates, and routed versus bridged operation.
- Intrusion and monitoring: awareness of network scanning with
nmap, packet capture tools, and intrusion detection concepts. - Host hardening: auditing listening services, minimizing installed software, file integrity checks, and reviewing logs for suspicious activity.
For iptables, rule order is decisive: packets are matched top to bottom and the first match determines the outcome, so an early ACCEPT can make a later DROP irrelevant. Be ready to tell NAT from filtering: masquerading belongs in the nat table's POSTROUTING chain. For SSH, know that key-based login depends on correct permissions on ~/.ssh and authorized_keys.
Scheduling the Six Domains Across Your Prep
Sequence matters because the domains build on each other. Start with DNS, since mail and web services both depend on working name resolution, and finish with security, which reviews everything you have exposed.
DNS foundations
- Build a primary and a secondary BIND server and test zone transfers.
- Practice
digqueries, reverse zones, and TSIG.
Web Services
- Configure Apache virtual hosts with TLS and an Nginx reverse proxy.
- Write a Squid ACL set and test rule order.
File Sharing and Client Management
- Share a Samba folder and an NFS export, then mount both.
- Stand up DHCP, a PAM stack change, and a small LDAP directory.
E-Mail and System Security
- Deploy Postfix with Dovecot and a Sieve rule.
- Write an iptables policy, harden SSH, and review the whole stack.
If you want an honest read on how demanding this workload is, the difficulty guide covers where candidates struggle most. Timing your attempt is covered in the exam dates and scheduling guide.
Last-Day Review Checklist
Use this list the evening before and the morning of the exam. Each item is something a fill-in or configuration question can hinge on.
- Recite the SOA fields and what the serial number controls.
- List the checking tools:
named-checkconf,named-checkzone,testparm,postconf. - Recall the Apache directive for the document root, the listening port, and the TLS certificate and key.
- State what
root_squashdoes and where NFS exports are defined. - Explain PAM control flags and how
sufficientshort-circuits a stack. - Distinguish
mydestinationfrommynetworksin Postfix. - Trace a packet through iptables chains and note where NAT applies.
- Confirm your appointment details, ID requirements, and delivery method with Pearson VUE.
Key Takeaway
Because the paper mixes recognition and recall, spend your final hours on exact command names, file paths, and directive spellings rather than rereading prose. Then run timed sets in the practice test environment to confirm you can finish 60 questions inside 90 minutes.
Independently written practice material should be mapped to the published objectives and should never be treated as actual LPI questions or an official exam simulation. Use objective-mapped practice questions to find weak domains, then return to the lab to fix them. If you are weighing the investment, the ROI analysis and earnings guide put the effort in context.
Frequently Asked Questions
The paper contains 60 questions in multiple-choice and fill-in-the-blank formats, with a 90-minute time limit.
No. You must pass both 201-450 and 202-450, and you need an active LPIC-1 certification to receive LPIC-2.
Domain Name Server, Web Services, File Sharing, Network Client Management, E-Mail Services, and System Security. LPI weights individual objectives rather than publishing domain percentages.
Validity is 5 years. Confirm current renewal options and regional pricing with LPI and Pearson VUE, since these details can change.
This sheet does not state them because a current official value was not verified. Check LPI directly, and see the pass rate discussion for context on what data is and is not available.