LPIC-2: Linux Engineer Practice Exam

What the LPIC-2 exam covers

• 201: Capacity Planning167 questions
• 201: Linux Kernel297 questions
• 201: System Startup180 questions
• 201: Filesystems and Storage232 questions
• 201: Networking Configuration185 questions
• 201: System Maintenance47 questions
• 202: DNS115 questions
• 202: Web Services90 questions
• 202: File Sharing58 questions
• 202: Network Client Management24 questions
• 202: E-Mail Services17 questions
• 202: System Security54 questions

Free LPIC-2 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 1,466.

1. Question 1201: Linux Kernel

   Which command displays kernel ring buffer messages (e.g., hardware/boot/driver events)?

   • Auseradd
   • Bchmod
   • Cping
   • DdmesgCorrect
   ✓ Correct answer: D

   The kernel writes diagnostic messages about hardware probing, driver initialization, and boot events into an in-memory ring buffer; dmesg reads and prints that buffer, optionally with -T for human-readable timestamps or -w to follow new entries, making it the first stop for hardware and driver troubleshooting.

   Why the other options are wrong

   • Auseradd creates user accounts and modifies /etc/passwd; it has nothing to do with kernel messages.
   • Bchmod changes file permission bits and does not read kernel logs.
   • Cping sends ICMP echo requests to test connectivity, not to display kernel events.
2. Question 2201: Linux Kernel

   A static file download server is CPU-idle but saturating its network sending large files. Which service-design optimization helps most?

   • ASwitch the server to a fork-per-request model to use more processes
   • BDisable keepalive to open a new connection per file
   • CEnable sendfile/zero-copy and tune output buffers so the kernel streams files without extra user-space copyingCorrect
   • DMove the document root onto a tmpfs limited to available RAM
   ✓ Correct answer: C

   A CPU-idle server saturating its NIC while sending large files benefits from the sendfile() system call, which lets the kernel stream file data straight from the page cache to the socket without copying it through user space. Combined with tuned output buffers this zero-copy path lowers CPU overhead and context switches, letting the server push bytes to the network as fast as the link allows.

   Why the other options are wrong

   • AA fork-per-request model adds process overhead and does not reduce the network-copy cost.
   • BDisabling keepalive adds connection setup overhead rather than speeding large-file sends.
   • Dtmpfs speeds reads but does not address the user-space copying bottleneck on the wire.
3. Question 3202: Web Services

   Which Apache directive enables HTTP Strict Transport Security to force browsers to use HTTPS?

   • ASSLProtocol all -SSLv3 -TLSv1
   • BHeader set X-Frame-Options DENY
   • Cheader always set Strict-Transport-Security "max-age=31536000"Correct
   • DHeader set Content-Security-Policy "default-src 'self'"
   ✓ Correct answer: C

   HTTP Strict Transport Security is delivered via the Strict-Transport-Security response header, which Apache sets using mod_headers with the Header directive. Adding it with the 'always' condition ensures the header is sent on all responses, instructing browsers to use HTTPS for the configured max-age period.

   Why the other options are wrong

   • ASSLProtocol restricts which TLS versions are offered but does not emit the HSTS response header browsers require.
   • BX-Frame-Options controls framing/clickjacking protection, not enforcement of HTTPS via HSTS.
   • DContent-Security-Policy governs resource loading sources and does not force browsers onto HTTPS.
4. Question 4201: Networking ConfigurationSelect all that apply

   On a host where the legacy net-tools netstat command is deprecated, which TWO ss commands provide equivalent throughput- and connection-load information from the iproute2 suite? (Choose TWO)

   • Ass -s to obtain a summary of socket counts by protocol and TCP stateCorrect
   • Bss -tunap to list all TCP and UDP sockets with numeric ports and owning processesCorrect
   • Css -K to set the kernel's network throughput limit
   • Dss --bandwidth to print per-interface bits-per-second rates
   ✓ Correct answer: A, B

   ss -s mirrors netstat -s-style aggregate insight by summarizing total sockets and TCP states (estab, timewait, etc.), giving a quick read on connection load. ss -tunap replaces netstat -tunap, listing every TCP (-t) and UDP (-u) socket in all states (-a) with numeric output (-n) and the owning process (-p). These are the standard modern equivalents for examining sockets and connection load.

   Why the other options are wrong

   • Css -K to set the kernel's network throughput limit is incorrect because ss -K is used to forcibly kill/close matching sockets, not to set any throughput limit.
   • Dss --bandwidth to print per-interface bits-per-second rates is incorrect because ss has no --bandwidth option and does not measure interface throughput; tools like nload, sar -n DEV, or iftop do that.
5. Question 5201: Linux Kernel

   You need to load the 'usbcore' module right now and pass it the integer parameter 'autosuspend=2' for this single load, without writing any configuration file. Which command is correct?

   • Amodprobe usbcore autosuspend=2Correct
   • Bmodprobe usbcore --set autosuspend 2
   • Cmodinfo usbcore autosuspend=2
   • Dsysctl usbcore.autosuspend=2
   ✓ Correct answer: A

   When invoking modprobe, any 'name=value' tokens that follow the module name are passed straight through to the module as load-time parameters. So 'modprobe usbcore autosuspend=2' loads the module with that parameter set for this load only; no file is needed for a one-time setting. The same key=value syntax works with insmod for a single .ko file.

   Why the other options are wrong

   • Bmodprobe usbcore --set autosuspend 2 is incorrect because modprobe has no --set option; parameters are given directly as name=value arguments.
   • Cmodinfo usbcore autosuspend=2 is incorrect because modinfo only reads metadata and cannot load a module or set parameters.
   • Dsysctl usbcore.autosuspend=2 is incorrect because sysctl manipulates kernel tunables exposed under /proc/sys, not loadable-module parameters; module parameters are not sysctl keys.
6. Question 6201: System StartupSelect all that apply

   Which TWO statements correctly describe systemd target units? (Choose TWO)

   • AA target unit groups other units and acts as a synchronization point but contains no process of its ownCorrect
   • Bmulti-user.target is roughly equivalent to the SysVinit runlevel 3Correct
   • CTarget units are stored as executable shell scripts in /etc/rc.d
   • DEach target maps one-to-one to a kernel command-line parameter that cannot be overridden
   ✓ Correct answer: A, B

   A target is a special unit type with no associated executable; it exists purely to pull in and order a set of other units, providing named milestones (like basic.target, multi-user.target, graphical.target) that the boot transaction can synchronize on. systemd ships compatibility aliases so that runlevel3.target is a symlink to multi-user.target, reflecting the traditional runlevel 3 multi-user, non-graphical state. These design points let administrators reason about boot goals much as they did with runlevels.

   Why the other options are wrong

   • CTarget units are stored as executable shell scripts in /etc/rc.d is incorrect because targets are declarative .target unit files under the systemd unit directories, not shell scripts.
   • DEach target maps one-to-one to a kernel command-line parameter that cannot be overridden is incorrect because you can override the boot goal at runtime with 'systemd.unit=' on the kernel line, and most targets have no dedicated kernel parameter.
7. Question 7201: System StartupSelect all that apply

   When defining a systemd .mount unit by hand, which TWO directives in the [Mount] section are mandatory for systemd to perform the mount? (Choose TWO)

   • AWhat=Correct
   • BWhere=Correct
   • CTimeoutSec=
   • DOptions=
   ✓ Correct answer: A, B

   The 'What=' directive names the source (device, UUID/LABEL path, or remote share) and 'Where=' names the absolute mount-point directory; systemd requires both to build the mount(8) invocation, and 'Where=' must also match the unit's escaped filename. Without either directive systemd cannot determine what to mount or where, so the unit fails to load. Type and Options are optional because systemd can auto-detect the filesystem type and apply defaults.

   Why the other options are wrong

   • CTimeoutSec= is incorrect because it only adjusts how long systemd waits for the mount to complete; the mount still works using the default timeout if it is omitted.
   • DOptions= is incorrect because mount options are optional and default to sane values; the mount proceeds even when no Options= line is present.
8. Question 8201: Filesystems and Storage

   Which statement most accurately contrasts how Btrfs and ZFS commonly handle data redundancy across multiple disks?

   • ABtrfs implements RAID profiles natively at the chunk level inside a single multi-device filesystem, while ZFS builds redundancy at the vdev level within a poolCorrect
   • BBoth delegate redundancy to a separate mdadm array and merely place a single-device filesystem on top of it
   • CBtrfs assigns a fixed RAID profile per subvolume, whereas ZFS assigns redundancy per dataset within the pool
   • DZFS layers its redundancy on top of an underlying LVM volume group, whereas Btrfs mirrors only via device-mapper
   ✓ Correct answer: A

   Btrfs treats redundancy as a per-chunk profile (raid0/1/10/5/6/dup) chosen separately for data and metadata within one multi-device filesystem, so you can convert profiles online with balance. ZFS instead organizes physical disks into redundant vdevs (mirror or RAID-Z), and a pool stripes its datasets across those vdevs, with the redundancy fixed by how each vdev is constructed. Both are checksumming, copy-on-write filesystems that can self-heal from redundant copies, but their redundancy is expressed at different layers.

   Why the other options are wrong

   • BBoth Btrfs and ZFS provide their own native redundancy and do not require an external mdadm layer to mirror data.
   • CBtrfs RAID profiles apply at the chunk level across the whole filesystem, not fixed per subvolume; ZFS redundancy is set at the vdev, not per dataset.
   • DZFS builds redundancy at the vdev level without needing LVM, and Btrfs mirrors natively at the chunk level rather than via device-mapper.
9. Question 9201: Networking Configuration

   A user reports that a web page loads slowly only sometimes. The administrator wants ping to send probes to 203.0.113.50 with a 0.2-second interval to quickly surface intermittent latency spikes, but this requires elevated privileges. Which option sets that sub-second interval?

   • Aping -i 0.2 203.0.113.50Correct
   • Bping -c 0.2 203.0.113.50
   • Cping -W 0.2 203.0.113.50
   • Dping -t 0.2 203.0.113.50
   ✓ Correct answer: A

   The -i option sets the interval, in seconds, between successive ping probes; specifying a value below 0.2 seconds (and on many systems any sub-second value as an unprivileged user) requires root privileges, which matches the scenario. A 0.2-second interval sends five probes per second, increasing temporal resolution so brief, intermittent latency spikes are far more likely to be observed than with the default one-second interval. This is the correct flag for controlling the spacing between echo requests.

   Why the other options are wrong

   • Bping -c 0.2 203.0.113.50 is incorrect because -c specifies an integer count of packets to send, not an interval, and a fractional value is invalid.
   • Cping -W 0.2 203.0.113.50 is incorrect because -W sets the timeout to wait for a reply, not the interval between probes.
   • Dping -t 0.2 203.0.113.50 is incorrect because -t sets the IP Time To Live (TTL) value, which has nothing to do with probe timing.
10. Question 10202: DNS

    A signed zone must provide authenticated denial of existence in a way that resists zone-walking (enumeration of all names) better than the original NSEC mechanism. Which DNSSEC record type, using hashed owner names, should the administrator configure?

    • ANSEC3Correct
    • BCNAME
    • CDNAME
    • DSPF
    ✓ Correct answer: A

    NSEC3 provides authenticated denial of existence using cryptographically hashed owner names plus an optional salt and iteration count, making zone enumeration far harder than plain NSEC, which exposes the sorted list of names directly. By hashing names it prevents an attacker from chaining NSEC pointers to walk every record; in BIND it is configured via dnssec-policy or the legacy -3 salt option to dnssec-signzone.

    Why the other options are wrong

    • BCNAME is an alias record pointing one name at another and plays no role in authenticated denial of existence.
    • CDNAME redirects an entire subtree of names and is unrelated to proving non-existence under DNSSEC.
    • DSPF (now usually a TXT record) describes authorized mail senders and is not a DNSSEC denial-of-existence mechanism.

Related Linux resources

• LPIC-2 study guideKey concepts
• Linux practice examsAll Linux
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Red Hat Certified System Administrator (RHCSA, EX200-style) practice examRelated
• LPIC-1 practice examRelated
• Linux Foundation Certified System Administrator (LFCS) practice examRelated

LPIC-2 practice exam FAQ