• Home
• LPI Exams
• 202-450 - LPIC-2 Exam 202

202-450 LPI Practice Test Questions and Exam Dumps

Question 1

On a Linux router, IPv4 packet forwarding has been enabled. However, after the system reboots, it stops forwarding packets from other machines. Executing the command echo 1 > /proc/sys/net/ipv4/ip_forward restores packet forwarding temporarily.
Which one of the following options is the best way to ensure that this setting remains active even after a system restart?

A. Add echo 1 > /proc/sys/net/ipv4/ip_forward to the root user login script
B. Add echo 1 > /proc/sys/net/ipv4/ip_forward to any user login script
C. In /etc/sysctl.conf change net.ipv4.ip_forward to 1
D. In /etc/rc.local add net.ipv4.ip_forward = 1
E. In /etc/sysconfig/iptables-config add ipv4.ip_forward = 1

Correct Answer: C

Explanation:
IPv4 packet forwarding is controlled by a kernel parameter. When enabled through the echo command, it only lasts until the system reboots. The proper and persistent method is to configure this setting in the /etc/sysctl.conf file. This ensures the forwarding remains active across reboots by applying the configuration automatically at startup.

Adding the command to login scripts (whether for root or other users) is unreliable, as it only takes effect during interactive sessions and not during system boot. Editing firewall-related files like /etc/sysconfig/iptables-config does not impact IP forwarding. The /etc/rc.local file is no longer supported by many modern Linux systems and should not be used for this type of configuration.

Using the sysctl configuration file is the most appropriate and reliable way to apply kernel settings persistently.

Question 2

In an OpenVPN server setup, a file defined by the status parameter is used to monitor the server.
Which two types of information are typically found in this status file?

A. Errors and warnings generated by the openvpn daemon
B. Routing information
C. Statistical information regarding the currently running openvpn daemon
D. A list of currently connected clients
E. A history of all clients who have connected at some point

Correct Answers: C and D

Explanation:
The OpenVPN status file is a valuable diagnostic and monitoring tool for administrators. It is specified using the status directive in the OpenVPN server configuration file and provides a real-time snapshot of the server's current state. This file is updated periodically by the OpenVPN daemon and can be viewed at any time to observe active sessions and performance metrics.

One of the primary pieces of information included in the status file is a list of currently connected clients. Each client entry typically includes the client's common name, their virtual IP address, the real IP address from which they are connected, and timestamps indicating when the connection was established. This information is crucial for network administrators who need to track which users are connected to the VPN at any given time and verify whether unauthorized access is taking place.

The file also includes statistical data about each client session. These statistics may include the number of bytes sent and received, the duration of the connection, and other performance-related metrics. This type of information is useful for bandwidth monitoring, usage auditing, and ensuring that connections remain stable and efficient.

Options A, B, and E do not describe the contents of the status file accurately. For example, errors and warnings generated by the OpenVPN process are not stored in the status file but are instead logged to a designated log file, which is defined separately using the log or log-append parameters in the configuration. This log file contains system-level messages, error reports, warnings, and notices from the OpenVPN process.

Routing information is another item that is not included in the status file. Routing details such as which routes have been pushed to clients or the internal VPN routing table are managed internally by OpenVPN and the operating system. To view this kind of data, administrators typically use system tools like route, ip route, or inspect server-side configuration directives.

Lastly, a history of all clients who have connected is not maintained in the status file. It only shows the current active connections. If historical data is needed, administrators must configure OpenVPN to write logs to a persistent location or use external monitoring tools or scripts to track and archive client activity over time.

Overall, the OpenVPN status file is intended to give a real-time, live view of VPN activity rather than serve as a long-term log or diagnostic archive.

Question 3

Which of the following lines in the sshd configuration file should, if present, be changed in order to increase the security of the server? (Choose two.)

A. Protocol 2, 1
B. PermitEmptyPasswords no
C. Port 22
D. PermitRootLogin yes
E. IgnoreRhosts yes

Correct Answers: A and D

Explanation:
The sshd_config file controls the behavior of the SSH daemon on a server. Some settings can significantly impact the overall security posture of the system. Among the options listed, two entries stand out as security risks and should be modified.

Protocol 2, 1 is insecure because it enables support for both SSH protocol versions 1 and 2. SSH protocol version 1 is outdated and contains multiple known vulnerabilities, including weak encryption and the lack of integrity checking. To enhance security, this line should be changed to only allow Protocol 2, which is the modern and secure version.

PermitRootLogin yes allows direct SSH access to the root account. While this may be convenient for administrators, it presents a serious security risk. Attackers often attempt to brute-force root credentials. A more secure approach is to disable root login and instead allow standard users to authenticate and use sudo for administrative tasks. The setting should be changed to PermitRootLogin no to minimize the attack surface.

Other options like PermitEmptyPasswords no are already secure; this setting prevents users with empty passwords from logging in. IgnoreRhosts yes is also secure, as it disables legacy .rhosts authentication mechanisms that are considered insecure. Port 22 is the default SSH port and does not pose a direct security threat, although changing it may reduce exposure to automated scans—it is not critical compared to the protocol and root login settings.

Question 4

Which of the following nmap parameters scans a target for open TCP ports? (Choose two.)

A. -sO
B. -sZ
C. -sT
D. -sU
E. -sS

Correct Answers: C and E

Explanation:
Nmap is a widely used network scanning tool that supports different scan types to detect open ports and services. TCP port scanning is one of its most common uses.

-sT initiates a full TCP connect scan, also known as a "connect scan." It attempts to complete the three-way TCP handshake with each port on the target. This method is reliable but more easily detected by intrusion detection systems.

-sS performs a TCP SYN scan, also known as a "half-open" scan. Instead of completing the full handshake, it sends a SYN packet and waits for a response. If the target replies with SYN-ACK, the port is open. This method is faster and more stealthy than -sT, making it a popular choice for network reconnaissance.

-sU is used for scanning UDP ports, not TCP. -sO attempts to identify which IP protocols are supported by the target (like ICMP, TCP, UDP, etc.), and -sZ is not a valid nmap option. Therefore, only -sT and -sS correctly scan for open TCP ports.

Question 5

What option in the client configuration file would tell OpenVPN to use a dynamic source port when making a connection to a peer?

A. src-port
B. remote
C. source-port
D. nobind
E. dynamic-bind

Correct Answer: D

Explanation:
OpenVPN is a highly configurable VPN solution used for creating secure point-to-point or site-to-site connections. In any OpenVPN client configuration file, various options can control how the client initiates its connection to a VPN server. One of those behaviors involves how the client binds to local ports when establishing the connection.

The directive nobind is specifically used in the client configuration file to instruct OpenVPN not to bind to a specific local IP address or port number. When nobind is specified, the client does not request a fixed source port; instead, the operating system dynamically assigns an available ephemeral port at runtime. This is exactly what is meant by using a dynamic source port.

The behavior of not binding to a specific port is desirable in many typical VPN scenarios. For instance, when multiple OpenVPN clients are running on the same machine or if the client does not require a fixed port (which is often the case), allowing the system to choose a free port helps avoid conflicts. Also, when connecting through NAT (Network Address Translation), this flexibility allows better compatibility.

On the other hand, if a source port is manually specified without nobind, OpenVPN will try to use that port and will fail to connect if it is already in use or restricted by firewall rules.

Let’s go over why the other options are incorrect:

• A. src-port: This is not a valid OpenVPN directive. Although the name suggests it might control the source port, OpenVPN does not recognize this keyword in its configuration syntax. Therefore, it has no effect on behavior and would result in a configuration error.

• B. remote: This directive is used to specify the remote server’s address and optional port. For example, remote vpn.example.com 1194 tells the client to connect to the server at that domain on port 1194. It has nothing to do with setting or changing the source port on the client side. It targets the destination, not the origin of the connection.

• C. source-port: Like src-port, this is not a recognized or valid directive in OpenVPN’s configuration language. Adding such a line would either be ignored or cause a failure in parsing the configuration file.

• E. dynamic-bind: This is another invalid option. There is no directive by this name in OpenVPN. While it may sound descriptive, OpenVPN does not use this terminology for dynamic port binding. Again, the correct keyword for allowing dynamic source ports is nobind.

In practical use, especially when setting up OpenVPN clients on personal devices, routers, or systems behind NAT, the nobind option is commonly included in configuration files. It ensures that the OpenVPN process does not attempt to lock a specific local port, which could be unavailable or blocked. It makes the VPN connection more robust and adaptable across different network environments.

In summary, when the goal is to allow OpenVPN to use any available local port — i.e., a dynamic source port — the configuration must include nobind. This is the correct and supported way to achieve that functionality within OpenVPN. It enhances compatibility, reduces connection failures, and is part of standard practice in most client deployments.

Question 6

Which Linux user is used by vsftpd to perform file system operations for anonymous FTP users?

A. The Linux user which runs the vsftpd process
B. The Linux user that owns the root FTP directory served by vsftpd
C. The Linux user with the same user name that was used to anonymously log into the FTP server
D. The Linux user root, but vsftpd grants access to anonymous users only to globally read-/writeable files
E. The Linux user specified in the configuration option ftp_username

Correct Answer: E

Explanation:
vsftpd (Very Secure FTP Daemon) is a widely used FTP server for Linux and Unix systems. It’s designed to be simple, fast, and secure, providing a highly configurable platform for file transfers, including anonymous FTP access.

When anonymous FTP users connect to the server, vsftpd needs to perform file system operations on their behalf. The user under which these operations are performed is crucial for both security and functionality. The configuration of vsftpd determines which Linux user is used for these operations, specifically when handling anonymous access.

The correct answer is E. The Linux user specified in the configuration option ftp_username.

In vsftpd, the ftp_username directive in the configuration file (/etc/vsftpd.conf) specifies which Linux user vsftpd should use for performing file system operations on behalf of anonymous users. By default, this is set to a non-privileged user, often ftp or nobody, to minimize security risks associated with allowing anonymous access.

Here’s a breakdown of why the other options are incorrect:

• A. The Linux user which runs the vsftpd process: This option is incorrect because while vsftpd itself is typically run by a system user (often root), the actual file operations for anonymous FTP users are not performed by this user. Using the user running the vsftpd process could pose significant security risks, as the user running the process may have more privileges than necessary for file operations.

• B. The Linux user that owns the root FTP directory served by vsftpd: While it is true that the owner of the root FTP directory (/srv/ftp or /var/ftp depending on the system) is important, it does not directly determine the user performing file operations for anonymous users. The owner of the FTP directory is usually set to the user running the FTP service, but it’s the ftp_username setting in the configuration that specifies the user under which file operations will be performed.

• C. The Linux user with the same username that was used to anonymously log into the FTP server: This option is incorrect because anonymous FTP users generally log in with the username anonymous or ftp. However, vsftpd does not perform file system operations under the same user as the one used to log in. Instead, it uses a specific system user defined in the ftp_username configuration option to control permissions and minimize risks.

• D. The Linux user root, but vsftpd grants access to anonymous users only to globally read-/writeable files: This option is incorrect and dangerous. Using the root user for anonymous FTP access would create severe security risks. Root access should always be avoided in any configuration involving anonymous access. Proper configuration should ensure that anonymous FTP access is restricted to a non-privileged user, such as ftp or nobody, to prevent unauthorized access to sensitive system files.

Why Option E is Correct:

The ftp_username directive in the vsftpd configuration file allows administrators to specify a non-privileged Linux user for handling file system operations related to anonymous FTP access. By default, this might be set to a user like ftp or nobody, which is designed to be safe and has minimal permissions. This configuration helps to enforce security by ensuring that anonymous FTP users cannot perform dangerous file system operations.

Moreover, specifying a dedicated, non-privileged user in ftp_username ensures that if an attacker gains access through an anonymous FTP session, they are limited in the types of operations they can perform, thereby protecting the integrity and security of the system.

The Linux user specified in the ftp_username option is the one used by vsftpd to perform file system operations on behalf of anonymous FTP users, ensuring that such operations are conducted with a non-privileged user, minimizing security risks.

Question 7

Which of the following sshd configuration options should be set to no in order to fully disable password-based logins? (Choose two.)

A. PAMAuthentication
B. ChallengeResponseAuthentication
C. PermitPlaintextLogin
D. UsePasswords
E. PasswordAuthentication

Correct Answers: B and E

Explanation:
Disabling password-based logins in SSH is a crucial security measure, especially on servers where sensitive data is handled. Allowing only key-based authentication and disabling passwords makes it significantly harder for attackers to gain unauthorized access using brute force attacks or credential stuffing.

The two most important SSH configuration options to disable password-based logins are ChallengeResponseAuthentication and PasswordAuthentication. Let’s break down why these two are correct and why the others are not applicable for this purpose.

1. PasswordAuthentication (Option E)

The PasswordAuthentication option controls whether or not SSH will allow password-based authentication for logins. By setting this option to no, SSH will reject any login attempts that try to authenticate using a password, requiring an alternative method (such as SSH key-based authentication) instead.

• Correct setting: PasswordAuthentication no

• Why: This is the most direct way to disable password-based authentication for SSH logins.

2. ChallengeResponseAuthentication (Option B)

The ChallengeResponseAuthentication option controls whether SSH should allow challenge-response authentication methods (such as One-Time Passwords (OTPs) or other interactive prompts). In many systems, challenge-response methods can still rely on passwords, so disabling this method also helps eliminate password-based authentication.

• Correct setting: ChallengeResponseAuthentication no

• Why: Disabling this option prevents SSH from accepting any form of interactive password-based authentication (including challenge-response mechanisms).

Why the Other Options Are Incorrect:

• A. PAMAuthentication:
  The PAMAuthentication option controls whether Pluggable Authentication Modules (PAM) are used for authentication. PAM is a framework that allows various authentication methods, including password-based logins. Disabling this option will stop PAM from being used, but it is not the most direct method to disable password logins specifically. Moreover, PAM is often used in many Linux distributions to control additional authentication mechanisms beyond just passwords.

• C. PermitPlaintextLogin:
  The PermitPlaintextLogin directive does not exist in the default SSH configuration and is not a recognized option in sshd_config. This might be a confusion with another configuration or an incorrectly specified option.

• D. UsePasswords:
  The UsePasswords option is also not a valid directive in sshd_config. There is no setting by this name in OpenSSH's default configuration file. This could be a misinterpretation of the correct configuration directive names like PasswordAuthentication or ChallengeResponseAuthentication.

To fully disable password-based logins in SSH, you need to set PasswordAuthentication and ChallengeResponseAuthentication to no. This ensures that all password-based authentication mechanisms are disabled, and only methods like SSH key-based authentication are allowed.

Question 8

When the default policy for the netfilter INPUT chain is set to DROP, why should a rule allowing traffic to localhost exist?

A. All traffic to localhost must always be allowed
B. It doesn’t matter; netfilter never affects packets addressed to localhost
C. Some applications use the localhost interface to communicate with other applications
D. syslogd receives messages on localhost
E. The iptables command communicates with the netfilter management daemon netfilterd on localhost to create and change packet filter rules

Correct Answer: C

Explanation:
In a typical Linux firewall setup using iptables (which interfaces with netfilter), it is common to define default policies to control how packets are handled. If the default policy for the INPUT chain is set to DROP, it means that any incoming traffic not explicitly allowed by other rules will be dropped. While this is a good security measure, there is one important exception that needs special consideration: traffic to the localhost (127.0.0.1).

Localhost traffic (i.e., traffic directed to 127.0.0.1 or ::1 for IPv6) is used by applications to communicate with each other on the same machine. It is handled entirely by the kernel and does not involve network interfaces outside the system. However, even with the DROP policy set for the INPUT chain, traffic to localhost may be blocked unless explicitly allowed.

Now, let’s break down the reasoning behind the correct answer and why the others are not appropriate.

Why C. Some applications use the localhost interface to communicate with other applications is the correct answer:

Many applications on a Linux system use the localhost interface (127.0.0.1) to communicate with other processes running on the same machine. For example:

• A web server (like Apache or Nginx) might need to communicate with a local database server (such as MySQL or PostgreSQL).

• Various applications may use inter-process communication (IPC) methods that rely on the localhost network interface.

If the firewall drops traffic to localhost, these essential local communications would fail, even though the traffic doesn’t go outside the machine. By allowing localhost traffic explicitly in the firewall, you ensure that local applications can continue to communicate with each other.

Why the other options are incorrect:

• A. All traffic to localhost must always be allowed:
  While this might seem logical, it’s not entirely accurate. The critical point is that allowing localhost traffic is necessary for proper local communication between applications. However, it is not the case that all traffic to localhost “must always be allowed.” The firewall can, in certain situations, allow or deny specific types of traffic to localhost depending on the system’s needs and security policies. The need for a rule allowing localhost traffic arises because of the default policy being set to DROP, which would block all traffic unless explicitly permitted.

• B. It doesn’t matter; netfilter never affects packets addressed to localhost:
  This statement is incorrect. Netfilter does in fact process packets addressed to localhost. It is a common misconception that packets destined for localhost bypass the netfilter framework. In reality, packets directed to 127.0.0.1 can still be filtered by netfilter rules unless explicitly allowed, and if the default policy is DROP, such traffic will be blocked unless a specific rule exists to allow it.

• D. syslogd receives messages on localhost:
  While it’s true that some system logging daemons, like syslogd, may communicate over localhost, this isn’t the primary reason to allow localhost traffic. The main issue is that many applications rely on the localhost interface for inter-process communication, as discussed in C. Logging systems may also rely on localhost traffic, but this is a secondary concern compared to the broader need for local application communication.

• E. The iptables command communicates with the netfilter management daemon netfilterd on localhost to create and change packet filter rules:
  This is inaccurate. The iptables command does not communicate with any daemon like netfilterd for managing packet filter rules. iptables is a user-space utility that directly manipulates the kernel's netfilter framework through system calls. It doesn’t require localhost communication for rule creation or modification. Therefore, this is not a valid reason for needing a rule allowing localhost traffic.

When the default policy for the INPUT chain is set to DROP in a Linux firewall, you must ensure that traffic to localhost is explicitly allowed. This is crucial because many applications rely on the localhost interface for inter-process communication, and blocking localhost traffic would break such essential functions. Therefore, the correct answer is C, as it reflects the practical need to maintain local communication between applications running on the same machine.