Free LPIC-2 202-450 Practice Questions

Question 1

A manually maintained BIND zone has just been edited and reloaded on its primary server. Direct queries to the primary return the new address, but direct queries to its secondary still return the old address. Both replies have the authoritative-answer flag set. The secondary has completed a refresh check, and both servers report SOA serial 2026102201. Which maintenance step was missed?

Accepted Answer

Increase the SOA serial, validate the zone, and reload the primary.

Answer

Lower the record TTL, validate the zone, and reload the primary.

Answer

Flush the secondary's recursive cache to remove the old address.

Answer

Shorten the SOA refresh interval so the secondary polls the primary more often.

Question 2

An Apache 2.4 HTTPS site uses working Basic authentication. Its only authorization block is: Require ip 10.24.8.0/24 Require valid-user The policy requires BOTH a valid account and a connection from 10.24.8.0/24. At present, a client on that subnet can enter without a password. How should the authorization block be corrected?

Accepted Answer

Replace and with and .

Answer

Move Require valid-user above Require ip inside the existing container.

Answer

Place each Require directive inside a separate nested <RequireAny> container.

Answer

Remove Require ip and retain Require valid-user on the HTTPS virtual host.

Question 3

Alice authenticates to a Samba 4 share and can read its files, but creating a file returns Access denied. The relevant settings and directory permissions are:

[reports]
    path = /srv/reports
    read only = no
    valid users = @analysts

/srv/reports: drwxr-x--- root analysts

Alice belongs to analysts. The filesystem is writable, parent directories are searchable, and no ACLs or other access controls alter these permissions. Select the change that lets analysts create files without giving other users access.

Accepted Answer

Grant group write access with chmod g+w /srv/reports.

Answer

Add write list = @analysts to the share configuration.

Answer

Raise the share's create mask setting to 0660.

Answer

Reset Alice's Samba password and reconnect the client.

Question 4

A service has the following complete PAM authentication stack:

auth required   pam_listfile.so item=user sense=allow file=/etc/access-users onerr=fail
auth sufficient pam_sss.so
auth required   pam_unix.so

For one login attempt, pam_listfile fails, pam_sss succeeds, and pam_unix succeeds. What authentication result does PAM return to the service?

Accepted Answer

Failure after pam_unix has been processed.

Answer

Success immediately after pam_sss succeeds.

Answer

Failure immediately when pam_listfile fails.

Answer

Success after the final pam_unix check succeeds.

Question 5

A Linux router translates incoming TCP connections on 203.0.113.10:443 to a web server at 10.20.0.10:443. IPv4 forwarding and the route to the server are correct. During a connection test, counters show:

DNAT rule in PREROUTING: 12 packets
TCP/443 ACCEPT rule in INPUT: 0 packets
FORWARD policy DROP: 12 packets

FORWARD already accepts ESTABLISHED,RELATED traffic; it has no other rules. Which additional rule permits the incoming connections to reach the web server?

Accepted Answer

iptables -A FORWARD -p tcp -d 10.20.0.10 --dport 443 -j ACCEPT

Answer

iptables -A INPUT -p tcp -d 10.20.0.10 --dport 443 -j ACCEPT

Answer

iptables -A FORWARD -p tcp -d 203.0.113.10 --dport 443 -j ACCEPT

Answer

iptables -A OUTPUT -p tcp -d 10.20.0.10 --dport 443 -j ACCEPT

Question 6

For the past five minutes, Postfix has logged this response while delivering to one partner domain:

status=deferred (host mx.partner.example said: 451 4.3.0 Temporary server error, in reply to RCPT TO command)

Mail to other domains is being delivered, and the local queue filesystem has ample free space. What is the appropriate initial response to these deferred messages?

Accepted Answer

Keep them queued and monitor Postfix's scheduled delivery retries.

Answer

Delete them from the queue and ask their senders to submit new copies.

Answer

Stop Postfix until the partner server resumes accepting deliveries.

Answer

Run postqueue -f every few seconds until the remote error disappears.

Question 7

After a certificate renewal on Apache 2.4, some clients connect successfully while fresh clients report unable to get local issuer certificate. A test using the correct SNI hostname shows that the server sends only its leaf certificate. That certificate is within its validity period, matches the hostname, and was issued by an intermediate CA. The affected clients already trust the root CA. Which fault best explains the difference between clients?

Accepted Answer

Apache is omitting the issuing intermediate from the certificate chain.

Answer

Apache is selecting a certificate whose subject names exclude this hostname.

Answer

The affected clients lack the trusted root CA needed to validate the certificate.

Answer

The affected clients and Apache cannot agree on any enabled TLS cipher suite.

Question 8

An ISC DHCPv4 server has one dynamic pool on 192.0.2.0/24:

range 192.0.2.80 192.0.2.159;

The pool has 62 active leases; every other address in it is available. Twelve separate fixed-address reservations use 192.0.2.20 through 192.0.2.31. Another 24 clients without reservations must join before any lease expires. Addresses 192.0.2.160 through 192.0.2.199 are verified unused. Keeping the lower endpoint unchanged, which upper endpoint provides exactly enough dynamic addresses for all existing and new clients?

Accepted Answer

192.0.2.165

Answer

192.0.2.159

Answer

192.0.2.166

Answer

192.0.2.177

Question 9

A Squid proxy must serve the corporate network except for the contractor subnet. Its complete http_access rules are:

acl corporate src 10.18.0.0/16
acl contractors src 10.18.42.0/24

http_access allow corporate
http_access deny contractors
http_access deny all

Contractors can still browse through the proxy. What correction blocks them while preserving access for every other client in 10.18.0.0/16?

Accepted Answer

Move http_access deny contractors above http_access allow corporate.

Answer

Move the contractors acl declaration above the corporate acl declaration.

Answer

Change the corporate acl network from 10.18.0.0/16 to 10.18.0.0/24.

Answer

Move http_access deny all above both of the subnet-specific access rules.

Question 10

A Linux file server is being configured as a Samba 4 member of an existing Active Directory domain, not as a domain controller. Domain user and group identities must map to Unix UIDs and GIDs for filesystem permission checks. Which Samba daemon provides that identity-mapping role?

Accepted Answer

winbindd

Answer

smbd

Answer

nmbd

Answer

samba

Free LPIC-2 202-450 Practice Questions

Domain 1: Domain Name Server

Question 1

Domain 2: Web Services

Question 2

Question 3

Question 4

Domain 3: File Sharing

Question 5

Question 6

Domain 4: Network Client Management

Question 7

Question 8

Domain 5: E-Mail Services

Question 9

Domain 6: System Security

Question 10

That's 10 of 1,030