LPI 202-450 Exam Dumps & Practice Test Questions

Question 1:

After enabling IPv4 packet forwarding on a Linux router, the setting is lost after a reboot. Running echo 1 > /proc/sys/net/ipv4/ip_forward restores forwarding temporarily. 

Which is the best method to make this setting persist across system restarts?

A. Add echo 1 > /proc/sys/net/ipv4/ip_forward to the root user’s login script
B. Add echo 1 > /proc/sys/net/ipv4/ip_forward to any user’s login script
C. Modify /etc/sysctl.conf to set net.ipv4.ip_forward = 1
D. Add net.ipv4.ip_forward = 1 to /etc/rc.local
E. Add ipv4.ip_forward = 1 to /etc/sysconfig/iptables-config

Correct Answer: C

Explanation:

IPv4 packet forwarding is a kernel-level setting controlled by a system parameter. When the command echo 1 > /proc/sys/net/ipv4/ip_forward is executed, it changes the kernel’s runtime configuration, enabling packet forwarding only temporarily. This setting reverts to the default after a system reboot because /proc is a virtual filesystem that resets with each boot.

To make this setting permanent, the correct approach is to update the kernel parameter in the system configuration file /etc/sysctl.conf. Adding the line net.ipv4.ip_forward = 1 in this file instructs the system to apply the forwarding setting automatically during boot through the sysctl mechanism, which loads these parameters when the system starts.

Using login scripts (whether for root or any other user) as suggested in options A and B is unreliable because these scripts run only during user login, typically for interactive sessions. Packet forwarding needs to be active regardless of whether a user is logged in or not, so relying on login scripts won’t ensure persistence.

Option D suggests modifying /etc/rc.local, which was historically used to run commands at the end of the boot process. However, many modern Linux distributions have deprecated or disabled this file, making it an unsuitable place for such configurations.

Option E refers to /etc/sysconfig/iptables-config, a file related to firewall rules, not kernel network parameters. Editing this file will not affect IP forwarding.

In summary, configuring the kernel parameter in /etc/sysctl.conf is the most reliable and standard way to ensure IPv4 forwarding persists after reboot, enabling the Linux router to continue forwarding packets as intended.

Question 2:

In an OpenVPN server setup, the status parameter points to a file used for server monitoring. What types of information are commonly found in this status file? (Choose two)

A. Errors and warnings generated by the OpenVPN daemon
B. Routing information
C. Statistics related to the currently running OpenVPN daemon
D. A list of currently connected clients
E. A historical record of all clients who have ever connected

Correct Answers: C and D

Explanation:

The status file specified by the OpenVPN status directive is a vital resource for administrators to monitor the server’s real-time operation. This file is periodically updated by the OpenVPN daemon and provides a snapshot of current VPN activity.

One of the key contents of this status file is a list of currently connected clients. For each client, the status file typically includes details such as the client’s common name, the virtual IP assigned by the VPN server, the client’s real IP address, and connection timestamps. This live client list allows administrators to track active VPN sessions, verify authorized access, and troubleshoot connectivity issues.

In addition to client listings, the status file also contains statistical information about these connections. Metrics such as bytes sent and received per client, connection duration, and data throughput help admins monitor bandwidth usage, detect anomalies, and ensure optimal VPN performance.

It’s important to note what the status file does not contain. Option A is incorrect because errors and warnings are logged separately in dedicated log files, specified by the log or log-append parameters. These log files capture system-level messages, errors, and diagnostic information.

Option B is incorrect since routing information is managed internally by OpenVPN and the operating system; it is not included in the status file. To view routing details, system commands like ip route or route should be used.

Option E is also incorrect because the status file only reflects current active sessions and does not maintain historical records of past connections. If a historical client connection record is needed, admins must rely on log files or implement external monitoring and auditing solutions.

In essence, the OpenVPN status file is designed as a live snapshot of VPN server activity — listing active clients and showing session statistics — which helps administrators maintain operational oversight in real time.

Question 3:

Which two directives in the sshd configuration file should be modified to improve the security of an SSH server?

A. Protocol 2, 1
B. PermitEmptyPasswords no
C. Port 22
D. PermitRootLogin yes
E. IgnoreRhosts yes

Correct Answer: A and D

Explanation:

The sshd_config file governs the behavior of the SSH daemon, which is responsible for managing secure shell connections to a Linux or Unix server. Configurations within this file can drastically affect the security stance of the server, particularly against unauthorized access attempts or exploitation of protocol weaknesses.

Two specific settings from the list stand out as potentially weakening the server’s security:

• Protocol 2, 1: This directive enables support for both SSH Protocol versions 1 and 2. While SSH Protocol 2 is the current standard with strong encryption and enhanced security features, Protocol 1 is deprecated and fraught with vulnerabilities. Protocol 1 lacks important cryptographic protections, including message integrity checks and robust encryption algorithms. Retaining support for Protocol 1 exposes the server to a wide range of attacks, including session hijacking and replay attacks. To secure the server, the directive should be changed to allow only Protocol 2. This ensures all SSH connections use the modern, secure protocol.

• PermitRootLogin yes: This setting allows users to log in directly as the root user via SSH. Although it may simplify administration, it creates a significant security risk because the root account is a highly privileged target for attackers. Allowing root login increases the likelihood of brute-force attacks on the root password. Best practice is to disable direct root login by setting PermitRootLogin no. Instead, administrators should connect using a regular user account and escalate privileges with sudo or similar tools, thus reducing the attack surface.

Other options mentioned provide either no security risk or contribute positively:

• PermitEmptyPasswords no disables logins with empty passwords, which is a secure configuration.

• IgnoreRhosts yes disables legacy .rhosts authentication, which is insecure, so this is a good practice.

• Port 22 is the default SSH port. While changing it may reduce automated scans, it does not inherently improve security as effectively as disabling Protocol 1 or root login.

In summary, disabling Protocol 1 and disallowing direct root logins are critical steps to harden the SSH service against common and high-impact attacks.

Question 4:

Which two nmap options are used to scan a target for open TCP ports?

A. -sO
B. -sZ
C. -sT
D. -sU
E. -sS

Correct Answer: C and E

Explanation:

Nmap (Network Mapper) is a widely used tool for network discovery and security auditing. One of its most common functions is scanning a target system to identify open ports and the services listening on those ports. TCP port scanning is a fundamental technique used to assess which TCP services a host exposes.

Among the scan options listed:

• -sT (TCP Connect Scan): This scan type attempts to complete the full TCP three-way handshake with each port on the target. It’s a straightforward and reliable scanning method because it uses the operating system’s network stack to initiate connections. If the connection is successful, the port is open. However, because it establishes full connections, it’s more easily logged and detected by intrusion detection systems (IDS).

• -sS (TCP SYN Scan): Known as a "half-open" scan, this method sends SYN packets and waits for responses without completing the full TCP handshake. If the target responds with SYN-ACK, the port is open. If it responds with RST, the port is closed. Because it does not complete the connection, it is faster and stealthier, making it a favorite among security professionals during reconnaissance.

Other options:

• -sU: This is used for scanning UDP ports, not TCP. UDP scanning is generally slower and less reliable due to the nature of the protocol.

• -sO: This option scans IP protocols rather than TCP or UDP ports. It is used to identify which IP protocols (ICMP, TCP, UDP, etc.) a host supports.

• -sZ: This is not a valid nmap option and likely a typo or confusion.

Therefore, only -sT and -sS are the correct nmap parameters for scanning open TCP ports.

Question 5:

Which directive in an OpenVPN client configuration file instructs the client to use a dynamically assigned local source port when connecting to a VPN server?

A. src-port
B. remote
C. source-port
D. nobind
E. dynamic-bind

Correct Answer: D

Explanation:

OpenVPN is a flexible and widely used VPN solution that allows clients to establish secure connections to VPN servers. One important aspect of client configuration is how it handles the assignment of local ports for outgoing connections.

The nobind option in an OpenVPN client configuration file tells the client not to bind to a specific local port when initiating the VPN connection. Instead of requesting a fixed source port, the operating system dynamically assigns an ephemeral port from the available pool at runtime. This dynamic port allocation helps avoid port conflicts and enhances compatibility, especially in complex network environments.

Using nobind is particularly useful in cases where multiple VPN clients operate on the same machine or when the client is behind a NAT (Network Address Translation) device. In these situations, allowing the system to assign a free port prevents connection failures caused by port collisions or firewall restrictions.

To clarify why the other options are incorrect:

• A. src-port: This is not a valid OpenVPN configuration directive. Although it suggests controlling the source port, OpenVPN does not recognize this keyword, so including it would cause errors or be ignored.

• B. remote: This option specifies the VPN server’s hostname or IP address and the destination port but does not influence the client’s source port assignment.
  C. source-port: Similar to src-port, this is not a recognized OpenVPN directive and thus does not affect the client’s source port behavior.

• E. dynamic-bind: This option does not exist in OpenVPN’s syntax. While the name might imply dynamic port assignment, OpenVPN’s correct keyword for this functionality is nobind.

Without nobind, OpenVPN tries to bind to the port specified (or default 1194 UDP if unspecified), and if that port is unavailable or blocked by a firewall, the connection will fail.

In summary, nobind is essential for enabling OpenVPN clients to request a dynamic source port from the operating system. This setting increases reliability and flexibility, particularly in multi-client environments or those behind NAT. It’s considered best practice in many client configurations for stable and conflict-free VPN connections.

Question 6:

Which Linux user account does vsftpd use to perform file system actions on behalf of anonymous FTP clients?

A. The Linux user running the vsftpd daemon
B. The Linux user owning the FTP root directory
C. The Linux user matching the anonymous FTP login username
D. The root user, with access limited to globally readable/writable files
E. The Linux user specified by the ftp_username configuration directive

Correct Answer: E

Explanation:

vsftpd (Very Secure FTP Daemon) is a popular and secure FTP server for Linux and Unix-like systems. It supports anonymous FTP access, where users can connect without a personal account, usually logging in with usernames like anonymous or ftp.

When anonymous FTP users interact with files on the server, vsftpd must perform file system operations such as reading or writing files on their behalf. To maintain security, these operations are executed under a specific Linux user account with restricted privileges to minimize risks.

The correct Linux user for these operations is specified by the ftp_username directive in the vsftpd configuration file (usually /etc/vsftpd.conf). This directive designates a non-privileged system user—commonly ftp or nobody—under which anonymous FTP file operations are performed. This separation ensures that anonymous users cannot execute commands or access files beyond what the system user permissions allow.

Why the other options are incorrect:

• A. The Linux user running the vsftpd daemon: vsftpd typically runs as root to bind to privileged ports initially but drops privileges when handling connections. Running file operations as root would expose the system to serious security vulnerabilities.

• B. The Linux user owning the FTP root directory: Ownership of the FTP root directory is important for permissions but does not determine which user vsftpd runs as for file operations.

• C. The Linux user matching the anonymous FTP login: Anonymous logins don’t map to actual system users; the login username (anonymous) is just a convention. vsftpd uses the ftp_username system user instead.

• D. The root user: Using root for anonymous FTP file operations is extremely dangerous and avoided to prevent unauthorized system access.

In practice, using a dedicated non-privileged user defined by ftp_username confines the FTP server’s file system access, reducing the attack surface and protecting system integrity. If an attacker exploits anonymous FTP access, their capabilities remain limited by the minimal privileges of this dedicated user.

Therefore, the ftp_username configuration is a key security feature of vsftpd that ensures anonymous FTP sessions run safely under a constrained Linux user account, balancing functionality with strong security controls.

Question 7:

Which two settings in the sshd configuration file must be disabled (set to no) to completely turn off password-based SSH logins?

A. PAMAuthentication
B. ChallengeResponseAuthentication
C. PermitPlaintextLogin
D. UsePasswords
E. PasswordAuthentication

Correct Answers: B and E

Explanation:

Disabling password-based authentication in SSH is a vital security practice, especially for servers hosting sensitive data. By disallowing password logins, organizations ensure that users can only access servers through more secure methods like SSH key-based authentication. This significantly reduces the risk of unauthorized access via brute-force attacks or stolen passwords.

The two crucial sshd_config options to disable password authentication are ChallengeResponseAuthentication and PasswordAuthentication.

1. PasswordAuthentication controls whether SSH allows login attempts using passwords. When this option is set to no, the SSH server rejects all attempts to authenticate using passwords. This forces users to use alternative methods, typically public/private key pairs, making it one of the most straightforward ways to disable password logins.
   
   

2. ChallengeResponseAuthentication governs whether SSH supports challenge-response authentication mechanisms, which often include password prompts or one-time passwords (OTPs). Some challenge-response methods still rely on passwords indirectly. Disabling this option ensures that interactive password prompts are also disabled, tightening security further.

Why the other options don’t apply:

• PAMAuthentication (Pluggable Authentication Modules) is a framework that supports multiple authentication methods, including passwords. However, disabling PAM is not the most direct way to disable passwords in SSH, and it might interfere with other authentication processes unrelated to password use.

• PermitPlaintextLogin is not a valid or recognized directive in the standard OpenSSH sshd_config file, so this option is irrelevant.

• UsePasswords is also not a valid sshd_config option and appears to be a mistaken or non-existent directive.

In summary, fully disabling password-based SSH logins requires explicitly setting both PasswordAuthentication and ChallengeResponseAuthentication to no. This combination ensures that no password-based authentication is accepted, effectively mandating more secure authentication methods such as SSH keys.

Question 8:

If the default policy for the netfilter INPUT chain is set to DROP, why is it necessary to add a rule that permits traffic to the localhost interface?

A. All traffic destined for localhost must be allowed at all times
B. netfilter never processes packets sent to localhost
C. Some programs rely on the localhost interface to exchange information
D. syslogd receives messages over the localhost interface
E. iptables uses localhost to communicate with the netfilter management daemon

Correct Answer: C

Explanation:

In Linux firewalls managed by iptables (which uses the netfilter framework), the default policies define how packets are treated if no explicit rule matches them. Setting the INPUT chain policy to DROP means that any incoming packet that does not match an allow rule will be discarded by default. This approach is highly secure but requires careful exception rules.

One critical exception is traffic to the localhost interface (127.0.0.1 for IPv4 or ::1 for IPv6). The localhost interface is a special network interface used by applications on the same machine to communicate with each other. Unlike external network traffic, localhost communication happens entirely within the kernel, without using physical network devices.

If the firewall drops all packets by default and no rule explicitly permits traffic to localhost, communication between local processes using the network stack will fail. This can break many system functionalities.

Why is option C correct?

Many services and applications depend on the localhost interface to exchange data or coordinate processes. For example:

• A web server might connect to a local database through localhost.

• Inter-process communication (IPC) often uses the localhost network interface.

• Daemons and system components may use localhost to send and receive control messages.

Without allowing localhost traffic explicitly, all these internal communications would be blocked by the firewall, causing application failures even though the traffic never leaves the machine.

Why are the other options incorrect?

• A is not entirely true; while allowing localhost is usually necessary, it is not an absolute mandate in every context. The need depends on the default DROP policy blocking all other traffic unless permitted.

• B is a common misconception. netfilter does filter localhost traffic. Unless explicitly allowed, localhost packets will be dropped if the policy is DROP.

• D mentions syslogd, which may use localhost, but this is only a subset of the broader requirement for all applications using localhost.

• E is inaccurate. The iptables command does not communicate with a netfilter daemon via localhost. It directly interfaces with the kernel's netfilter subsystem through system calls.

In conclusion, when the INPUT chain policy is set to DROP, you must explicitly allow traffic to localhost to ensure that essential internal communications between processes on the same system continue uninterrupted. This makes Option C the best and most practical choice.

Question 9:

Which of the following best describes the role of Infrastructure as Code (IaC) in a DevOps environment?

A. Manually configuring servers to optimize application deployment.
B. Using code to automate provisioning and management of infrastructure resources.
C. Writing application code that includes infrastructure setup instructions.
D. Monitoring application logs for infrastructure issues.

Correct Answer: B

Explanation:

Infrastructure as Code (IaC) is a foundational practice in modern DevOps that allows teams to automate and manage infrastructure through machine-readable configuration files rather than manual processes. This automation enables consistent and repeatable provisioning of resources, which is critical for scalability, reliability, and fast deployments.

Option B correctly captures the essence of IaC — using code (typically in declarative formats like YAML, JSON, or domain-specific languages such as HashiCorp Configuration Language) to define infrastructure components such as servers, networks, storage, and load balancers. Tools like Terraform, Ansible, and AWS CloudFormation facilitate this approach by reading these configurations and orchestrating the deployment accordingly.

Manual configuration (Option A) contradicts the automation principle of IaC, which aims to eliminate manual errors and inconsistencies. Option C is misleading because while application code can include some environment setup scripts, IaC specifically refers to dedicated configuration management for infrastructure separate from application logic. Option D refers to monitoring, which is important but unrelated to provisioning or managing infrastructure via code.

By embracing IaC, teams can apply version control, peer review, and continuous integration practices to infrastructure changes just like application code. This accelerates deployment cycles, improves collaboration, and enables quick recovery through version rollback if needed. It also supports infrastructure scalability and standardization, both essential in complex, cloud-based environments.

In summary, IaC is about treating infrastructure like software — codifying configurations so that infrastructure is automatically created, updated, and maintained in a consistent and controlled manner. This aligns with DevOps goals of accelerating delivery and increasing system reliability.

Question 10:

In a Continuous Integration/Continuous Deployment (CI/CD) pipeline, what is the primary purpose of automated testing?

A. To manually verify new feature functionality before deployment.
B. To automatically detect bugs and regressions before code reaches production.
C. To automate infrastructure provisioning.
D. To monitor production system health.

Correct Answer: B

Explanation:

Automated testing is a critical component of CI/CD pipelines in DevOps, designed to ensure software quality and stability by automatically validating code changes before they are merged and deployed.

Option B accurately describes the goal: detecting bugs, regressions, and unintended side effects early in the development cycle to prevent faulty code from reaching production. Automated tests may include unit tests, integration tests, functional tests, and sometimes performance or security tests. These are run every time new code is committed, providing immediate feedback to developers.

Manual verification (Option A) is not the focus of automated testing; manual testing may still be performed but is slower and less scalable. Infrastructure provisioning (Option C) is handled separately, typically by IaC tools, not automated testing in a CI/CD pipeline. Monitoring production (Option D) is a post-deployment activity, not part of automated testing in the pipeline.

By automating tests, teams can rapidly iterate with confidence, reduce human error, and maintain high code quality despite frequent deployments. This aligns with DevOps principles of continuous feedback and improvement.

In conclusion, automated testing in CI/CD is a gatekeeper that helps catch issues early, maintain application stability, and accelerate delivery cycles — all key goals for a DevOps Tools Engineer as tested in the LPI 202-450 exam.