View Full LPI 202-450  Exam Dumps and Practice Test Dumps

 

Question 301. Which BIND directive determines whether a server performs recursive queries?

1. recursion
2. recursive-query
3. enable-recursion
4. recursive-mode

Correct Answer: 1. recursion

Explanation :-

The BIND recursion option controls whether the DNS server performs recursive queries. When enabled, the server can resolve names by querying other DNS servers when the requested information is not already available locally. This setting is commonly used together with allow-recursion, which controls which clients are permitted to use recursive service. An authoritative-only server may disable recursion to reduce unnecessary exposure. Administrators should distinguish between enabling recursion and controlling recursive clients: recursion determines whether the capability exists, while allow-recursion controls access to it.

Question 302. Which Apache module provides support for SSL/TLS connections such as HTTPS?

1. mod_http
2. mod_secure
3. mod_ssl
4. mod_tls

Correct Answer: 3. mod_ssl

Explanation :-

The Apache mod_ssl module provides SSL/TLS support for Apache HTTP Server and is commonly used to configure HTTPS virtual hosts. It enables Apache to establish encrypted connections and can be configured with certificates, private keys, protocol settings, and related TLS parameters. Simply enabling mod_ssl is not sufficient by itself; the appropriate virtual-host configuration and certificate files must also be correctly configured. Modules such as mod_rewrite serve different purposes, including URL rewriting. Administrators should verify both module availability and the TLS virtual-host configuration when troubleshooting HTTPS services.

Question 303. Which NFS configuration option prevents the root user on an NFS client from being treated as root on the exported file system?

1. no_root
2. root_squash
3. secure_root
4. map_root

Correct Answer: 4. root_squash

Explanation :-

The NFS root_squash option maps requests from the root user on an NFS client to an anonymous identity on the server. This prevents a client-side root account from automatically having root-level privileges on the exported file system. It is an important security feature for many NFS exports. The opposite behavior can be enabled with no_root_squash, although that should be used carefully. NFS permissions involve both export options and underlying Unix ownership and mode bits, so administrators should evaluate all layers when securing shared file systems.

Question 304. Which Samba parameter specifies the directory that is shared through a particular share definition?

1. directory
2. share_path
3. path
4. sharedir

Correct Answer: 3. path

Explanation :-

The Samba path parameter specifies the local file-system directory associated with a share. For example, a share definition might contain path = /srv/shared. Samba then exposes that directory through the configured SMB share name. Other parameters control access, visibility, and write behavior, such as valid users, browseable, and read only. The directory specified by path must also have appropriate underlying Unix permissions and ownership. Therefore, configuring the Samba share correctly does not automatically grant access if the operating system’s file permissions prevent the authenticated user from reading or writing the directory.

Question 305. Which DNS record type is normally used to specify the primary authoritative name server and administrative contact for a zone?

1. SOA
2. NS
3. MX
4. SRV

Correct Answer: 3. SOA

Explanation :-

The SOA, or Start of Authority, record contains administrative information for a DNS zone. Its fields include the primary name server, the responsible party’s mailbox in DNS notation, the zone serial number, and several timing values such as refresh, retry, and expire. Every authoritative DNS zone has an SOA record. NS records identify authoritative name servers, but the SOA contains the primary server and zone-management information. Correct SOA configuration is important for secondary-server synchronization and DNS administration because the serial and timing fields influence how zone transfers and refresh operations are handled.

Question 306. Which DHCP message is normally broadcast by a client at the beginning of the DHCP address-discovery process?

1. DHCPACK
2. DHCPREQUEST
3. DHCPOFFER
4. DHCPDISCOVER

Correct Answer: 4. DHCPDISCOVER

Explanation :-

DHCPDISCOVER is normally the first message sent by a DHCP client seeking network configuration. Because the client may not yet have an IP address or know the location of a DHCP server, the message is typically broadcast on the local network. DHCP servers can respond with DHCPOFFER messages containing proposed configuration. The client then selects an offer using DHCPREQUEST, and the server generally completes the process with DHCPACK. Understanding this sequence is useful when troubleshooting DHCP because packet captures can reveal whether the client is discovering servers and whether servers are responding with valid offers.

Question 307. Which Postfix parameter controls the domain appended to locally submitted mail when appropriate?

1. myorigin
2. mydomain
3. origin_domain
4. local_domain

Correct Answer: 1. myorigin

Explanation :-

The Postfix myorigin parameter specifies the domain that locally posted mail appears to come from when a domain is not otherwise specified. It can influence the domain appended to local addresses and is commonly derived from other Postfix parameters by default. mydestination has a different purpose: it identifies destinations for which Postfix performs local delivery. mydomain can provide a domain value used by other configuration defaults. Understanding these related parameters helps administrators correctly configure local mail identity and distinguish sender-domain behavior from local delivery destinations.

Question 308. Which Dovecot protocol commonly allows users to download messages from a mailbox and optionally remove them from the server?

1. LMTP
2. IMAP
3. SMTP
4. POP3

Correct Answer: 4. POP3

Explanation :-

POP3 is a mail-access protocol designed primarily for retrieving messages from a remote mailbox. Depending on the client configuration, downloaded messages may be removed from the server after successful retrieval, although clients can also be configured to leave copies on the server. IMAP is more suitable for synchronized mailbox access across multiple devices because it maintains folders, flags, and message state on the server. SMTP is used for message transfer or submission, while LMTP is commonly used for local mail delivery. Dovecot can provide both POP3 and IMAP services to mail clients.

Question 309. Which SSH client option enables verbose diagnostic output useful for troubleshooting connection problems?

1. -v
2. -d
3. -x
4. -V

Correct Answer: 1. -v

Explanation :-

The OpenSSH -v option enables verbose diagnostic output from the SSH client. Increasing verbosity with -vv or -vvv provides progressively more detailed information about connection establishment, key exchange, authentication, and other stages. This is particularly useful when an SSH connection fails and the administrator needs to determine where the process stops. The -V option reports the SSH client version, while other options have unrelated purposes. Verbose logs should be reviewed carefully because they can reveal configuration details, but they are among the most useful first-line diagnostics for SSH connection problems.

Question 310. Which SELinux command displays whether the system is currently enforcing SELinux policy?

1. getenforce
2. getselinux
3. selinuxmode
4. policy-status

Correct Answer: 1. getenforce

Explanation :-

The getenforce command displays the current SELinux enforcement mode. Typical results are Enforcing, Permissive, or Disabled. Enforcing mode actively applies policy decisions, while permissive mode logs violations without enforcing the corresponding access denials. The command is useful for quickly determining whether SELinux is active and enforcing policy during troubleshooting. sestatus provides more detailed information, including policy and configuration data. Administrators should distinguish the current runtime mode from persistent SELinux configuration, because a temporary change made with setenforce does not necessarily change the mode that will be used after reboot.

Question 311. Which nftables statement represents a rule that rejects traffic rather than silently dropping it?

1. accept
2. drop
3. reject
4. deny

Correct Answer: 3. reject

Explanation :-

The nftables reject verdict actively rejects matching traffic, typically generating an appropriate response to the sender depending on the protocol and rule configuration. By contrast, drop discards matching packets without providing a rejection response. accept permits the packet to continue through the relevant processing path. deny is not the standard nftables verdict used for packet rejection. Choosing between reject and drop depends on the firewall’s intended behavior, visibility, and security requirements. Administrators should also consider how rejection behavior affects clients and troubleshooting.

Question 312. Which DNS record maps a domain name directly to an IPv4 address?

1. PTR
2. AAAA
3. A
4. CNAME

Correct Answer: 3. A

Explanation :-

An A record maps a hostname or domain name to an IPv4 address. For example, an A record can associate www.example.com with an IPv4 address such as 192.0.2.10. AAAA records perform the equivalent function for IPv6 addresses. PTR records are used for reverse DNS, while CNAME records create aliases to other hostnames. Administrators can inspect A records with commands such as dig A example.com or simply dig example.com. Correct A-record configuration is fundamental to making IPv4-based web, mail, and other network services reachable by hostname.

Question 313. Which Apache directive can define an additional hostname that should be handled by an existing virtual host?

1. ServerAlias
2. HostAlias
3. VirtualAlias
4. AliasHost

Correct Answer: 1. ServerAlias

Explanation :-

The Apache ServerAlias directive defines additional hostnames that should match an existing virtual host. For example, a virtual host with ServerName example.com could use ServerAlias www.example.com to serve both hostnames using the same configuration. ServerName identifies the primary hostname, while Alias is used for mapping URL paths to file-system locations rather than hostnames. Correct virtual-host configuration is important when a server hosts multiple domains or aliases. Administrators should ensure that DNS records also point the relevant hostnames to the Apache server.

Question 314. Which NFS-related service traditionally provides RPC port mapping for services using dynamically assigned ports?

1. nfsd
2. rpcbind
3. mountd
4. statd

Correct Answer: 2. rpcbind

Explanation :-

The rpcbind service maps RPC program numbers to network ports. Older NFS configurations and other RPC-based services rely on this mechanism because some services may use dynamically assigned ports. Clients can contact rpcbind to discover the port associated with a particular RPC program. NFSv4 reduces reliance on separate RPC services compared with older NFS versions, but understanding rpcbind remains important when administering or troubleshooting NFSv2/v3 environments and other RPC applications. Firewall configurations must account for the relevant services and ports when supporting these protocols.

Question 315. Which Postfix utility is used to create or update indexed database files such as those generated from alias maps?

1. postmap
2. postaliaser
3. postdb
4. postindex

Correct Answer: 1. postmap

Explanation :-

The Postfix postmap utility creates or updates indexed database files from text-based mapping files. It is commonly used with lookup tables such as virtual aliases, transport maps, and other Postfix-supported databases. For example, after modifying a source mapping file, an administrator may run postmap to generate the database that Postfix actually queries. postqueue and postsuper instead manage the mail queue. Correctly rebuilding map databases is important because Postfix may continue using an older database if the generated map is not updated after the source file changes.

Question 316. Which PAM module is commonly used to enforce per-user resource limits such as maximum open files or processes?

1. pam_env
2. pam_access
3. pam_limits
4. pam_resources

Correct Answer: 3. pam_limits

Explanation :-

The pam_limits module applies user resource limits configured through files such as /etc/security/limits.conf and related configuration. These limits can include maximum processes, open files, memory-related resources, and other session constraints depending on the operating system. This mechanism is useful for preventing a single user or service from consuming excessive system resources. pam_access controls access according to configured rules, while pam_env manages environment variables. When troubleshooting unexpected resource restrictions, administrators should check both PAM configuration and the applicable limits for the affected user or group.

Question 317. Which SSH configuration file is commonly used to define server-side OpenSSH daemon settings?

1. /etc/ssh/ssh_config
2. /etc/ssh/sshd_config
3. /etc/sshd/config
4. /etc/ssh/server.conf

Correct Answer: 2. /etc/ssh/sshd_config

Explanation :-

The /etc/ssh/sshd_config file commonly contains server-side configuration for the OpenSSH daemon. Settings such as Port, PermitRootLogin, PasswordAuthentication, and PubkeyAuthentication can be defined there. The /etc/ssh/ssh_config file is instead the system-wide configuration for SSH clients. After modifying sshd_config, administrators should validate the configuration and reload the SSH service so that changes are applied safely. Keeping a working administrative session open during configuration changes can also help prevent accidental loss of remote access if an error is introduced.

Question 318. Which SELinux tool can be used to determine why an access denial was logged?

1. ausearch
2. selinuxlog
3. auditcheck
4. sealertlog

Correct Answer: 1. ausearch

Explanation :-

The ausearch utility can search Linux audit logs for events, including SELinux access-denial records. Administrators can use it to locate AVC denial messages and investigate which process attempted an operation, which file or resource was targeted, and what SELinux context was involved. The auditd subsystem records these events when auditing is enabled. Tools such as sealert may also provide higher-level explanations on systems where they are installed. Reviewing audit information helps administrators distinguish genuine policy problems from Unix permission, ownership, application, or configuration issues.

Question 319. Which DNS query type is commonly used to retrieve the SOA record for a zone?

1. AUTH
2. ZONE
3. SOA
4. START

Correct Answer: 3. SOA

Explanation :-

The DNS query type SOA requests the Start of Authority record for a zone. Administrators commonly use commands such as dig SOA example.com to inspect the zone’s primary name server, responsible-party field, serial number, and timing values. The SOA serial is particularly useful when troubleshooting zone transfers because secondary servers use it to determine whether their copy is current. DNS does not use generic query types such as AUTH or ZONE for this purpose. Regularly checking SOA information can help identify synchronization and delegation problems.

Question 320. Which Linux command displays the neighbor table used for address-to-link-layer mappings?

1. ip route
2. ip neigh
3. ip arp-table
4. ip link-neighbor

Correct Answer: 2. ip neigh

Explanation :-

The ip neigh command displays and manages the Linux neighbor table, which contains mappings between network-layer addresses and link-layer addresses. For IPv4, this information corresponds closely to traditional ARP functionality; IPv6 uses Neighbor Discovery. The table can show states such as reachable, stale, delayed, or failed. Administrators can use ip neigh when troubleshooting local-network communication, duplicate addresses, or incomplete address resolution. ip route instead displays routing information, while ip link provides interface and link-state information.