LPI 102-500 Bundle

The option would apply to “A compliance auditor must demonstrate that normal users cannot read /etc/shadow”. The most direct risk is Overly permissive shadow access can expose credentials to ordinary users. This question instead requires “Deleting pathnames without checking open handles can fail to reclaim disk space”.

That danger is associated more closely with A Linux security review needs to find root-owned files with the SUID bit set. Here the primary exposure is Deleting pathnames without checking open handles can fail to reclaim disk space.

That outcome fits another condition, A process consumes too much address space and a shell session needs a temporary limit, rather than the current one.

This option serves the scenario “An incident report shows Linux time jumping after daylight saving changes when hardware clock is kept in local time”. The relevant Linux mechanism is A UTC RTC removes local daylight-saving ambiguity during system startup. This question instead requires “Keeping the RTC in UTC avoids daylight-saving and timezone ambiguity on Linux hosts”.

The proposed principle does not identify the crucial dependency in this case: Keeping the RTC in UTC avoids daylight-saving and timezone ambiguity on Linux hosts.

The option would apply to “A script requires a fixed global time reference and must not depend on the user's configured TZ”. The relevant Linux mechanism is The timezone environment selects local display; UTC output avoids location assumptions. The present scenario is distinguished by “Keeping the RTC in UTC avoids daylight-saving and timezone ambiguity on Linux hosts”.

The required verification is The function becomes callable immediately after source ~/.bashrc in that shell, not a result meant for A monitoring script uses exit 0 after detecting a failed prerequisite and is treated as successful by automation.

This alternative addresses the separate case “A user appends a directory to ~/.bashrc but a fresh login shell still has a different environment”. Expect Controlled login and interactive tests show the required PATH in both intended contexts. The deciding requirement here is “The function becomes callable immediately after source ~/.bashrc in that shell”.

The related but distinct situation is “A shell script prints an updated working directory but the parent terminal remains unchanged”. The best evidence is pwd in the invoking terminal reports the intended directory after sourcing. For the stated problem, “The function becomes callable immediately after source ~/.bashrc in that shell” addresses the central condition.

It fails to address the actual requirement, An engineer updates a NetworkManager connection but only the stored profile changes. The needed change is Activate or reapply the profile to the affected device using supported nmcli actions; verify nmcli device show and ip addr reflect the updated parameters.

The alternative fits A user can reach a web service by IP but not by hostname and suspects DNS. The reported issue instead calls for Activate or reapply the profile to the affected device using supported nmcli actions, as Editing a profile is separate from applying changes to a currently active interface.

The alternative fits A laptop must join a secured Wi-Fi network via NetworkManager from the command line. The reported issue instead calls for Activate or reapply the profile to the affected device using supported nmcli actions, as Editing a profile is separate from applying changes to a currently active interface.

The option would apply to “A GUI tool works under a user's desktop but fails when launched from a root shell without DISPLAY”. Acceptance requires The program renders only in the approved user's display session. This question instead requires “A session inspection identifies the active protocol and the GUI launches compatibly”.

This would test another scenario: A support engineer expects RDP to be identical to VNC when accessing a Linux desktop remotely. Here the acceptance evidence is A session inspection identifies the active protocol and the GUI launches compatibly.

This would test another scenario: A graphical login service can authenticate users but the desktop session never starts after an Xorg keyboard edit. Here the acceptance evidence is A session inspection identifies the active protocol and the GUI launches compatibly.

That statement explains another situation: A user account is deleted but its running processes and file ownership remain on shared storage. The current observation instead depends on Special-purpose service accounts need not permit general human logins.

This alternative addresses the separate case “An automated task must run at system startup even if no user logs into a shell”. Here, System services are managed by the init system independent of interactive logins. For the stated problem, “Special-purpose service accounts need not permit general human logins” addresses the central condition.

The option would apply to “A Linux host uses directory-based account resolution and /etc/passwd does not list a known user”. The relevant Linux mechanism is Name service switch resolution can include accounts not stored in local passwd files. The present scenario is distinguished by “Special-purpose service accounts need not permit general human logins”.

This alternative addresses the separate case “A DHCP-enabled workstation needs to switch to a managed static IPv4 address”. The most direct risk is Leaving automatic DHCP enabled can override manually intended values. The deciding requirement here is “Uncontrolled default-route selection can bypass intended egress filtering”.

It is not the most direct failure mode. The relevant mechanism is Where routes have comparable prefix length, route metrics and policy can influence selection, which risks Uncontrolled default-route selection can bypass intended egress filtering.

The related but distinct situation is “A network engineer uses netstat on a minimal modern Linux host and discovers it is not installed”. Leaving the issue can cause Depending on absent net-tools can delay routine incident investigation. For the stated problem, “Uncontrolled default-route selection can bypass intended egress filtering” addresses the central condition.

This alternative addresses the separate case “In an LPIC-1 102-500 administration task, A test host uses 255.255.255.0 but another host in the same VLAN uses 255.255.0.0”. The appropriate operation is Normalize the intended IPv4 prefixes and verify routing and broadcast behavior. For the stated problem, “Compare ip addr and ip route data with the intended subnet design” addresses the central condition.

The alternative fits An IPv6-only server uses ping for an IPv4 literal and mistakenly reports IPv6 routing is broken. The reported issue instead calls for Compare ip addr and ip route data with the intended subnet design, as Incorrect prefix length changes what the kernel considers directly connected.

This option serves the scenario “A Linux host can ping its gateway but cannot reach the Internet because no default route exists”. The appropriate operation is Inspect ip route and add the correct default route through the authorized gateway. This question instead requires “Compare ip addr and ip route data with the intended subnet design”.

That observation may validate An application binds to port 8443 but remote users cannot connect and the team blames DNS, but it does not establish that ip route get for a public destination shows the proper gateway and traffic succeeds for the current case.

The related but distinct situation is “An IPv6 interface displays an fe80:: address and an operator expects Internet-wide routing”. Acceptance requires The host communicates on-link with fe80:: and uses a correct separate route for off-link targets. For the stated problem, “ip route get for a public destination shows the proper gateway and traffic succeeds” addresses the central condition.

This alternative addresses the separate case “A host's network route mistakenly directs local office traffic through its Internet gateway”. Acceptance requires ip route get for the office subnet selects the intended internal next hop. The deciding requirement here is “ip route get for a public destination shows the proper gateway and traffic succeeds”.

That danger is associated more closely with A user must authenticate to an SSH host without typing a password for an approved automation task. Here the primary exposure is Directly exposing the remote X server increases desktop attack surface.

It is not the most direct failure mode. The relevant mechanism is SSH X11 forwarding tunnels GUI application traffic and supplies scoped authentication, which risks Directly exposing the remote X server increases desktop attack surface.

The stated concern is possible elsewhere, but the facts here specifically imply Directly exposing the remote X server increases desktop attack surface.

It fails to address the actual requirement, An engineer must distinguish a globally routable IPv4 address from RFC1918 private space. The needed change is Recognize 10/8, 172.16/12 and 192.168/16 as private IPv4 ranges; verify Address-classification tests flag private addresses and a documented public address correctly.

It fails to address the actual requirement, An engineer must distinguish a globally routable IPv4 address from RFC1918 private space. The needed change is Recognize 10/8, 172.16/12 and 192.168/16 as private IPv4 ranges; verify Address-classification tests flag private addresses and a documented public address correctly.

It fails to address the actual requirement, An engineer must distinguish a globally routable IPv4 address from RFC1918 private space. The needed change is Recognize 10/8, 172.16/12 and 192.168/16 as private IPv4 ranges; verify Address-classification tests flag private addresses and a documented public address correctly.