30 free LPI LPIC-2 202-450 practice questions from the CertStash pack of 120, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 30 free here, all 120 in the pack, and each step includes the one before it.
Get all 120 questions (US$39) · Download the first 10 as a PDF
Question 1
On a Linux router, packet forwarding for IPv4 has been enabled. After a reboot, the machine no longer forwards IP packets from other hosts. The command: echo 1 > /proc/sys/net/ipv4/ip_forward temporarily resolves this issue. Which one of the following options is the best way to ensure this setting is saved across system restarts?
Show answer and explanation
Correct answer: C. In /etc/sysct1.conf change net.ipv4.ip_forward to 1
The /etc/sysctl.conf file is the standard configuration file for persistent sysctl settings on Linux systems. Setting net.ipv4.ip_forward = 1 in this file ensures the kernel parameter is applied at boot time through the sysctl service. This is the proper, persistent method endorsed by Linux distributions for maintaining kernel parameters across reboots.
Why the other options are wrong
- A. Login scripts only execute when a user logs in, not at system boot, and root may not always log in.
- B. Relying on user login scripts is unreliable and won't execute if no user logs in after boot.
- D. The /etc/rc.local syntax is incorrect; it should use sysctl format (net.ipv4.ip_forward = 1) but sysctl.conf is the proper location.
- E. The iptables-config file is for iptables-specific settings, not general kernel parameters, and the syntax is wrong.
Question 2
What information can be found in the file specified by the status parameter in an OpenVPN server configuration file? (Choose two.)
Show answer and explanation
Correct answer: C, D. Statistical information regarding the currently running openvpn daemon; A list of currently connected clients
The OpenVPN status file (specified by the 'status' parameter) contains real-time statistical information about the running OpenVPN daemon, including current connection statistics and performance metrics (option C), and a list of clients currently connected to the server with their connection details (option D). These are the standard contents of the OpenVPN status log.
Why the other options are wrong
- A. Errors and warnings are logged to the main OpenVPN log file, not the status file.
- B. Routing information is not included in the status file; it's maintained by the kernel's routing table.
- E. Historical data about all past connections is not stored in the status file; only current connections are listed.
Question 3
Which of the following lines in the sshd configuration file should, if present, be changed in order to increase the security of the server? (Choose two.)
Show answer and explanation
Correct answer: A, D. Protocol 2, 1; PermitRootLogin yes
Option A (Protocol 2, 1) should be changed because it enables the insecure SSH protocol version 1; only Protocol 2 should be allowed. Option D (PermitRootLogin yes) should be changed because directly permitting root login via SSH is a significant security risk; it should be set to 'no' to prevent brute-force attacks and direct root compromise. Both represent common security hardening requirements.
Why the other options are wrong
- B. PermitEmptyPasswords no is already the secure setting and requires no change.
- C. While port 22 is the default, changing it is obscurity rather than security and is not required for baseline hardening.
- E. IgnoreRhosts yes is already the secure default setting that should be present.
Question 4
Which of the following nmap parameters scans a target for open TCP ports? (Choose two.)
Show answer and explanation
Correct answer: C, E. -sT; -sS
Option C (-sT) performs a TCP connect scan, which completes full TCP connections to open ports. Option E (-sS) performs a SYN scan (half-open scan), which is the most common and stealthy TCP scanning method. Both are legitimate TCP port scanning techniques used to identify open TCP ports on a target.
Why the other options are wrong
- A. -sO is IP protocol scan, not TCP port scanning.
- B. -sZ is SCTP COOKIE ECHO scan, not TCP scanning.
- D. -sU performs UDP scanning, not TCP port scanning.
Question 5
Which of the statements below are correct regarding the following commands, which are executed on a Linux router? (Choose two.)
Show answer and explanation
Correct answer: A, D. Packets with source or destination addresses from fe80::/64 will never occur in the FORWARD chain; Both ip6tables commands complete without an error message or warning
The fe80::/64 range contains IPv6 link-local addresses, which are used for communication on a single link and are never routed across networks. Option A is correct because routers must not forward packets with link-local source or destination addresses, so these packets do not reach the FORWARD chain. Option D is correct because both commands are syntactically valid: the first uses -s to match packets from fe80::/64 and the second uses -d to match packets to fe80::/64, and both execute without error.
Why the other options are wrong
- B. The rules only drop FORWARD chain packets whose source or destination is in fe80::/64. All other traffic is still forwarded, so forwarding is not disabled.
- C. ip6tables accepts several rules that match the same network, so the second command returns no error.
- E. Router advertisements and on-link DHCPv6 messages use link-local addresses on the local link and are not forwarded, so rules in the FORWARD chain do not suppress them.
Question 6
What option in the client configuration file would tell OpenVPN to use a dynamic source port when making a connection to a peer?
Show answer and explanation
Correct answer: D. nobind
The 'nobind' option in OpenVPN client configuration tells the client to not bind to a fixed local port, allowing it to use dynamic source ports when making connections to peers. This is the correct option for enabling dynamic source port allocation in OpenVPN clients.
Why the other options are wrong
- A. src-port is not a valid OpenVPN configuration option.
- B. remote specifies the peer address and port, not the local source port behavior.
- C. source-port is not a valid OpenVPN configuration option.
- E. dynamic-bind is not a valid OpenVPN configuration option.
Question 7
Which Linux user is used by vsftpd to perform file system operations for anonymous FTP users?
Show answer and explanation
Correct answer: E. The Linux user specified in the configuration option ftp_username
The vsftpd daemon uses the Linux user specified in the ftp_username configuration option (typically 'ftp') to perform file system operations on behalf of anonymous FTP users. This configuration option explicitly defines which user account vsftpd impersonates when handling anonymous connections, allowing administrators to control file permissions and access.
Why the other options are wrong
- A. The vsftpd process typically runs as root or a dedicated service user, not the user for anonymous operations.
- B. The FTP root directory owner is not necessarily the user used for anonymous operations.
- C. Anonymous users don't have Linux usernames; they're mapped to a single configured user.
- D. vsftpd does not rely on root access with special file permissions for anonymous users; it uses a dedicated ftp user account.
Question 8
Which of the following sshd configuration should be set to no in order to fully disable password based logins? (Choose two.)
Show answer and explanation
Correct answer: B, E. ChallengegeResponseAuthentication; PasswordAuthentication
Option B (ChallengeResponseAuthentication) and Option E (PasswordAuthentication) must both be set to 'no' to fully disable password-based logins. ChallengeResponseAuthentication handles keyboard-interactive methods including password prompts, while PasswordAuthentication handles direct password authentication. Disabling both prevents all password-based login methods.
Why the other options are wrong
- A. PAMAuthentication is not a standard sshd configuration option (the correct option is UsePAM).
- C. PermitPlaintextLogin is not a valid sshd configuration option.
- D. UsePasswords is not a valid sshd configuration option.
Question 9
When the default policy for the netfilter INPUT chain is set to DROP, why should a rule allowing traffic to localhost exist?
Show answer and explanation
Correct answer: C. Some applications use the localhost interface to communicate with other applications
When the INPUT chain policy is DROP, a rule allowing localhost traffic is necessary because many applications use the localhost interface (127.0.0.1 and ::1) to communicate with other local applications or services. Without allowing loopback traffic, essential inter-process communication breaks, causing applications and system services to malfunction. This is a fundamental networking principle that applies regardless of netfilter's specific implementation.
Why the other options are wrong
- A. While true, this is too vague and doesn't explain the specific technical reason why it's necessary.
- B. Netfilter absolutely affects localhost traffic; packets addressed to localhost travel through the network stack and are subject to iptables rules.
- D. While syslogd may use localhost, this is too specific; the general principle applies to many applications.
- E. iptables is a userspace utility; netfilter is the kernel subsystem. The management daemon netfilterd doesn't exist; iptables communicates directly with the kernel.
Question 10
The content of which local file has to be transmitted to a remote SSH server in order to be able to log into the remote server using SSH keys?
Show answer and explanation
Correct answer: C. ~/.ssh/id_rsa.pub
To enable SSH key-based login to a remote server, the public key (id_rsa.pub) from the local client must be transmitted and added to the remote server's ~/.ssh/authorized_keys file. The public key is the only component that should be shared with remote systems; it is used by the server to verify that the client possesses the corresponding private key.
Why the other options are wrong
- A. authorized_keys is the destination file on the remote server where the public key is placed, not the file to be transmitted from the local client.
- B. config is a local SSH client configuration file that specifies connection preferences and has no role in key authentication.
- D. id_rsa is the private key and must never be transmitted or shared with any remote system.
- E. known_hosts stores fingerprints of remote servers the client has connected to, unrelated to authentication key setup.
What people say about the full LPIC-2 pack 4.9 from 9
sharing is caring…I wanna say that the practice questions and answers for 202-450 exam are what you need to ace the exam from the first attempt……they helped me pass my exam today!! all the best everyone!
Passed the 202-450! Real questions in this dump. For the price this is excellent prep material.
Cleared my LPIC 202 exam. Went through this twice. Questions are close to the real exam. Passed comfortably. Highly recommend.
Question 11
In a BIND zone file, what does the @ character indicate?
Show answer and explanation
Correct answer: C. It's the name of the zone as defined in the zone statement in named.conf
In a BIND zone file, the @ character is a special symbol that represents the name of the zone as it is defined in the zone statement in the named.conf configuration file. It serves as a shorthand to refer to the zone apex without having to type the full zone name repeatedly.
Why the other options are wrong
- A. @ does not represent the fully qualified hostname of the DNS server
- B. @ is not an alias for the zone master's email address; that is specified separately in SOA records
- D. @ is not used to create aliases between CNAME entries; it simply represents the zone name
Question 12
Which of the following Samba services handles the membership of a file server in an Active Directory domain?
Show answer and explanation
Correct answer: A. winbindd
The winbindd service handles the membership of a file server in an Active Directory domain. It manages user and group information from Active Directory, performs domain authentication, and provides name service switching integration for AD users and groups.
Why the other options are wrong
- B. nmbd handles NetBIOS name registration and browsing, not Active Directory domain membership.
- C. msadd is not a recognized Samba service.
- D. admemb is not a recognized Samba service.
- E. samba (the main daemon) handles file sharing and printing, not specifically AD domain membership management.
Question 13
After the installation of Dovecot, it is observed that the dovecot processes are shown in ps ax like this: In order to associate the processes with users and peers, the username, IP address of the peer and the connection status, which of the following options must be set?
Show answer and explanation
Correct answer: D. verbose_proctitle = yes in the Dovecot configuration
The verbose_proctitle configuration option in Dovecot controls whether detailed information is displayed in the process title (what appears in ps output). When enabled with 'verbose_proctitle = yes', Dovecot will display additional details such as username, IP address of the peer, and connection status in the process listing, making it possible to associate processes with users and their connection information. This is exactly what the question asks for, associating processes with username, peer IP address, and connection status.
Why the other options are wrong
- A. The --with-linux-extprocnames option does not exist as a standard Dovecot configure option and does not control process title verbosity.
- B. sys.ps.allow_descriptions is not a valid sysctl parameter and does not relate to Dovecot process title configuration.
- C. proc.all.show_status is not a valid sysctl parameter and does not control how Dovecot displays process information.
- E. process_format is not a valid Dovecot configuration directive; the correct option is verbose_proctitle, not a format string definition.
Question 14
Which of the following PAM modules allows the system administrator to use an arbitrary file containing a list of user and group names with restrictions on the system resources available to them?
Show answer and explanation
Correct answer: B. pam_limits
pam_limits applies resource limits to users and groups. It reads the limits from a configuration file (/etc/security/limits.conf by default, or another file named with the conf= option). pam_listfile only allows or denies access based on the entries of a file; it does not set resource limits.
Why the other options are wrong
- A. pam_filter filters the input and output of applications; it does not set resource limits.
- C. pam_listfile allows or denies access to a service based on a list of users or groups in a file; it does not apply resource limits.
- D. pam_unix is the standard password authentication module and does not set resource limits.
Question 15
Which BIND option should be used to limit the IP addresses from which slave name servers may connect?
Show answer and explanation
Correct answer: B. allow-transfer
The 'allow-transfer' option in BIND is used to limit which IP addresses are permitted to initiate zone transfers from the master nameserver. This controls which slave (secondary) nameservers can pull zone data from the primary server.
Why the other options are wrong
- A. allow-zone-transfer is not the correct BIND option name
- C. allow-secondary is not a standard BIND option for restricting zone transfers
- D. allow-slaves is not a standard BIND option for zone transfer control
- E. allow-queries restricts which addresses can perform DNS queries, not zone transfers
Question 16
Which of the following statements is true regarding the NFSv4 pseudo file system on the NFS server?
Show answer and explanation
Correct answer: B. It usually contains bind mounts of the directory trees to be exported
The NFSv4 pseudo file system is a virtual namespace on the NFS server that usually contains bind mounts of the directory trees to be exported. These bind mounts present the actual exported directories within a unified namespace that NFSv4 clients see as a single coherent file system hierarchy.
Why the other options are wrong
- A. The pseudo file system is not required to be named /exports; the name is configurable.
- C. The pseudo file system does not need to be a dedicated partition; it is typically a directory within the existing file system.
- D. The NFSv4 root is not defined in /etc/pathmapd.conf; it is configured in /etc/exports or /etc/nfs.conf.
- E. The pseudo file system uses bind mounts rather than symlinks to present the exported directory trees.
Question 17
Which of the following DNS records could be a glue record?
Show answer and explanation
Correct answer: A. ns1.lab A 198.51.100.53
A glue record is an A record that provides the IP address of a nameserver, typically needed when the nameserver's hostname is within the zone being delegated. Option A (ns1.lab A 198.51.100.53) is an A record that maps a nameserver hostname to its IP address, which is the definition of a glue record.
Why the other options are wrong
- B. An NS record cannot be used as a glue record; glue records must be A or AAAA records
- C. An NS record with an IP address is invalid syntax; NS records contain hostnames, not addresses
- D. The notation 'ns1.' (with trailing dot but no domain) is incomplete and invalid
- E. GLUE is not a valid DNS record type; glue records are A or AAAA records by definition
Question 18
Which Postfix command can be used to rebuild all of the alias database files with a single invocation and without the need for any command line arguments?
Show answer and explanation
Correct answer: B. newaliases
The 'newaliases' command rebuilds all alias database files with a single invocation and requires no command-line arguments. It automatically processes the aliases file specified in Postfix configuration and generates the corresponding database files needed for mail routing.
Why the other options are wrong
- A. makealiases is not a standard Postfix command; the correct command is newaliases.
- C. postalias is a more general tool for managing Postfix alias maps but typically requires file arguments to specify which aliases to process.
- D. postmapbuild is not a valid Postfix command for rebuilding alias databases.
Question 19
Which of the following options are valid in /etc/exports? (Choose two.)
Show answer and explanation
Correct answer: A, B. rw; ro
The /etc/exports file uses specific options to control NFS sharing. Both 'rw' (read-write) and 'ro' (read-only) are valid options that specify access permissions for exported filesystems. These are fundamental NFS export options that appear in the exports syntax.
Why the other options are wrong
- C. The correct syntax is 'root_squash' (with underscore), not 'rootsquash'
- D. The correct syntax is 'no_root_squash' (with underscores), not 'norootsquash'
- E. The 'uid' option is not a valid /etc/exports option; NFS uses anonuid for specifying anonymous user mapping
Question 20
How is the LDAP administrator account configured when the rootdn and rootpw directives are not present in the slapd.conf file?
Show answer and explanation
Correct answer: B. The account is defined by an ACL in slapd.conf
When rootdn and rootpw directives are absent from slapd.conf, the LDAP administrator account is defined through Access Control Lists (ACLs) in the slapd.conf file. ACLs specify which users have administrative privileges and under what conditions, providing a flexible alternative to hardcoded root credentials.
Why the other options are wrong
- A. There is no default 'admin' account with password 'admin' in LDAP when rootdn/rootpw are not specified.
- C. Without rootdn and rootpw directives, no default account exists without a password.
- D. The /etc/ldap.secret file is not used to define the LDAP administrator account.
- E. There is no standard /etc/ldap.root.conf file for defining LDAP administrator accounts.
Question 21
Which of the following statements in the ISC DHCPD configuration is used to specify whether or not an address pool can be used by nodes which have a corresponding host section in the configuration?
Show answer and explanation
Correct answer: E. unknown-clients
The 'unknown-clients' statement in ISC DHCPD configuration specifies whether or not an address pool can be used by clients that do not have a corresponding host section in the configuration file. This allows administrators to control whether dynamically discovered clients can use certain pools.
Why the other options are wrong
- A. identified-nodes is not a standard ISC DHCPD configuration statement for pool allocation.
- B. unconfigured-hosts is not a standard ISC DHCPD configuration statement for controlling pool usage.
- C. missing-peers is not a standard ISC DHCPD configuration statement for pool allocation rules.
- D. unmatched-hwaddr is not a standard ISC DHCPD configuration statement for pool allocation or host matching.
Question 22
What is the name of the network security scanner project which, at the core, is a server with a set of network vulnerability tests?
Show answer and explanation
Correct answer: B. OpenVAS
OpenVAS (Open Vulnerability Assessment System) is a network security scanner project built around a server with a collection of network vulnerability tests. It performs comprehensive vulnerability scanning and assessment on network hosts and services.
Why the other options are wrong
- A. NetMap is not a recognized network vulnerability scanning framework or project.
- C. Smartscan is not a standard or widely recognized network vulnerability assessment tool.
- D. Wireshark is a packet analyzer and network protocol analyzer, not a vulnerability scanner with tests.
Question 23
In order to protect a directory on an Apache HTTPD web server with a password, this configuration was added to an .htaccess file in the respective directory: Furthermore, a file /var/www/dir/ .htpasswd was created with the following content: usera:S3cr3t Given that all these files were correctly processed by the web server processes, which of the following statements is true about requests to the directory?
Show answer and explanation
Correct answer: D. The browser prompts the visitor for a username and password but logins for usera do not seem to work
The .htaccess configuration correctly specifies Basic authentication with AuthUserFile pointing to .htpasswd. However, the .htpasswd file contains 'usera:S3cr3t' which is a plain text password, not a properly hashed password (htpasswd typically creates MD5, bcrypt, or other hashed formats). When a user attempts to log in as usera with password 's3cr3t', Apache will prompt for credentials but the authentication will fail because Apache compares the submitted password against the stored hash. Since 'S3cr3t' is stored as plaintext rather than a proper hash, the login attempt for usera will not succeed, even though the authentication mechanism itself is functioning and prompting for credentials.
Why the other options are wrong
- A. usera cannot access the site because the password in .htpasswd is not properly hashed; plain text storage causes authentication to fail
- B. HTTP 442 is not a standard error code; Apache would return 401 Unauthorized for failed authentication, not 442
- C. There is no server configuration error here; the files are correctly processed and the syntax is valid, so no 500 error would occur
- E. The Require valid-user directive enforces authentication, so the directory is protected and will not be delivered without credentials
Question 24
What option for BIND is required in the global options to disable recursive queries on the DNS server by default?
Show answer and explanation
Correct answer: E. recursion no;
The correct BIND option to disable recursive queries is 'recursion no;' in the global options section. This is the standard syntax used in named.conf to prevent the DNS server from performing recursive lookups on behalf of clients.
Why the other options are wrong
- A. The syntax 'allow-recursive-query ( none; )' is not valid BIND configuration syntax
- B. The syntax 'allow-recursive-query off' is not the correct BIND option name or format
- C. The syntax 'recursion { disabled; }' uses invalid syntax; recursion uses a boolean value
- D. The syntax 'recursion { none; }' uses invalid syntax with braces instead of a boolean value
Question 25
How are PAM modules organized and stored?
Show answer and explanation
Correct answer: D. As shared object files within the /lib/ directory hierarchy
PAM modules are stored as shared object files (dynamic libraries with .so extensions) within the /lib/ directory hierarchy, typically in /lib/security/ or /lib64/security/. These are loaded dynamically at runtime by the PAM framework when needed for authentication operations.
Why the other options are wrong
- A. PAM configuration files are plain text in /etc/security/ and /etc/pam.d/, but the modules themselves are compiled binaries, not text files.
- B. PAM modules are not statically linked binaries stored in /etc/pam.d/bin/; PAM configuration files are in /etc/pam.d/ but modules are elsewhere.
- C. PAM modules are not Linux kernel modules; they are userspace libraries, not stored in /lib/modules/.
- E. PAM modules are not dynamically linked binaries in /usr/lib/pam/sbin/; they are shared object files in /lib/ hierarchy directories.
Question 26
Which Apache HTTPD directive enables HTTPS protocol support?
Show answer and explanation
Correct answer: B. SSLEngine on
SSLEngine on is the correct Apache HTTPD directive that enables SSL/TLS (HTTPS) protocol support. This directive must be present in the Apache configuration, typically within a VirtualHost or Directory context, to activate SSL/TLS functionality for secure connections.
Why the other options are wrong
- A. HTTPSEngine is not a valid Apache directive; the correct module is mod_ssl which uses SSLEngine.
- C. SSLEnable is not a valid Apache directive syntax.
- D. HTTPSEnable is not a valid Apache directive.
- E. StartTLS is used in LDAP and SMTP contexts, not Apache HTTPD configuration.
Question 27
Which command is used to configure which file systems a NFS server makes available to clients?
Show answer and explanation
Correct answer: A. exportfs
The 'exportfs' command is used to configure and manage which filesystems an NFS server makes available to clients. It reads the /etc/exports file and maintains the kernel's export table, allowing administrators to add, remove, or modify NFS exports without restarting the service.
Why the other options are wrong
- B. mkfs.nfs creates filesystems and is unrelated to NFS export configuration
- C. mount is used to mount filesystems locally, not to configure NFS server exports
- D. nfsservctl (or similar) is not a standard command for configuring NFS exports
- E. telinit is used to change runlevels and is unrelated to NFS configuration
Question 28
Which statements about the Alias and Redirect directives in Apache HTTPD's configuration file are true? (Choose two.)
Show answer and explanation
Correct answer: B, D. Redirect works with regular expressions; Alias is handled on the server side
Redirect does work with regular expressions when using RedirectMatch directive, allowing pattern-based URL matching. Alias is handled on the server side as it performs internal URL-to-filesystem mapping without sending anything to the client. Both directives are server-side operations that transform requests before processing.
Why the other options are wrong
- A. Alias can reference files and directories anywhere on the filesystem, not just under DocumentRoot.
- C. Redirect is handled on the server side; while it sends an HTTP redirect response to the client, the decision and initiation are server-side operations.
- E. Alias is a valid and commonly used Apache configuration directive for mapping URLs to filesystem locations.
Question 29
With fail2ban, what is a "˜jail'?
Show answer and explanation
Correct answer: C. A filter definition and a set of one or more actions to take when the filter is matched
In fail2ban, a 'jail' is a combination of a filter definition (which identifies attack patterns in log files) and one or more actions (such as banning or alerting) that are executed when the filter conditions are matched. Jails are the fundamental operational units in fail2ban.
Why the other options are wrong
- A. While jails may result in netfilter rules being applied, a jail itself is not defined as a netfilter chain.
- B. A jail is specific to a service or log file pattern, not a group of similar services, though multiple jails can be configured.
- D. Fail2ban does not run in a chroot environment; jails are not related to chroot isolation.
Question 30
Which global option in squid.conf sets the port number or numbers that Squid will use to listen for client requests?
Show answer and explanation
Correct answer: C. http_port
The http_port directive in squid.conf specifies the port number or numbers that Squid listens on for incoming client requests. This is the standard global option used to configure Squid's listening ports, with a default value of 3128.
Why the other options are wrong
- A. The 'port' directive is not used in Squid configuration for this purpose.
- B. client_port is not a valid Squid configuration directive.
- D. server_port refers to upstream server connections, not client-facing listening ports.
- E. squid_port is not a valid Squid configuration directive.
That was 30 of 120.
The full LPI LPIC-2 202-450 pack has all 120 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 60 free as one PDF by email. Get the Half Pack →