I85PREP
⌘ K
LPIC-2 202-450 study materials
LPIC-2 202-450 study resources

LPIC-2 202-450 practice questions

One question at a time. Build your LPIC-2 202-450 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Domain Name Server

In a BIND zone file, which directive sets the default domain name that is appended to unqualified names such as 'www'?

  1. $GENERATE
  2. $TTL
  3. $INCLUDE
  4. $ORIGIN Correct answer.

Explanation

The $ORIGIN directive defines the domain name that relative names in the zone are completed against, so a record written as 'www' becomes www.origin. $TTL only sets default time-to-live values and does not affect name completion.

Question 2Domain Name Server

A zone file contains the record 'mail IN A 192.0.2.10'. What is the fully qualified name of this record when the zone origin is example.com?

  1. mail.
  2. 192.0.2.10.example.com.
  3. mail.example.com. Correct answer.
  4. example.com.mail.

Explanation

A relative owner name is concatenated with the current origin, so 'mail' inside example.com yields mail.example.com. The trailing dot marks the name as fully qualified; without it the name is always completed with the origin.

Question 3Domain Name Server

Which resource record type maps a domain name to an IPv6 address?

  1. A
  2. PTR
  3. AAAA Correct answer.
  4. CNAME

Explanation

The AAAA record holds a 128-bit IPv6 address for a name, while the A record holds a 32-bit IPv4 address. PTR is used for reverse lookups and CNAME creates an alias to another name.

Question 4Domain Name Server

Which record type is used in a reverse zone to map an IP address to a hostname?

  1. NS
  2. PTR Correct answer.
  3. SRV
  4. MX

Explanation

Reverse zones under in-addr.arpa or ip6.arpa use PTR records to resolve an address to a canonical hostname. MX designates mail exchangers and NS delegates a zone to authoritative servers.

Question 5Domain Name Server

Which file is read by BIND to determine which zones the server is authoritative for?

  1. /etc/resolv.conf
  2. /etc/bind/named.conf.local Correct answer.
  3. /etc/hosts
  4. /etc/nsswitch.conf

Explanation

BIND's configuration, typically including named.conf.local on Debian-based systems, declares each zone and its zone file. The resolver configuration and host files play no part in defining authoritative zones.

Question 6Domain Name Server

What does the SOA record's serial number allow secondary servers to detect?

  1. That the zone data has changed and a transfer is needed Correct answer.
  2. That the zone uses a wildcard entry
  3. That the primary server is reachable
  4. That the zone is signed with DNSSEC

Explanation

Secondary servers compare the SOA serial from the primary with their stored copy; a higher serial triggers a zone transfer. The serial is a version indicator and does not signal reachability or signing status.

Question 7Domain Name Server

Which command sends a DNS query for the MX records of example.com to the server at 192.0.2.53 using the BIND utilities?

  1. dig @192.0.2.53 example.com MX Correct answer.
  2. host -t MX 192.0.2.53 example.com
  3. nslookup 192.0.2.53 MX example.com
  4. dig -x 192.0.2.53 example.com MX

Explanation

In dig the @ prefix selects the server to query and the type argument selects the record type, so '@192.0.2.53 example.com MX' returns the MX set. The other forms misuse the reverse-lookup or host/nslookup argument order.

Question 8Domain Name Server

Which statement describes the role of the root hints file in BIND?

  1. It defines the zones for which the server is authoritative.
  2. It lists the root name servers used to start iterative resolution. Correct answer.
  3. It maps client addresses to access control lists.
  4. It stores cached answers from previous queries.

Explanation

The root hints file provides the initial set of root server addresses a recursive resolver uses to begin iteration. Authoritative zones, cache contents and ACLs are defined elsewhere in the configuration.

Question 9Domain Name Server

A BIND zone uses 'www IN CNAME web.example.net.' and also has an MX record at the same owner name 'www'. Why is this configuration problematic?

  1. A CNAME must always point to a name inside the same zone.
  2. The MX record must be placed in the parent zone instead.
  3. A CNAME owner cannot have other data, so the MX at the same name is invalid. Correct answer.
  4. CNAME records are not permitted in authoritative zones.

Explanation

DNS forbids any other record type from sharing an owner name with a CNAME, so an MX at the same label makes the zone inconsistent. CNAME targets may point to any domain and CNAMEs are perfectly valid in authoritative zones.

Question 10Domain Name Server

What is the effect of the BIND option 'allow-transfer { none; };' in an options block?

  1. Zone transfers are refused for every zone unless overridden per zone. Correct answer.
  2. Transfers are allowed only from localhost.
  3. Transfers are allowed only for signed zones.
  4. Transfers are logged but still permitted.

Explanation

allow-transfer controls which clients may receive AXFR or IXFR; setting it to none blocks transfers globally, though a zone-level statement can override it. It does not merely log or restrict by signing state.

Question 11Domain Name Server

Which record type delegates authority for a subdomain to a different set of name servers?

  1. TXT
  2. NS Correct answer.
  3. A
  4. SOA

Explanation

An NS record at the child name points to the servers authoritative for that subdomain, creating a delegation. SOA marks the start of authority within a zone and A and TXT records carry address or text data.

Question 12Domain Name Server

A zone has an SOA serial of 2024010101 and the administrator makes several edits without changing it. What is the likely consequence for secondary servers?

  1. They fall back to recursion for the zone.
  2. They keep serving the old data because no transfer is triggered. Correct answer.
  3. They mark the zone as expired and stop answering.
  4. They immediately fetch the new data on the next query.

Explanation

Secondaries compare serials during the refresh interval and transfer only when the primary serial is greater. Without a serial bump the change is invisible, so stale data persists until the serial is raised.

Question 13Domain Name Server

Which BIND statement restricts which clients may submit recursive queries to the server?

  1. allow-recursion Correct answer.
  2. allow-update
  3. allow-transfer
  4. allow-notify

Explanation

allow-recursion defines the clients permitted to use the resolver for recursive lookups, which is important on internet-facing servers. The other options govern zone transfers, dynamic updates and NOTIFY messages respectively.

Question 14Domain Name Server

What does a DNAME record do in BIND?

  1. It defines the mail exchanger priority.
  2. It redirects an entire subtree to another domain. Correct answer.
  3. It aliases a single owner name like a CNAME.
  4. It stores a delegation key for DNSSEC.

Explanation

DNAME rewrites all names beneath its owner to a new suffix, effectively redirecting a whole subtree. CNAME aliases only one name, and DNSSEC keys and mail priorities use DNSKEY/DS and MX records.

Question 15Domain Name Server

Which command performs a zone transfer of example.com from the server at 192.0.2.53?

  1. dig -x 192.0.2.53 AXFR
  2. dig @192.0.2.53 example.com NS
  3. dig @192.0.2.53 example.com AXFR Correct answer.
  4. host -a example.com 192.0.2.53

Explanation

Requesting the AXFR type with dig against the authoritative server attempts a full zone transfer. Querying NS returns only the delegation data, and -x forces a reverse lookup.

Question 16Domain Name Server

A resolver receives a response with the AA bit clear from a server that was expected to be authoritative. What does this indicate?

  1. The answer came from a non-authoritative source such as a cache. Correct answer.
  2. The response is signed with DNSSEC.
  3. The zone has expired on the primary.
  4. The query used TCP instead of UDP.

Explanation

The authoritative answer flag is set only by a server answering from its own zone data. A cleared AA bit means the data came from a cache or another non-authoritative source, which matters when validating delegation.

Question 17Domain Name Server

Which statement about the $TTL directive and per-record TTL values is correct?

  1. Per-record TTLs are ignored when $TTL is present.
  2. $TTL must appear after every record it affects.
  3. A record-level TTL overrides the $TTL default for that record. Correct answer.
  4. $TTL overrides any TTL written on an individual record.

Explanation

$TTL supplies the default lifetime for records that omit one, while an explicit TTL on a record takes precedence for that record. The directive is normally placed once near the top of the zone.

Question 18Domain Name Server

What is the purpose of the 'also-notify' statement in a BIND zone configuration?

  1. It disables NOTIFY messages for the zone.
  2. It forwards client queries to another resolver.
  3. It sends NOTIFY messages to additional servers beyond the zone NS records. Correct answer.
  4. It adds extra name servers to the delegation.

Explanation

also-notify lists extra addresses that receive NOTIFY when the zone changes, useful for hidden secondaries. It does not alter the NS set published in the zone or forward client queries.

Question 19Domain Name Server

A zone's SOA expire value is 604800 and a secondary cannot reach the primary for 700000 seconds. What happens to the secondary's copy of the zone?

  1. It stops answering authoritatively for the zone. Correct answer.
  2. It converts the zone to a stub.
  3. It promotes itself to primary automatically.
  4. It continues serving the zone indefinitely.

Explanation

When the expire interval elapses without successful refresh, the secondary discards or stops serving the zone to avoid returning stale data. It does not self-promote or silently keep the data forever.

Question 20Domain Name Server

Which combination correctly enables DNSSEC validation on a BIND resolver?

  1. notify explicit; plus also-notify 127.0.0.1
  2. dnssec-validation auto; plus a trust anchor for the root Correct answer.
  3. dnssec-enable no; plus allow-recursion any
  4. zone-statistics yes; plus recursion yes

Explanation

Validation requires the resolver to be enabled with dnssec-validation and to have a configured trust anchor, commonly the built-in root key with 'auto'. Disabling dnssec-enable or changing notification settings does not provide validation.

Question 21Domain Name Server

In a DNSSEC-signed zone, which record type holds the hashed public key that a parent zone publishes for a child?

  1. DNSKEY
  2. NSEC3
  3. RRSIG
  4. DS Correct answer.

Explanation

The parent publishes a DS record containing a digest of the child's key, completing the chain of trust. DNSKEY holds the key itself inside the child zone, RRSIG carries signatures and NSEC3 proves name non-existence.

Question 22Domain Name Server

An administrator wants a BIND server to answer only for its own zones and never perform recursion for external clients. Which setting achieves this?

  1. forward only;
  2. dnssec-validation no;
  3. allow-recursion { any; };
  4. recursion no; Correct answer.

Explanation

Setting recursion no makes the server answer only from its authoritative data and refuse recursive service. Allowing recursion for any client or configuring forwarders would still provide recursive resolution.

Question 23Domain Name Server

A primary and secondary both show different SOA serials after a transfer attempt, and logs report 'transfer of example.com failed: permission denied'. Which cause is most consistent with this message?

  1. The secondary's forwarders list is empty.
  2. The primary's allow-transfer does not include the secondary's address. Correct answer.
  3. The zone file on the primary lacks an MX record.
  4. The secondary's allow-notify is misconfigured.

Explanation

A permission denied result on a transfer points to access control on the primary, typically allow-transfer excluding the secondary. Notify settings affect change announcements, and MX or forwarder configuration is unrelated to AXFR authorisation.

Question 24Domain Name Server

Which record allows a mail domain to publish a policy telling receivers how to handle messages that fail SPF or DKIM checks?

  1. SPF TXT record at the apex
  2. DMARC TXT record at _dmarc Correct answer.
  3. SRV record at _submission
  4. MX record at the apex

Explanation

DMARC policy is published as a TXT record at the _dmarc label, describing alignment and handling for failing mail. SPF records authorise sending hosts, MX records route mail and SRV records locate services.

Question 25Domain Name Server

A zone file entry reads '@ 3600 IN MX 10 mail.example.com.'. What does the '@' symbol represent?

  1. A wildcard label
  2. The current zone origin Correct answer.
  3. The previous owner name
  4. The root name server

Explanation

The at sign is shorthand for the zone origin, so this record is created at example.com when the origin is example.com. A wildcard is written with an asterisk and a blank owner repeats the previous name.

Question 26Domain Name Server

In a BIND zone file, which resource record type is used to publish the list of authoritative name servers for the zone itself?

  1. NS Correct answer.
  2. PTR
  3. SRV
  4. A

Explanation

The NS record identifies the authoritative name servers for a zone and appears at the zone apex, typically one record per server. Resolvers follow these records during delegation to reach the authoritative servers.

Question 27Domain Name Server

Which BIND configuration statement in a zone block causes the server to load a zone from a file on disk rather than only serving it from another server?

  1. masters { 192.0.2.1; };
  2. file "/var/named/db.example.com"; Correct answer.
  3. allow-update { none; };
  4. type slave;

Explanation

The file statement names the on-disk zone file from which BIND reads the zone data. For primary zones this file is the authoritative source of the zone contents.

Question 28Domain Name Server

A resolver queries for www.example.com and receives a response containing a CNAME pointing to web.example.net. What must the resolver do next?

  1. Reject the response because CNAMEs cannot cross domains.
  2. Query the root servers directly for www.example.com.
  3. Accept the CNAME as the final answer and stop.
  4. Issue a new query for web.example.net to obtain its address records. Correct answer.

Explanation

A CNAME is an alias, so the resolver must follow the target name and resolve it to address records. The original query is only satisfied once the canonical name's data is retrieved.

Question 29Domain Name Server

Which zone file record type is used to publish the public key material that lets a validating resolver verify RRSIG signatures for a signed zone?

  1. RRSIG
  2. DS
  3. NSEC3
  4. DNSKEY Correct answer.

Explanation

DNSKEY records hold the zone's public signing keys, which validators use to check RRSIG signatures. The DS record in the parent ties a child's DNSKEY into the chain of trust.

Question 30Domain Name Server

An administrator wants a BIND server to accept dynamic updates only from a specific set of client addresses. Which zone-level statement accomplishes this?

  1. allow-update { 192.0.2.0/24; }; Correct answer.
  2. allow-query { 192.0.2.0/24; };
  3. allow-transfer { 192.0.2.0/24; };
  4. update-policy { 192.0.2.0/24; };

Explanation

The allow-update statement lists the addresses permitted to send dynamic DNS updates to the zone. Address-based update control is the simplest form of update authorization in BIND.

Question 31Domain Name Server

A zone's SOA record has refresh 3600, retry 600, and expire 86400. A secondary has been unable to contact the primary for 90000 seconds. What is the state of the secondary's copy of the zone?

  1. It promotes itself to primary and accepts updates.
  2. It serves the zone but marks all answers as non-authoritative.
  3. It stops answering for the zone because the data has expired. Correct answer.
  4. It continues serving the zone and keeps retrying the primary.

Explanation

Once the expire interval passes without a successful refresh, the secondary must discard its copy and stop answering authoritatively for the zone. This prevents serving stale data indefinitely.

Question 32Domain Name Server

Which command uses the BIND utilities to query the server at 192.0.2.53 for the TXT records of example.com?

  1. host -t TXT example.com 192.0.2.53
  2. dig example.com TXT @192.0.2.53
  3. dig -x 192.0.2.53 example.com TXT
  4. dig @192.0.2.53 example.com TXT Correct answer.

Explanation

In dig the server is specified with @server immediately followed by the name and then the record type. The order @server name type is the documented syntax for directing a query.

Question 33Domain Name Server

A BIND server hosts the zone example.com and an administrator adds a delegating NS record for sub.example.com pointing to a server outside the organization. What must also be added for clients to resolve names in sub.example.com?

  1. A CNAME at sub.example.com pointing to the external server.
  2. Glue A or AAAA records only if the delegated server is inside the delegated subdomain. Correct answer.
  3. An SOA record for sub.example.com in the parent zone file.
  4. A wildcard MX record covering the subdomain.

Explanation

Glue address records are required only when the delegated name servers lie within the delegated subdomain, otherwise resolution would be circular. If the servers are elsewhere, the parent only needs the NS records.

Question 34Domain Name Server

A signed zone's DS record in the parent does not match the DNSKEY currently published by the child. What is the most likely effect on validating resolvers?

  1. They ignore DNSSEC and return the data as insecure.
  2. They treat the child's data as bogus and return SERVFAIL. Correct answer.
  3. They fall back to the parent's cached copy of the child zone.
  4. They accept the data because the child's RRSIG is still valid.

Explanation

Validation requires the DS digest to match a DNSKEY in the child, forming the chain of trust. A mismatch makes the delegation bogus, so validating resolvers return SERVFAIL rather than the data.

Question 35Web Services

In an Apache httpd configuration file, which directive specifies the email address that is displayed on server-generated error pages when the ServerSignature directive is enabled?

  1. ServerRoot
  2. ServerName
  3. ServerAdmin Correct answer.
  4. ServerAlias

Explanation

ServerAdmin sets the contact address that Apache includes in error pages and in some automatically generated documents when ServerSignature is turned on. ServerName only sets the hostname used for self-referential URLs, so it does not affect the contact address shown to clients.

Question 36Web Services

Which Apache module must be loaded for the NameVirtualHost/Listen-based name-based virtual hosting to serve different DocumentRoot directories per Host header?

  1. mod_vhost_alias Correct answer.
  2. mod_alias
  3. mod_rewrite
  4. mod_proxy

Explanation

Name-based virtual hosting itself is handled by core httpd, but dynamically mapping arbitrary Host headers to document roots uses mod_vhost_alias. mod_alias provides Redirect and Alias directives, and mod_rewrite handles URL rewriting rather than mass virtual hosting.

Question 37Web Services

An Apache server uses HTTP Basic authentication with AuthUserFile pointing to a password file. Which command creates the first user entry in that file with the correct hashed format?

  1. htpasswd -n /etc/apache2/.htpasswd alice
  2. htpasswd -D /etc/apache2/.htpasswd alice
  3. htpasswd -c /etc/apache2/.htpasswd alice Correct answer.
  4. htpasswd -b /etc/apache2/.htpasswd alice

Explanation

The -c option tells htpasswd to create a new password file, so it is required when adding the first user. Without -c the command updates an existing file and fails if the file does not yet exist.

Question 38Web Services

Which Apache directive, when placed in a <Directory> block, controls whether the contents of .htaccess files in that directory tree are processed?

  1. Require
  2. AccessFileName
  3. AllowOverride Correct answer.
  4. Options

Explanation

AllowOverride determines which directive categories may appear inside .htaccess files; setting it to None disables .htaccess processing entirely. AccessFileName only changes the filename that is scanned, not whether the file is honored.

Question 39Web Services

A virtual host must redirect every request for the old path /shop to https://example.com/store while preserving the remainder of the path. Which directive in the VirtualHost block accomplishes this?

  1. Alias /shop https://example.com/store
  2. RedirectMatch /shop https://example.com/store
  3. Redirect permanent /shop https://example.com/store Correct answer.
  4. RewriteRule ^/shop https://example.com/store

Explanation

The Redirect directive performs a prefix mapping: the matched path prefix is removed and the remainder is appended to the target URL, so /shop/item becomes https://example.com/store/item. The permanent keyword sends a 301 status, which is appropriate for a lasting move.

Question 40Web Services

Which Apache directive enables the server-status handler, and which module must be present for it to work?

  1. SetOutputFilter server-status with mod_filter loaded
  2. AddHandler server-status with mod_info loaded
  3. SetHandler server-status with mod_status loaded Correct answer.
  4. Action server-status with mod_cgi loaded

Explanation

The status page is produced by the mod_status module and is activated by assigning the server-status handler, typically with SetHandler inside a <Location> block. mod_info produces a separate configuration dump and is not involved.

Question 41Web Services

Which directive in an Apache <VirtualHost> block enables TLS for that host and points to the certificate and key files?

  1. SSLProtocol all together with SSLCipherSuite
  2. Listen 443 together with NameVirtualHost
  3. SSLEngine on together with SSLCertificateFile and SSLCertificateKeyFile Correct answer.
  4. SSLVerifyClient require together with SSLCACertificateFile

Explanation

SSLEngine on activates TLS processing for the virtual host, and SSLCertificateFile and SSLCertificateKeyFile supply the server's certificate and private key. The other SSL directives tune verification or cipher policy but do not by themselves enable TLS.

Question 42Web Services

Which nginx directive defines the document root for a server block?

  1. try_files
  2. location
  3. root Correct answer.
  4. index

Explanation

The root directive sets the base directory against which request URIs are mapped to filesystem paths. The index directive only names the files tried when a directory URI is requested.

Question 43Web Services

In nginx, which directive inside a server block forwards all requests to a FastCGI application such as PHP-FPM?

  1. uwsgi_pass
  2. proxy_pass
  3. scgi_pass
  4. fastcgi_pass Correct answer.

Explanation

fastcgi_pass specifies the address of a FastCGI upstream, which is the protocol used by PHP-FPM. The other *_pass directives speak different protocols and cannot talk to a FastCGI application.

Question 44Web Services

Which nginx directive is used to rewrite a request URI internally based on a regular expression, optionally returning a redirect?

  1. return
  2. if
  3. rewrite Correct answer.
  4. map

Explanation

The rewrite directive matches a regular expression against the URI and performs an internal rewrite or, when given a redirect flag such as permanent, an external redirect. The return directive sends a status code directly and does not perform regex-based URI rewriting.

Question 45Web Services

Which nginx directive configures the location of the access log and is typically placed at the http or server level?

  1. open_log_file_cache
  2. log_format
  3. access_log Correct answer.
  4. error_log

Explanation

access_log specifies the path and optional format of the access log, while error_log controls where error messages are written. log_format only defines the shape of log lines referenced by access_log.

Question 46Web Services

Which nginx directive should be used to serve a static file if it exists and otherwise pass the request to a named location handling PHP?

  1. internal;
  2. error_page 404 @php
  3. location @php { }
  4. try_files $uri $uri/ @php Correct answer.

Explanation

try_files checks each candidate in order and, when none exist, forwards to the final argument, which may be a named location such as @php. This is the standard pattern for front-controller applications.

Question 47Web Services

Which nginx directive enables TLS on a listening socket and which directive supplies the certificate chain?

  1. ssl_session_cache together with ssl_session_timeout
  2. ssl_protocols together with ssl_ciphers
  3. ssl_stapling together with ssl_trusted_certificate
  4. listen 443 ssl together with ssl_certificate Correct answer.

Explanation

TLS is enabled by adding the ssl parameter to the listen directive, and ssl_certificate points to the PEM file containing the server certificate and intermediate chain. The matching ssl_certificate_key directive holds the private key.

Question 48Web Services

Which nginx directive restricts access to a location to specific client IP addresses or networks?

  1. deny
  2. satisfy
  3. allow Correct answer.
  4. auth_basic

Explanation

The allow directive grants access to the listed addresses or CIDR ranges, and it is normally paired with deny all to block everyone else. The deny directive performs the inverse action.

Question 49Web Services

Which Apache directive should be used to pass requests for PHP files to PHP-FPM over a Unix socket when using mod_proxy_fcgi?

  1. SetHandler proxy:unix:/run/php/php-fpm.sock
  2. ProxyPassMatch "^/(.*\.php)$" "unix:/run/php/php-fpm.sock|fcgi://localhost/" Correct answer.
  3. ProxyPass "/" "unix:/run/php/php-fpm.sock"
  4. FastCgiServer /run/php/php-fpm.sock

Explanation

With mod_proxy_fcgi, the fcgi:// scheme must follow the socket path after a pipe character so that mod_proxy knows which protocol to speak. ProxyPassMatch applies the mapping only to URIs matching the regular expression, which is the common way to route PHP requests.

Question 50Web Services

An administrator wants Apache to serve compressed responses for text content when the client sends Accept-Encoding: gzip. Which module and directive combination is correct?

  1. mod_deflate with AddOutputFilterByType DEFLATE text/html Correct answer.
  2. mod_headers with Header set Content-Encoding gzip
  3. mod_expires with ExpiresActive On
  4. mod_mime with AddEncoding gzip .gz

Explanation

mod_deflate provides the DEFLATE output filter, which compresses responses on the fly when the client advertises support. AddOutputFilterByType applies that filter only to the listed MIME types.