LPI 102-500 Bundle

The option would apply to “A resolver searches external DNS before local /etc/hosts and ignores a deliberate test alias”. The decisive distinction is NSS controls whether files or DNS are consulted first for hostnames. This question instead requires “Hop-tracing tools estimate path behavior using TTL or hop-limit expiration”.

That statement explains another situation: A network engineer uses netstat on a minimal modern Linux host and discovers it is not installed. The current observation instead depends on Hop-tracing tools estimate path behavior using TTL or hop-limit expiration.

This would be the main explanation for A host shows an Ethernet link but no IP connectivity to its local subnet peers. It does not account for A user reports packet loss only toward one remote hop and wants to locate the failing segment.

It is not the most direct failure mode. The relevant mechanism is Binding to the required address limits where a network service can be contacted, which risks Unnecessary public listeners expose sensitive services to outside networks.

That danger is associated more closely with A process consumes too much address space and a shell session needs a temporary limit. Here the primary exposure is Unnecessary public listeners expose sensitive services to outside networks.

This alternative addresses the separate case “A compliance auditor must demonstrate that normal users cannot read /etc/shadow”. The most direct risk is Overly permissive shadow access can expose credentials to ordinary users. For the stated problem, “Unnecessary public listeners expose sensitive services to outside networks” addresses the central condition.

This alternative addresses the separate case “A team must encrypt a confidential file for one specific recipient using GnuPG”. This behavior is explained by Public-key encryption uses the recipient's public key so their private key can decrypt. The deciding requirement here is “Encryption to a public key normally requires the corresponding private key for decryption”.

The option would apply to “A user must authenticate to an SSH host without typing a password for an approved automation task”. The decisive distinction is SSH public-key authentication uses a private client key and authorized server-side public key. This question instead requires “Encryption to a public key normally requires the corresponding private key for decryption”.

This would be the main explanation for A service listens on all network interfaces though only local clients should use it. It does not account for A user wants to decrypt a GnuPG file received for a different person's key.

This alternative addresses the separate case “A host has two default routes and traffic unexpectedly exits the wrong network interface”. The conclusive result is ip route get for the destination reports the approved outgoing interface. For the stated problem, “The corrected interface reports the expected link state and address” addresses the central condition.

The option would apply to “A server must be assigned a persistent IPv6 address but its only configuration is an ip -6 addr add command”. Verify that After reboot the target IPv6 address and default route remain present. The present scenario is distinguished by “The corrected interface reports the expected link state and address”.

This would test another scenario: A technician must check whether the server can connect to a TCP service on port 443. Here the acceptance evidence is The corrected interface reports the expected link state and address.

This would test another scenario: An operator searches for service failures but the journal shows previous boots mixed with today's records. Here the acceptance evidence is The debug output lists only the application logs covered by the new rule.

The related but distinct situation is “A security reviewer wants to investigate only error-priority journal entries for yesterday”. Expect The report contains matching error entries from the requested interval only. For the stated problem, “The debug output lists only the application logs covered by the new rule” addresses the central condition.

This option serves the scenario “An administrator needs to see current CUPS printer status, destinations and pending jobs”. Verify that The status output identifies the stopped printer and affected jobs. The present scenario is distinguished by “The debug output lists only the application logs covered by the new rule”.

The related but distinct situation is “A server is reinstalled and clients receive a changed SSH host-key warning”. The best evidence is The verified fingerprint matches the approved replacement and SSH reconnects safely. The deciding requirement here is “A test session accepts only the verified new fingerprint”.

This alternative addresses the separate case “A user must authenticate to an SSH host without typing a password for an approved automation task”. The conclusive result is A restricted test login succeeds with the approved key and no shared password. For the stated problem, “A test session accepts only the verified new fingerprint” addresses the central condition.

A passing result on that unrelated check cannot certify the present correction; require A test session accepts only the verified new fingerprint.

This option serves the scenario “A host still exposes Telnet but policy allows only encrypted remote administration”. The best evidence is A Telnet connection is refused while authorized SSH continues working. The present scenario is distinguished by “Subsequent authorized SSH connections use the agent while the key remains protected”.

This would test another scenario: A developer wants to revoke an exposed GnuPG certificate and communicate the revocation. Here the acceptance evidence is Subsequent authorized SSH connections use the agent while the key remains protected.

This would test another scenario: An administrator wants to run a remote X11 tool through an encrypted SSH session. Here the acceptance evidence is Subsequent authorized SSH connections use the agent while the key remains protected.

It is not the most direct failure mode. The relevant mechanism is Setting the host identity is separate from resolving that name into an address, which risks A hostname without corresponding resolution may break local services.

The option would apply to “An operator wants file-based host mappings to be consulted before DNS on one Linux host”. The main exposure is A misplaced NSS order can ignore local overrides during troubleshooting. The present scenario is distinguished by “A hostname without corresponding resolution may break local services”.

That danger is associated more closely with A resolver searches external DNS before local /etc/hosts and ignores a deliberate test alias. Here the primary exposure is A hostname without corresponding resolution may break local services.

The required verification is nmcli shows an active authorized Wi-Fi connection after reboot, not a result meant for An application binds to port 8443 but remote users cannot connect and the team blames DNS.

The required verification is nmcli shows an active authorized Wi-Fi connection after reboot, not a result meant for A new static IPv4 connection created with nmcli disappears after reboot because it was not saved correctly.

This would test another scenario: A system has two NetworkManager profiles on one NIC and activates the wrong address after restart. Here the acceptance evidence is nmcli shows an active authorized Wi-Fi connection after reboot.

That danger is associated more closely with A technician assumes the window manager is responsible for authenticating users at the graphical login screen. Here the primary exposure is Installing only an X server can leave an unusable bare graphical session.

That danger is associated more closely with A workstation team wants a lightweight desktop and confuses the desktop environment with its display manager. Here the primary exposure is Installing only an X server can leave an unusable bare graphical session.

The option would apply to “A support engineer expects RDP to be identical to VNC when accessing a Linux desktop remotely”. Leaving the issue can cause Assuming protocol interchangeability can expose insecure ports and break remote access. The present scenario is distinguished by “Installing only an X server can leave an unusable bare graphical session”.

This would be the main explanation for A blind operator needs to navigate desktop controls and receive spoken feedback. It does not account for A user with tremor repeatedly triggers accidental double keystrokes in a Linux desktop.

This alternative addresses the separate case “A user who cannot operate a physical keyboard needs to enter login data with a pointing device”. The decisive distinction is An on-screen keyboard provides a graphical input alternative to physical keys. The deciding requirement here is “Keyboard accessibility controls can filter unintended or rapid repeat keystrokes”.

This would be the main explanation for An employee with low vision cannot read a desktop's default tiny text and icons. It does not account for A user with tremor repeatedly triggers accidental double keystrokes in a Linux desktop.