50 Free LPIC-2 202-450 Practice Questions and Answers

Play from 05:04 Question 4. Which Samba service provides file and print sharing to Windows clients? Here are the options. Option A. nmbd. Option B. smbd. Option C. winbindd. Option D. vsftpd. Pause the video now if you want time to think about the answer.

The correct answer is B. smbd. smbd provides SMB/CIFS file and print services. Now, why are the other options incorrect? Option A is incorrect. nmbd handles NetBIOS name service. Option C is incorrect. winbindd integrates with AD. Option D is incorrect. vsftpd is an FTP server. Therefore, B, smbd, is the correct answer.

Play from 06:06 Question 5. What is the name of the network security scanner project which, at the core, is a server with a set of network vulnerability tests? Here are the options. Option A. NetMap. Option B. OpenVAS. Option C. Smartscan. Option D. Wireshark. Pause the video now if you want time to think about the answer.

The correct answer is B. OpenVAS. OpenVAS (Open Vulnerability Assessment System) is a network security scanner project built around a server with a collection of network vulnerability tests. It performs comprehensive vulnerability scanning and assessment on network hosts and services. Now, why are the other options incorrect? Option A is incorrect. NetMap is not a recognized network vulnerability scanning framework or project. Option C is incorrect. Smartscan is not a standard or widely recognized network vulnerability assessment tool. Option D is incorrect. Wireshark is a packet analyzer and network protocol analyzer, not a vulnerability scanner with tests. Therefore, B, OpenVAS, is the correct answer.

Play from 07:33 Question 6. Which keyword is used in the Squid configuration to define networks and times used to limit access to the service? Here are the options. Option A. acl. Option B. allow. Option C. http_allow. Option D. permit. Pause the video now if you want time to think about the answer.

The correct answer is A. acl. The 'acl' keyword in Squid configuration is used to define Access Control Lists that specify networks, times, protocols, and other criteria. These ACLs are then referenced in http_access rules to limit and control access to the service. ACLs are the foundational mechanism for defining what traffic is permitted or denied. Now, why are the other options incorrect? Option B is incorrect. allow is not a Squid configuration keyword; access control uses http_access with acl definitions. Option C is incorrect. http_allow is not a valid Squid directive; http_access rules use acl definitions to control access. Option D is incorrect. permit is not a Squid configuration keyword for defining access rules or networks. Therefore, A, acl, is the correct answer.

Play from 09:07 Question 7. Which option within the ISC DHCPD configuration file defines the IPv4 DNS server address(es) to be sent to the DHCP clients? Here are the options. Option A. domain-name-servers. Option B. domain-server. Option C. name-server. Option D. servers. Pause the video now if you want time to think about the answer.

The correct answer is A. domain-name-servers. The correct option in ISC DHCPD configuration file is 'domain-name-servers' which specifies the IPv4 DNS server address(es) to be sent to DHCP clients. This is the standard DHCP option 6 directive that clients receive to configure their DNS resolution. Now, why are the other options incorrect? Option B is incorrect. domain-server is not a valid ISC DHCPD configuration directive. Option C is incorrect. name-server is used in other contexts (like BIND zone files) but not in DHCPD configuration. Option D is incorrect. servers is not a valid ISC DHCPD configuration option. Therefore, A, domain-name-servers, is the correct answer.

Play from 10:40 Question 8. When the default policy for the netfilter INPUT chain is set to DROP, why should a rule allowing traffic to localhost exist? Here are the options. Option A. All traffic to localhost must always be allowed. Option B. It doesn't matter; netfilter never affects packets addressed to localhost. Option C. Some applications use the localhost interface to communicate with other applications. Option D. syslogd receives messages on localhost. Option E. The iptables command communicates with the netfilter management daemon netfilterd on localhost to create and change packet filter rules. Pause the video now if you want time to think about the answer.

The correct answer is C. Some applications use the localhost interface to communicate with other applications. When the INPUT chain policy is DROP, a rule allowing localhost traffic is necessary because many applications use the localhost interface (127.0.0.1 and ::1) to communicate with other local applications or services. Without allowing loopback traffic, essential inter- process communication breaks, causing applications and system services to malfunction. This is a fundamental networking principle that applies regardless of netfilter's specific implementation. Now, why are the other options incorrect? Option A is incorrect. While true, this is too vague and doesn't explain the specific technical reason why it's necessary. Option B is incorrect. Netfilter absolutely affects localhost traffic; packets addressed to localhost travel through the network stack and are subject to iptables rules. Option D is incorrect. While syslogd may use localhost, this is too specific; the general principle applies to many applications. Option E is incorrect. iptables is a userspace utility; netfilter is the kernel subsystem. The management daemon netfilterd doesn't exist; iptables communicates directly with the kernel. Therefore, C, Some applications use the localhost interface to communicate with other applications, is the correct answer.

Play from 13:10 Question 9. Which netfilter table contains built-in chains called INPUT, OUTPUT and FORWARD? Here are the options. Option A. ipconn. Option B. filter. Option C. nat. Option D. default. Option E. masq. Pause the video now if you want time to think about the answer.

The correct answer is B. filter. The filter table is the default netfilter table containing the built-in chains INPUT, OUTPUT, and FORWARD. These chains are used to filter network packets based on firewall rules. The filter table is the most commonly used table for implementing firewall policies on Linux systems. Now, why are the other options incorrect? Option A is incorrect. ipconn is not a standard netfilter table. Option C is incorrect. The nat table handles Network Address Translation and contains PREROUTING, OUTPUT, and POSTROUTING chains, not INPUT/OUTPUT/FORWARD. Option D is incorrect. default is not a netfilter table name. Option E is incorrect. masq is not a standard netfilter table; masquerading is configured through nat table rules. Therefore, B, filter, is the correct answer.

Play from 14:46 Question 10. Which Apache HTTPD configuration directive specifies the RSA private key that was used in the generation of the SSL certificate for the server? Here are the options. Option A. SSLCertificateKeyFile. Option B. SSLKeyFile. Option C. SSLPrivateKeyFile. Option D. SSLRSAKeyFile. Pause the video now if you want time to think about the answer.

The correct answer is A. SSLCertificateKeyFile. SSLCertificateKeyFile is the correct Apache HTTPD directive that specifies the path to the RSA private key file used to generate the SSL certificate. This directive is part of mod_ssl and is essential for HTTPS server configuration. Now, why are the other options incorrect? Option B is incorrect. SSLKeyFile is not a valid Apache HTTPD directive for specifying the private key. Option C is incorrect. SSLPrivateKeyFile is not the correct Apache HTTPD directive name. Option D is incorrect. SSLRSAKeyFile is not a valid Apache HTTPD configuration directive. Therefore, A, SSLCertificateKeyFile, is the correct answer.

Play from 16:27 Question 11. A company is transitioning to a new DNS domain name and wants to accept e-mail for both domains for all of its users on a Postfix server. Which configuration option should be updated to accomplish this? Here are the options. Option A. mydomain. Option B. mylocations. Option C. mydestination. Option D. myhosts. Option E. mydomains. Pause the video now if you want time to think about the answer.

The correct answer is C. mydestination. The 'mydestination' configuration option in Postfix specifies which domains the server will accept mail for. By updating this parameter to include both the old and new domain names, the server will accept email addressed to users in either domain, enabling a smooth transition period. Now, why are the other options incorrect? Option A is incorrect. mydomain specifies the local machine's domain name, not the list of domains to accept mail for. Option B is incorrect. mylocations is not a standard Postfix configuration parameter. Option D is incorrect. myhosts is not a standard Postfix configuration parameter for specifying mail-receiving domains. Option E is incorrect. mydomains is not the correct Postfix parameter; the plural form 'mydestination' is used instead. Therefore, C, mydestination, is the correct answer.

Play from 18:13 Question 12. Select the alternative that shows the correct way to disable a user login for all users except root. Here are the options. Option A. The use of the pam_block module along with the /etc/login configuration file. Option B. The use of the pam_deny module along with the /etc/deny configuration file. Option C. The use of the pam_pwdb module along with the /etc/pwdv.conf configuration file. Option D. The use of the pam_nologin module along with the /etc/nologin configuration file. Pause the video now if you want time to think about the answer.

The correct answer is D. The use of the pam_nologin module along with the /etc/nologin configuration file. The pam_nologin module checks for the /etc/nologin file and denies login to all users except root when that file exists. This is the standard PAM mechanism for system-wide login restrictions while preserving root access. Now, why are the other options incorrect? Option A is incorrect. pam_block and /etc/login are not standard PAM components for this purpose. Option B is incorrect. pam_deny denies access but does not have a standard /etc/deny configuration file mechanism. Option C is incorrect. pam_pwdb and /etc/pwdv.conf are not the correct PAM module and configuration for login restriction. Therefore, D, The use of the pam_nologin module along with the /etc/nologin configuration file, is the correct answer.

Play from 20:12 Question 13. Which option in named.conf specifies which host are permitted to ask for domain name information from the server? Here are the options. Option A. allowed-hosts. Option B. accept-query. Option C. permit-query. Option D. allow-query. Option E. query-group. Pause the video now if you want time to think about the answer.

The correct answer is D. allow-query. The allow-query option in named.conf specifies which hosts or IP addresses are permitted to send DNS queries to the server. This is the standard directive for controlling query access in BIND configuration. Now, why are the other options incorrect? Option A is incorrect. allowed-hosts is not the correct named.conf option name. Option B is incorrect. accept-query is not a valid BIND configuration directive. Option C is incorrect. permit-query is not the standard BIND configuration option. Option E is incorrect. query-group is not a BIND option for controlling query access. Therefore, D, allow-query, is the correct answer.

Play from 21:35 Question 14. Which of the following statements in the ISC DHCPD configuration is used to specify whether or not an address pool can be used by nodes which have a corresponding host section in the configuration? Here are the options. Option A. identified-nodes. Option B. unconfigured-hosts. Option C. missing-peers. Option D. unmatched-hwaddr. Option E. unknown-clients. Pause the video now if you want time to think about the answer.

The correct answer is E. unknown-clients. The 'unknown-clients' statement in ISC DHCPD configuration specifies whether or not an address pool can be used by clients that do not have a corresponding host section in the configuration file. This allows administrators to control whether dynamically discovered clients can use certain pools. Now, why are the other options incorrect? Option A is incorrect. identified-nodes is not a standard ISC DHCPD configuration statement for pool allocation. Option B is incorrect. unconfigured-hosts is not a standard ISC DHCPD configuration statement for controlling pool usage. Option C is incorrect. missing-peers is not a standard ISC DHCPD configuration statement for pool allocation rules. Option D is incorrect. unmatched-hwaddr is not a standard ISC DHCPD configuration statement for pool allocation or host matching. Therefore, E, unknown-clients, is the correct answer.

Play from 23:27 Question 15. Which of the following statements is true regarding the NFSv4 pseudo file system on the NFS server? Here are the options. Option A. It must be called /exports. Option B. It usually contains bind mounts of the directory trees to be exported. Option C. It must be a dedicated partition on the server. Option D. It is defined in the option Nfsv4-Root in /etc/pathmapd.conf. Option E. It usually contains symlinks to the directory trees to be exported. Pause the video now if you want time to think about the answer.

The correct answer is B. It usually contains bind mounts of the directory trees to be exported. The NFSv4 pseudo file system is a virtual namespace on the NFS server that usually contains bind mounts of the directory trees to be exported. These bind mounts present the actual exported directories within a unified namespace that NFSv4 clients see as a single coherent file system hierarchy. Now, why are the other options incorrect? Option A is incorrect. The pseudo file system is not required to be named /exports; the name is configurable. Option C is incorrect. The pseudo file system does not need to be a dedicated partition; it is typically a directory within the existing file system. Option D is incorrect. The NFSv4 root is not defined in /etc/pathmapd.conf; it is configured in /etc/exports or /etc/nfs.conf. Option E is incorrect. The pseudo file system uses bind mounts rather than symlinks to present the exported directory trees. Therefore, B, It usually contains bind mounts of the directory trees to be exported, is the correct answer.

Play from 25:36 Question 16. Which Postfix command can be used to rebuild all of the alias database files with a single invocation and without the need for any command line arguments? Here are the options. Option A. makealiases. Option B. newaliases. Option C. postalias. Option D. postmapbuild. Pause the video now if you want time to think about the answer.

The correct answer is B. newaliases. The 'newaliases' command rebuilds all alias database files with a single invocation and requires no command-line arguments. It automatically processes the aliases file specified in Postfix configuration and generates the corresponding database files needed for mail routing. Now, why are the other options incorrect? Option A is incorrect. makealiases is not a standard Postfix command; the correct command is newaliases. Option C is incorrect. postalias is a more general tool for managing Postfix alias maps but typically requires file arguments to specify which aliases to process. Option D is incorrect. postmapbuild is not a valid Postfix command for rebuilding alias databases. Therefore, B, newaliases, is the correct answer.

Play from 27:09 Question 17. Which of the following commands displays an overview of the Postfix queue content to help identify remote sites that are causing excessive mail traffic? Here are the options. Option A. mailtraf. Option B. queuequery. Option C. qshape. Option D. postmap. Option E. poststats. Pause the video now if you want time to think about the answer.

The correct answer is C. qshape. qshape is the Postfix utility that provides a detailed overview and analysis of queue contents, organized by destination hosts. It displays mail traffic patterns and helps identify which remote sites are receiving excessive mail, making it useful for troubleshooting mail flow issues and identifying problematic destinations. Now, why are the other options incorrect? Option A is incorrect. mailtraf is not a standard Postfix command for queue analysis. Option B is incorrect. queuequery is not a standard Postfix utility for queue overview. Option D is incorrect. postmap is used for managing lookup tables, not for queue analysis. Option E is incorrect. poststats is not a standard Postfix command for queue content analysis. Therefore, C, qshape, is the correct answer.

Play from 28:40 Question 18. What does the samba-tool testparm command confirm regarding the Samba configuration? Here are the options. Option A. The configuration loads successfully. Option B. The service operates as expected. Option C. The Samba services are started automatically when the system boots. Option D. The netfilter configuration on the Samba server does not block any access to the services defined in the configuration. Option E. All running Samba processes use the most recent configuration version. Pause the video now if you want time to think about the answer.

The correct answer is A. The configuration loads successfully. The testparm command (or 'samba-tool testparm' in newer versions) validates the Samba configuration file (smb.conf) and confirms that it loads successfully without syntax errors. It parses the configuration and reports any issues, making it useful for verifying configuration validity before restarting the service. Now, why are the other options incorrect? Option B is incorrect. testparm does not verify runtime operation or service functionality, only configuration syntax. Option C is incorrect. testparm does not check boot-time startup settings or systemd/init configurations. Option D is incorrect. testparm does not analyze netfilter rules or firewall configurations blocking service access. Option E is incorrect. testparm does not monitor running processes or verify that they are using the latest configuration version. Therefore, A, The configuration loads successfully, is the correct answer.

Play from 30:40 Question 19. Which option within a Nginx server configuration section defines the file system path from which the content of the server is retrieved? Here are the options. Option A. location. Option B. htdocs. Option C. DocumentRoot. Option D. root. Option E. base_dir. Pause the video now if you want time to think about the answer.

The correct answer is D. root. The root directive in Nginx specifies the file system path from which the web server retrieves and serves content. This is the fundamental directive for defining the document root in Nginx server configuration blocks. Now, why are the other options incorrect? Option A is incorrect. location is used to define URI matching patterns and configuration blocks, not the content path. Option B is incorrect. htdocs is an Apache concept, not used in Nginx configuration. Option C is incorrect. DocumentRoot is an Apache directive; Nginx uses root instead. Option E is incorrect. base_dir is not a valid Nginx configuration directive. Therefore, D, root, is the correct answer.

Play from 32:11 Question 20. Which of the following statements allow the logical combinations of conditions in Sieve filters? (Choose two.) Here are the options. Option A. allof. Option B. anyof. Option C. noneof. Option D. and. Option E. or. Pause the video now if you want time to think about the answer.

The correct answers are A. allof, and B. anyof. A. allof B. anyof In Sieve email filtering language, logical conditions are combined using 'allof' (all conditions must be true) and 'anyof' (at least one condition must be true). These are the standard logical combination operators defined in the Sieve specification (RFC 5228). They allow creation of complex filter rules by grouping multiple conditions together. Now, why are the other options incorrect? Option C is incorrect. noneof is not a valid Sieve logical operator for combining conditions. Option D is incorrect. and is not used as a logical operator in Sieve syntax; allof serves this purpose. Option E is incorrect. or is not used as a logical operator in Sieve syntax; anyof serves this purpose. Therefore, A and B are the correct answers.

Play from 33:46 Question 21. Which protocol and port does SMTP use by default? Here are the options. Option A. TCP 25. Option B. TCP 110. Option C. TCP 143. Option D. TCP 993. Pause the video now if you want time to think about the answer.

The correct answer is A. TCP 25. SMTP uses TCP port 25 for mail transfer. Now, why are the other options incorrect? Option B is incorrect. 110 is POP3. Option C is incorrect. 143 is IMAP. Option D is incorrect. 993 is IMAPS. Therefore, A, TCP 25, is the correct answer.

Play from 34:50 Question 22. In a PAM configuration file, which of the following is true about the required control flag? Here are the options. Option A. If the module returns success, no more modules of the same type will be invoked. Option B. The success of the module is needed for the module-type facility to succeed. If it returns a failure, control is returned to the calling application. Option C. The success of the module is needed for the module-type facility to succeed. However, all remaining modules of the same type will be invoked. Option D. The module is not critical and whether it returns success or failure is not important. Option E. If the module returns failure, no more modules of the same type will be invoked. Pause the video now if you want time to think about the answer.

The correct answer is C. The success of the module is needed for the module-type facility to succeed. However, all remaining modules of the same type will be invoked. The 'required' control flag means that the module's success is necessary for the overall authentication to succeed. If it fails, authentication fails and control returns to the application. However, all remaining modules of the same type are still invoked, allowing proper logging and additional checks to occur before final failure is reported. Now, why are the other options incorrect? Option A is incorrect. The 'required' flag does not stop module processing on success; remaining modules are still invoked. Option B is incorrect. While required modules must succeed and cause failure if they fail, the key distinction is that remaining modules are still invoked rather than returning immediately. Option D is incorrect. The 'required' flag is critical; its success or failure directly impacts the overall result. Option E is incorrect. The 'required' flag does not cause immediate return on failure; all remaining modules of the same type continue to be invoked. Therefore, C, The success of the module is needed for the module-type facility to succeed. However, all remaining modules of the same type will be invoked, is the correct answer.

Play from 37:23 Question 23. Which Linux user is used by vsftpd to perform file system operations for anonymous FTP users? Here are the options. Option A. The Linux user which runs the vsftpd process. Option B. The Linux user that owns the root FTP directory served by vsftpd. Option C. The Linux user with the same user name that was used to anonymously log into the FTP server. Option D. The Linux user root, but vsftpd grants access to anonymous users only to globally read-/writeable files. Option E. The Linux user specified in the configuration option ftp_username. Pause the video now if you want time to think about the answer.

The correct answer is E. The Linux user specified in the configuration option ftp_username. The vsftpd daemon uses the Linux user specified in the ftp_username configuration option (typically 'ftp') to perform file system operations on behalf of anonymous FTP users. This configuration option explicitly defines which user account vsftpd impersonates when handling anonymous connections, allowing administrators to control file permissions and access. Now, why are the other options incorrect? Option A is incorrect. The vsftpd process typically runs as root or a dedicated service user, not the user for anonymous operations. Option B is incorrect. The FTP root directory owner is not necessarily the user used for anonymous operations. Option C is incorrect. Anonymous users don't have Linux usernames; they're mapped to a single configured user. Option D is incorrect. vsftpd does not rely on root access with special file permissions for anonymous users; it uses a dedicated ftp user account. Therefore, E, The Linux user specified in the configuration option ftp_username, is the correct answer.

Play from 39:43 Question 24. What is the purpose of DANE? Here are the options. Option A. Verify the integrity of name information retrieved via DNS. Option B. Allow secure dynamic DNS updates. Option C. Invalidate name information stored on caching name servers to speed up DNS updates. Option D. Discover which servers within a DNS domain offer a specific service. Option E. Provide a way to verify the association of X 509 certificates to DNS host names. Pause the video now if you want time to think about the answer.

The correct answer is E. Provide a way to verify the association of X 509 certificates to DNS host names. DANE (DNS-based Authentication of Named Entities) provides a mechanism to verify the association between X.509 certificates and DNS host names using TLSA records. It allows certificate verification through DNS instead of relying solely on certificate authorities, enhancing security for TLS connections. Now, why are the other options incorrect? Option A is incorrect. While DNS has integrity mechanisms, verifying name information integrity is not DANE's primary purpose; DNSSEC serves that role. Option B is incorrect. Secure dynamic DNS updates are handled by mechanisms like TSIG or SIG(0), not DANE. Option C is incorrect. Cache invalidation is handled by DNS mechanisms like cache timeout, not DANE. Option D is incorrect. Service discovery within DNS domains is accomplished using SRV records, not DANE. Therefore, E, Provide a way to verify the association of X 509 certificates to DNS host names, is the correct answer.

Play from 41:55 Question 25. Which of the following services belongs to NFSv4 and does not exist in NFSv3? Here are the options. Option A. rpc.idmapd. Option B. rpc.statd. Option C. nfsd. Option D. rpc.mountd. Pause the video now if you want time to think about the answer.

The correct answer is A. rpc.idmapd. The rpc.idmapd daemon is specific to NFSv4 and handles the mapping of user and group names to numeric UIDs/GIDs across the network. This service did not exist in NFSv3, which handled ID mapping differently. The rpc.idmapd service is essential for NFSv4's distributed security model and name resolution. Now, why are the other options incorrect? Option B is incorrect. rpc.statd (NSM) exists in both NFSv3 and NFSv4 for lock and status monitoring. Option C is incorrect. nfsd (the NFS server daemon) exists in both NFSv3 and NFSv4 implementations. Option D is incorrect. rpc.mountd (the mount daemon) exists in both NFSv3 and NFSv4, though its role differs slightly between versions. Therefore, A, rpc.idmapd, is the correct answer.

Play from 43:34 Question 26. When are Sieve filters usually applied to an email? Here are the options. Option A. When the email is delivered to a mailbox. Option B. When the email is relayed by an SMTP server. Option C. When the email is received by an SMTP smarthost. Option D. When the email is sent to the first server by an MUA. Option E. When the email is retrieved by an MUA. Pause the video now if you want time to think about the answer.

The correct answer is A. When the email is delivered to a mailbox. Sieve filters are typically applied when an email is delivered to a mailbox. The mail delivery agent (MDA) or server processes the incoming message against the user's Sieve script rules during the delivery phase, allowing actions like moving messages to folders or discarding them before they reach the user's mailbox. Now, why are the other options incorrect? Option B is incorrect. Sieve filters operate at delivery time, not during SMTP relay between servers. Option C is incorrect. Sieve filters are not applied when email reaches an SMTP smarthost; they apply during final delivery. Option D is incorrect. Sieve filters do not apply when an MUA initially sends email; they work on the receiving end during delivery. Option E is incorrect. Sieve filters are applied during delivery, not when an MUA retrieves messages from the server. Therefore, A, When the email is delivered to a mailbox, is the correct answer.

Play from 45:23 Question 27. How are PAM modules organized and stored? Here are the options. Option A. As plain text files in /etc/security/. Option B. A statically linked binaries in /etc/pam.d/bin/. Option C. As Linux kernel modules within the respective sub directory of /lib/modules/. Option D. As shared object files within the /lib/ directory hierarchy. Option E. As dynamically linked binaries in /usr/lib/pam/sbin/. Pause the video now if you want time to think about the answer.

The correct answer is D. As shared object files within the /lib/ directory hierarchy. PAM modules are stored as shared object files (dynamic libraries with .so extensions) within the /lib/ directory hierarchy, typically in /lib/security/ or /lib64/security/. These are loaded dynamically at runtime by the PAM framework when needed for authentication operations. Now, why are the other options incorrect? Option A is incorrect. PAM configuration files are plain text in /etc/security/ and /etc/pam.d/, but the modules themselves are compiled binaries, not text files. Option B is incorrect. PAM modules are not statically linked binaries stored in /etc/pam.d/bin/; PAM configuration files are in /etc/pam.d/ but modules are elsewhere. Option C is incorrect. PAM modules are not Linux kernel modules; they are userspace libraries, not stored in /lib/modules/. Option E is incorrect. PAM modules are not dynamically linked binaries in /usr/lib/pam/sbin/; they are shared object files in /lib/ hierarchy directories. Therefore, D, As shared object files within the /lib/ directory hierarchy, is the correct answer.

Play from 47:38 Question 28. Which FTP names are recognized as anonymous users in vsftp when the option anonymous_enable is set to yes in the configuration files? (Choose two.) Here are the options. Option A. anonymous. Option B. ftp. Option C. In the described configuration, any username which neither belongs to an existing user nor has another special meaning is treated as anonymous user. Option D. nobody. Option E. guest. Pause the video now if you want time to think about the answer.

The correct answers are A. anonymous, and B. ftp. A. anonymous B. ftp In vsftpd, the standard recognized anonymous user names are 'anonymous' and 'ftp'. These are the conventional names that enable anonymous FTP login when the anonymous_enable option is set to yes. Now, why are the other options incorrect? Option C is incorrect. This statement about any unrecognized username being treated as anonymous is incorrect; vsftpd only recognizes specific standard names. Option D is incorrect. The 'nobody' user is a system user but is not a recognized anonymous FTP username in vsftpd. Option E is incorrect. The 'guest' user is not a recognized anonymous FTP username in vsftpd's standard configuration. Therefore, A and B are the correct answers.

Play from 49:25 Question 29. Which of the following OpenVPN configuration options makes OpenVPN forward network packets between VPN clients itself instead of passing the packets on to the Linux host which runs the OpenVPN server for further processing? Here are the options. Option A. inter-client-traffic. Option B. client-to-client. Option C. client-router. Option D. client-pass. Option E. grant-client-traffic. Pause the video now if you want time to think about the answer.

The correct answer is B. client-to-client. The client-to-client option enables OpenVPN to route packets directly between VPN clients without forwarding them to the host operating system first. This improves efficiency by allowing client-to-client communication within the VPN tunnel without additional host processing. Now, why are the other options incorrect? Option A is incorrect. inter-client-traffic is not a valid OpenVPN configuration option. Option C is incorrect. client-router is not a standard OpenVPN directive. Option D is incorrect. client-pass is not a valid OpenVPN configuration option. Option E is incorrect. grant-client-traffic is not a recognized OpenVPN option. Therefore, B, client-to-client, is the correct answer.

Play from 51:08 Question 30. Which of these tools, without any options, provides the most information when performing DNS queries? Here are the options. Option A. dig. Option B. nslookup. Option C. host. Option D. named-checkconf. Option E. named-checkzone. Pause the video now if you want time to think about the answer.

The correct answer is A. dig. The 'dig' command provides the most detailed and comprehensive output for DNS queries without any options. It displays full DNS response data including headers, sections, and query details, making it superior to nslookup and host for diagnostic purposes. Now, why are the other options incorrect? Option B is incorrect. nslookup provides less detailed output than dig and is considered legacy Option C is incorrect. host provides only basic DNS lookup information with minimal details Option D is incorrect. named-checkconf validates BIND configuration files, not a query tool Option E is incorrect. named-checkzone validates zone files, not a DNS query tool Therefore, A, dig, is the correct answer.

Play from 52:39 Question 31. Which Apache directive sets the root directory for served files? Here are the options. Option A. ServerRoot. Option B. DocumentRoot. Option C. DirectoryIndex. Option D. Alias. Pause the video now if you want time to think about the answer.

The correct answer is B. DocumentRoot. DocumentRoot specifies the directory from which files are served. Now, why are the other options incorrect? Option A is incorrect. ServerRoot is the config/binary root. Option C is incorrect. DirectoryIndex sets default files. Option D is incorrect. Alias maps URLs to paths. Therefore, B, DocumentRoot, is the correct answer.

Play from 53:39 Question 32. What is the name of the Dovecot configuration variable that specifies the location of user mail? Here are the options. Option A. mbox. Option B. mail_location. Option C. user_dir. Option D. maildir. Option E. user_mail_dir. Pause the video now if you want time to think about the answer.

The correct answer is B. mail_location. mail_location is the Dovecot configuration variable that specifies the path where user mailboxes are stored. It defines the format and location of mail directories for all users and supports various formats like mbox, Maildir, and dbox. This is the standard and primary configuration parameter for this purpose in Dovecot. Now, why are the other options incorrect? Option A is incorrect. mbox is a mail format name, not a configuration variable that specifies mail location. Option C is incorrect. user_dir is not a Dovecot configuration variable for specifying mail location. Option D is incorrect. maildir is a mail format name, not the configuration parameter for setting mail location. Option E is incorrect. user_mail_dir is not a standard Dovecot configuration variable. Therefore, B, mail_location, is the correct answer.

Play from 55:18 Question 33. Using its standard configuration, how does fail2ban block offending SSH clients? Here are the options. Option A. By rejecting connections due to its role as a proxy in front of SSHD. Option B. By modifying and adjusting the SSHD configuration. Option C. By creating and maintaining netfilter rules. Option D. By creating null routes that drop any answer packets sent to the client. Option E. By modifying and adjusting the TCP Wrapper configuration for SSHD. Pause the video now if you want time to think about the answer.

The correct answer is C. By creating and maintaining netfilter rules. Fail2ban uses netfilter (iptables/ip6tables) rules to block offending clients by creating and maintaining firewall rules that drop or reject connections from the source IP addresses. This is the standard mechanism for its operation rather than modifying sshd configuration files directly. Now, why are the other options incorrect? Option A is incorrect. Fail2ban does not operate as a proxy in front of sshd; it works independently through the firewall. Option B is incorrect. Fail2ban does not modify the sshd configuration file itself to block clients. Option D is incorrect. While fail2ban could theoretically use null routes, this is not the standard configuration; netfilter rules are the typical approach. Option E is incorrect. TCP Wrappers (hosts.allow/hosts.deny) is not the standard mechanism used by fail2ban in default configuration. Therefore, C, By creating and maintaining netfilter rules, is the correct answer.

Play from 57:21 Question 34. With Nginx, which of the following directives is used to proxy requests to a FastCGI application? Here are the options. Option A. fastcgi_pass. Option B. fastcgi_proxy. Option C. proxy_fastcgi. Option D. proxy_fastcgi_pass. Option E. fastcgi_forward. Pause the video now if you want time to think about the answer.

The correct answer is A. fastcgi_pass. fastcgi_pass is the correct Nginx directive used to specify the address of a FastCGI application server to which requests should be proxied. It defines where Nginx forwards FastCGI requests for processing. Now, why are the other options incorrect? Option B is incorrect. fastcgi_proxy is not the correct Nginx directive name. Option C is incorrect. proxy_fastcgi is not a valid Nginx directive for FastCGI proxying. Option D is incorrect. proxy_fastcgi_pass is not a valid Nginx directive. Option E is incorrect. fastcgi_forward is not a standard Nginx FastCGI directive. Therefore, A, fastcgi_pass, is the correct answer.

Play from 58:53 Question 35. Which of the following commands is used to change user passwords in an OpenLDAP directory? Here are the options. Option A. setent. Option B. ldpasswd. Option C. olppasswd. Option D. ldappasswd. Option E. ldapchpw. Pause the video now if you want time to think about the answer.

The correct answer is D. ldappasswd. ldappasswd is the standard OpenLDAP command-line utility used to change user passwords in an LDAP directory. It communicates with the LDAP server to modify the userPassword attribute or other password-related attributes for user entries. Now, why are the other options incorrect? Option A is incorrect. setent is not an OpenLDAP command; it is related to NSS configuration. Option B is incorrect. ldpasswd is not a valid OpenLDAP command. Option C is incorrect. olppasswd is not a valid OpenLDAP utility name. Option E is incorrect. ldapchpw is not a standard OpenLDAP command for password changes. Therefore, D, ldappasswd, is the correct answer.

Play from 1:00:24 Question 36. Which of the following statements is INCORRECT regarding the LDIF file format? Here are the options. Option A. It contains a dn line that indicates where the attributes listed in the following lines of the file must be added. Option B. In the file, a blank line separates one entry from another one. Option C. If an attribute contains binary data, some specific configurations must be made for this entry. Option D. The LDIF file accepts any type of file encoding. Pause the video now if you want time to think about the answer.

The correct answer is D. The LDIF file accepts any type of file encoding. The LDIF (LDAP Data Interchange Format) file format has specific requirements regarding file encoding. LDIF files must be encoded in UTF-8 format according to RFC 2849, which defines the standard. Therefore, the statement that LDIF accepts any type of file encoding is incorrect. LDIF files do use dn lines, blank line separators between entries, and do require special handling for binary data. Now, why are the other options incorrect? Option A is incorrect. The dn line is correctly used in LDIF to specify where attributes are added, making this statement correct. Option B is incorrect. Blank lines do properly separate LDIF entries from one another, making this statement correct. Option C is incorrect. Binary data in LDIF does require specific configuration (base64 encoding), making this statement correct. Therefore, D, The LDIF file accepts any type of file encoding, is the correct answer.

Play from 1:02:26 Question 37. Which of the following statements are true regarding Server Name Indication (SNI)? (Choose two.) Here are the options. Option A. It supports transparent failover of TLS sessions from one web server to another. Option B. It allows multiple SSL/TLS secured virtual HTTP hosts to coexist on the same IP address. Option C. It enables HTTP servers to update the DNS of their virtual hosts' names using the X 509 certificates of the virtual hosts. Option D. It provides a list of available virtual hosts to the client during the TLS handshake. Option E. It submits the host name of the requested URL during the TLS handshake. Pause the video now if you want time to think about the answer.

The correct answers are B. It allows multiple SSL/TLS secured virtual HTTP hosts to coexist on the same IP address, and E. It submits the host name of the requested URL during the TLS handshake. SNI allows the client to submit the hostname of the requested URL during the TLS handshake (option E), enabling the server to select the correct SSL/TLS certificate before the handshake completes. This allows multiple SSL/TLS secured virtual HTTP hosts to coexist on the same IP address (option B), solving the limitation of the original SSL/TLS protocol where the server certificate had to be selected before knowing which virtual host was requested. Now, why are the other options incorrect? Option A is incorrect. SNI does not provide transparent failover of TLS sessions; failover requires additional mechanisms like load balancing. Option C is incorrect. SNI does not enable servers to update DNS records; it only communicates the hostname during the handshake. Option D is incorrect. SNI does not provide a list of available virtual hosts to the client; the client specifies which host it wants to connect to. Therefore, B and E are the correct answers.

Play from 1:04:54 Question 38. In order to prevent all anonymous FTP users from listing uploaded file names, what security precaution can be taken when creating an upload directory? Here are the options. Option A. The directory must not have the execute permission set. Option B. The directory must not have the read permission set. Option C. The directory must not have the read or execute permission set. Option D. The directory must not have the write permission set. Option E. The directory must not contain other directories. Pause the video now if you want time to think about the answer.

The correct answer is B. The directory must not have the read permission set. To prevent anonymous FTP users from listing uploaded file names in a directory, the read permission must be removed from the directory. Without read permission, users cannot list the directory contents, even though they may retain write permission to upload files. Now, why are the other options incorrect? Option A is incorrect. Removing execute permission prevents directory traversal but still allows listing if read permission exists. Option C is incorrect. Removing both read and execute permissions is overly restrictive and is not the minimal necessary precaution. Option D is incorrect. Removing write permission would prevent uploads, which contradicts the purpose of an upload directory. Option E is incorrect. Whether the directory contains other directories is not the relevant security control for preventing file listing. Therefore, B, The directory must not have the read permission set, is the correct answer.

Play from 1:06:46 Question 39. What is the standard port used by OpenVPN? Here are the options. Option A. 1723. Option B. 4500. Option C. 500. Option D. 1194. Pause the video now if you want time to think about the answer.

The correct answer is D. 1194. Port 1194 is the standard and default port used by OpenVPN for both UDP and TCP connections. This port was assigned by IANA specifically for OpenVPN. Now, why are the other options incorrect? Option A is incorrect. Port 1723 is the default port for PPTP (Point-to-Point Tunneling Protocol), not OpenVPN. Option B is incorrect. Port 4500 is used for IPSec NAT-T (NAT Traversal), not OpenVPN's standard port. Option C is incorrect. Port 500 is used for IPSec IKE (Internet Key Exchange), not OpenVPN. Therefore, D, 1194, is the correct answer.

Play from 1:08:06 Question 40. Which global option in squid.conf sets the port number or numbers that Squid will use to listen for client requests? Here are the options. Option A. port. Option B. client_port. Option C. http_port. Option D. server_port. Option E. squid_port. Pause the video now if you want time to think about the answer.

The correct answer is C. http_port. The http_port directive in squid.conf specifies the port number or numbers that Squid listens on for incoming client requests. This is the standard global option used to configure Squid's listening ports, with a default value of 3128. Now, why are the other options incorrect? Option A is incorrect. The 'port' directive is not used in Squid configuration for this purpose. Option B is incorrect. client_port is not a valid Squid configuration directive. Option D is incorrect. server_port refers to upstream server connections, not client-facing listening ports. Option E is incorrect. squid_port is not a valid Squid configuration directive. Therefore, C, http_port, is the correct answer.

Play from 1:09:42 Question 41. What is DNSSEC used for? Here are the options. Option A. Encrypted DNS queries between nameservers. Option B. Cryptographic authentication of DNS zones. Option C. Secondary DNS queries for local zones. Option D. Authentication of the user that initiated the DNS query. Option E. Encrypting DNS queries and answers. Pause the video now if you want time to think about the answer.

The correct answer is B. Cryptographic authentication of DNS zones. DNSSEC (DNS Security Extensions) is used for cryptographic authentication of DNS zones. It provides digital signatures and keys that allow DNS clients to verify that DNS responses originate from authoritative sources and have not been tampered with during transmission. Now, why are the other options incorrect? Option A is incorrect. DNSSEC does not encrypt DNS queries; it provides authentication through digital signatures Option C is incorrect. Secondary DNS queries are not related to DNSSEC functionality Option D is incorrect. DNSSEC authenticates zones and servers, not individual users who initiate queries Option E is incorrect. DNSSEC provides authentication, not encryption of queries and answers Therefore, B, Cryptographic authentication of DNS zones, is the correct answer.

Play from 1:11:33 Question 42. Which of the following commands can be used to connect and interact with remote TCP network services? (Choose two.) Here are the options. Option A. nettalk. Option B. nc. Option C. telnet. Option D. cat. Option E. netmap. Pause the video now if you want time to think about the answer.

The correct answers are B. nc, and C. telnet. B. nc C. telnet Both 'nc' (netcat) and 'telnet' are tools that can connect to and interact with remote TCP network services. They are commonly used for testing connectivity, debugging services, and general TCP/IP communication. Now, why are the other options incorrect? Option A is incorrect. Nettalk is not a standard Linux command for connecting to TCP services. Option D is incorrect. While 'cat' can read files, it is not designed to connect to and interact with remote TCP network services. Option E is incorrect. Netmap is not a standard Linux command for connecting to TCP network services. Therefore, B and C are the correct answers.

Play from 1:13:03 Question 43. Which of the following actions are available in Sieve core filters? (Choose three.) Here are the options. Option A. drop. Option B. discard. Option C. fileinto. Option D. relay. Option E. reject. Pause the video now if you want time to think about the answer.

The correct answers are B. discard, and C. fileinto, and E. reject. The Sieve core filter actions include discard (silently discards mail), fileinto (files mail into a mailbox), and reject (rejects mail with a bounce message). These are standard actions defined in the Sieve specification for mail filtering operations. Now, why are the other options incorrect? Option A is incorrect. drop is not a standard Sieve core filter action; discard is used instead. Option D is incorrect. relay is not part of the Sieve core filter actions. Therefore, B and C and E are the correct answers.

Play from 1:14:17 Question 44. Which configuration parameter on a Postfix server modifies only the sender address and not the recipient address? Here are the options. Option A. alias_maps. Option B. alias_rewrite_maps. Option C. sender_canonical_maps. Option D. sender_rewrite_maps. Pause the video now if you want time to think about the answer.

The correct answer is C. sender_canonical_maps. sender_canonical_maps is the Postfix parameter that rewrites only sender addresses in mail headers and envelopes. It applies transformations to the sender address exclusively without affecting recipient addresses. This is distinct from alias_maps which handles recipient aliasing, and sender_rewrite_maps which is a different mechanism. Now, why are the other options incorrect? Option A is incorrect. alias_maps rewrites recipient addresses, not sender addresses. Option B is incorrect. alias_rewrite_maps is not a standard Postfix configuration parameter. Option D is incorrect. sender_rewrite_maps operates differently and is not the primary parameter for basic sender address modification. Therefore, C, sender_canonical_maps, is the correct answer.

Play from 1:15:49 Question 45. Which of the following information has to be submitted to a certification authority in order to request a web server certificate? Here are the options. Option A. The web server's private key. Option B. The IP address of the web server. Option C. The list of ciphers supported by the web server. Option D. The web server's SSL configuration file. Option E. The certificate signing request. Pause the video now if you want time to think about the answer.

The correct answer is E. The certificate signing request. A certificate signing request (CSR) is the proper document submitted to a certification authority to request a web server certificate. The CSR contains the public key and identifying information; the private key must never be submitted to the CA. Now, why are the other options incorrect? Option A is incorrect. The private key must never be submitted to a certification authority; it must remain secret. Option B is incorrect. The IP address alone is not a required component of a certificate request; domain names are used instead. Option C is incorrect. The list of ciphers is not required for certificate requests; this is a server configuration matter. Option D is incorrect. The SSL configuration file is not submitted to certification authorities during the CSR process. Therefore, E, The certificate signing request, is the correct answer.

Play from 1:17:35 Question 46. Which of the following DNS record types is used for reverse DNS queries? Here are the options. Option A. CNAME. Option B. IN. Option C. PTR. Option D. REV. Option E. RIN. Pause the video now if you want time to think about the answer.

The correct answer is C. PTR. The PTR (Pointer) record type is used for reverse DNS queries, mapping IP addresses back to host names. Reverse DNS lookups use PTR records in the in-addr.arpa domain to resolve an IP address to its associated hostname. Now, why are the other options incorrect? Option A is incorrect. CNAME records are used for canonical name aliasing, not reverse DNS lookups. Option B is incorrect. IN is a DNS class designation, not a record type for reverse queries. Option D is incorrect. REV is not a standard DNS record type. Option E is incorrect. RIN is not a valid DNS record type. Therefore, C, PTR, is the correct answer.

Play from 1:19:02 Question 47. Which of the following PAM modules allows the system administrator to use an arbitrary file containing a list of user and group names with restrictions on the system resources available to them? Here are the options. Option A. pam_filter. Option B. pam_limits. Option C. pam_listfile. Option D. pam_unix. Pause the video now if you want time to think about the answer.

The correct answer is B. pam_limits. pam_limits applies resource limits to users and groups. It reads the limits from a configuration file (/etc/security/limits.conf by default, or another file named with the conf= option). pam_listfile only allows or denies access based on the entries of a file; it does not set resource limits. Now, why are the other options incorrect? Option A is incorrect. pam_filter filters the input and output of applications; it does not set resource limits. Option C is incorrect. pam_listfile allows or denies access to a service based on a list of users or groups in a file; it does not apply resource limits. Option D is incorrect. pam_unix is the standard password authentication module and does not set resource limits. Therefore, B, pam_limits, is the correct answer.

Play from 1:20:38 Question 48. It has been discovered that the company mail server is configured as an open relay. Which of the following actions would help prevent the mail server from being used as an open relay while maintaining the possibility to receive company mails? (Choose two.) Here are the options. Option A. Restrict Postfix to only accept e-mail for domains hosted on this server. Option B. Configure Dovecot to support IMAP connectivity. Option C. Configure netfilter to not permit port 25 traffic on the public network. Option D. Restrict Postfix to only relay outbound SMTP from the internal network. Option E. Upgrade the mailbox format from mbox to maildir. Pause the video now if you want time to think about the answer.

The correct answers are A. Restrict Postfix to only accept e-mail for domains hosted on this server, and D. Restrict Postfix to only relay outbound SMTP from the internal network. Preventing open relay requires two key actions: (A) restricting Postfix to only accept email for domains hosted on the server ensures it won't accept arbitrary mail for other domains, and (D) restricting relaying to only the internal network prevents external users from sending through the server to arbitrary destinations. Together these block the two main vectors of relay abuse. Now, why are the other options incorrect? Option B is incorrect. Dovecot IMAP configuration is for mail retrieval, not for preventing relay abuse or controlling inbound mail acceptance. Option C is incorrect. Blocking port 25 on the public network would prevent the server from receiving legitimate mail, contradicting the requirement to maintain mail reception. Option E is incorrect. The mailbox format (mbox vs maildir) has no bearing on preventing open relay; this is a storage format choice unrelated to relay control. Therefore, A and D are the correct answers.

Play from 1:22:58 Question 49. Which Apache HTTPD configuration directive is used to specify the method of authentication, e.g. None or Basic? Here are the options. Option A. AuthUser. Option B. AllowedAuthUser. Option C. AuthType. Option D. AllowAuth. Pause the video now if you want time to think about the answer.

The correct answer is C. AuthType. AuthType is the correct Apache HTTPD directive used to specify the authentication method, such as 'None', 'Basic', 'Digest', or other authentication schemes. This directive determines how the server will authenticate users in a protected area. Now, why are the other options incorrect? Option A is incorrect. AuthUser is not a standard Apache HTTPD directive for specifying authentication method. Option B is incorrect. AllowedAuthUser is not a valid Apache HTTPD configuration directive. Option D is incorrect. AllowAuth is not the correct directive name for specifying authentication type. Therefore, C, AuthType, is the correct answer.

Play from 1:24:27 Question 50. Which BIND option should be used to limit the IP addresses from which slave name servers may connect? Here are the options. Option A. allow-zone-transfer. Option B. allow-transfer. Option C. allow-secondary. Option D. allow-slaves. Option E. allow-queries. Pause the video now if you want time to think about the answer.

The correct answer is B. allow-transfer. The 'allow-transfer' option in BIND is used to limit which IP addresses are permitted to initiate zone transfers from the master nameserver. This controls which slave (secondary) nameservers can pull zone data from the primary server. Now, why are the other options incorrect? Option A is incorrect. allow-zone-transfer is not the correct BIND option name Option C is incorrect. allow-secondary is not a standard BIND option for restricting zone transfers Option D is incorrect. allow-slaves is not a standard BIND option for zone transfer control Option E is incorrect. allow-queries restricts which addresses can perform DNS queries, not zone transfers Therefore, B, allow-transfer, is the correct answer.