LPIC-2 202-450 study plan
LPIC-2 202-450 · Give each week a clear focus.
8 weeks · About 6 hours per week
Domain Name Server
Install and configure BIND 9 as an authoritative-only server for a lab zone, then verify delegation with dig against a forwarding resolver
Create forward and reverse zone files including SOA, NS, A, AAAA, CNAME, MX, and PTR records, and validate them with named-checkzone
Configure and test a slave zone with a TSIG-protected AXFR/IXFR transfer between two BIND instances
Enable and verify DNSSEC signing of a lab zone using dnssec-keygen and dnssec-signzone, then query with dig +dnssec
Your checkpoint
A working two-server BIND lab (master plus slave) with a signed zone, plus a one-page record of the dig outputs proving delegation, transfer, and DNSSEC validation
Domain Name Server
Configure BIND logging channels and categories, and demonstrate query logging to a dedicated file
Restrict recursion with allow-recursion, allow-query, and view statements so that only the lab subnet gets recursive answers
Set up a caching resolver with root hints and forwarders, and measure cache behavior with dig +stats
Troubleshoot a deliberately broken zone by reading named logs and rndc status, and fix the fault
Your checkpoint
A hardened resolver configuration with split views and query logging, plus a written troubleshooting log listing the injected faults and the evidence used to resolve each one
Web Services
Deploy Apache with multiple name-based virtual hosts and verify each host with curl --resolve
Configure TLS with a self-signed CA, enforce HSTS and a redirect from HTTP to HTTPS, and confirm the cipher and protocol in use
Install and configure nginx as a reverse proxy in front of Apache, forwarding headers correctly
Enable an Apache module for URL rewriting and implement a redirect rule that you then test
Your checkpoint
A dual-server web lab (nginx front end, Apache back end) serving three virtual hosts over HTTPS, documented with the effective config files and curl verification transcripts
Web Services & File Sharing
Configure PHP-FPM with nginx and Apache, and verify script execution and pool isolation per site
Harden both web servers by disabling directory listing, setting security headers, and restricting access to a directory by IP
Install and configure Samba as a standalone file server with two shares, one authenticated and one guest, and test access with smbclient
Join a Samba member server to a Samba AD domain and verify domain user access to a share
Your checkpoint
A web plus Samba host where a domain-authenticated user mounts a share, plus a hardening checklist annotated with the directive that satisfies each item
File Sharing
Configure an NFSv4 export with root_squash and a specific client subnet, mount it persistently, and verify ownership mapping
Export the same tree over SMB and NFS and document the differences in permission and locking behavior
Set up a Samba print share with a CUPS backend and confirm a test job from a client
Use smbstatus, testparm, and exportfs -v to audit the running configuration
Your checkpoint
A shared storage host exporting one directory over both NFSv4 and SMB with correct squashing and access control, plus captured audit output from all three tools
Network Client Management & E-Mail Services
Configure a DHCP server with static reservations and a dynamic pool, and verify lease assignment from a client
Set up PXE boot using DHCP options and TFTP, and confirm a client receives the boot file
Configure an LDAP directory with a base DN, an OU structure, and a test user, then query it with ldapsearch
Install Postfix as an internet site, configure SASL authentication with Dovecot, and send a test message between two local users
Your checkpoint
A single host providing DHCP with PXE plus LDAP and authenticated SMTP, with a client-side transcript showing a lease, a directory lookup, and an authenticated mail delivery
E-Mail Services & System Security
Configure Dovecot IMAP with Maildir and verify retrieval with a mail client or openssl s_client session
Implement SPF, DKIM, and DMARC records for the lab domain and validate DKIM signing with a verification tool
Set up Postfix content filtering through a milter or a simple filter script, and prove a message is filtered
Configure a firewall to permit only the mail, DNS, and web ports needed, and verify with a port scan
Your checkpoint
A mail stack with TLS, DKIM signing, and a filtering rule in place, plus a port-scan report showing only the intended services reachable
System Security
Configure OpenSSH with key-only authentication, a restricted user, and a port forward, then verify each restriction
Set up a certificate-based VPN or a site-to-site tunnel and confirm traffic flows through it
Apply mandatory access control to one service and demonstrate that a policy denial appears in the audit log
Audit the lab hosts with a scanning tool, remediate the top findings, and re-scan to confirm
Your checkpoint
A security baseline report for all lab hosts listing each finding, the remediation applied, and the before-and-after scan evidence
Milestones
Week 2: Can build a signed authoritative zone and a restricted recursive resolver from scratch in under 45 minutes without notes, and explain each directive used
Week 4: Can serve multiple HTTPS virtual hosts behind a reverse proxy and mount a domain-authenticated SMB share, with all configuration validated by the relevant syntax-check tool
Week 6: Can bring up DHCP, LDAP, and authenticated SMTP on one host and demonstrate a full client round trip for each service
Week 8: Can pass a timed 60-question mixed-domain practice set at 80 percent or better, and remediate every missed objective in the lab within the following week