LPI 102-500 Bundle

The option would apply to “A user wants to decrypt a GnuPG file received for a different person's key”. This behavior is explained by Encryption to a public key normally requires the corresponding private key for decryption. This question instead requires “TCP wrapper policy applies only when the relevant daemon is linked or configured for it”.

This option serves the scenario “A legacy host consults /etc/hosts.allow but a replacement server uses a modern daemon without wrapper support”. This behavior is explained by TCP wrapper files are not universal network firewalls and many modern services ignore them. The present scenario is distinguished by “TCP wrapper policy applies only when the relevant daemon is linked or configured for it”.

This alternative addresses the separate case “A fresh server boots with an unapproved web service that nobody uses”. The governing principle is Disabling unused network services reduces attack surface beyond firewall-only masking. The deciding requirement here is “TCP wrapper policy applies only when the relevant daemon is linked or configured for it”.

That danger is associated more closely with An application binds to port 8443 but remote users cannot connect and the team blames DNS. Here the primary exposure is Editing external DNS unnecessarily may leak internal-only hostnames.

The stated concern is possible elsewhere, but the facts here specifically imply Editing external DNS unnecessarily may leak internal-only hostnames.

That outcome fits another condition, A server must be assigned a persistent IPv6 address but its only configuration is an ip -6 addr add command, rather than the current one.

This option serves the scenario “A user must authenticate to an SSH host without typing a password for an approved automation task”. The decisive distinction is SSH public-key authentication uses a private client key and authorized server-side public key. The present scenario is distinguished by “Confidentiality and integrity/authenticity are distinct cryptographic goals”.

The option would apply to “An administrator wants to run a remote X11 tool through an encrypted SSH session”. The governing principle is SSH X11 forwarding tunnels GUI application traffic and supplies scoped authentication. This question instead requires “Confidentiality and integrity/authenticity are distinct cryptographic goals”.

The related but distinct situation is “A process consumes too much address space and a shell session needs a temporary limit”. The governing principle is Shell resource limits can constrain selected process resources and are inherited by children. For the stated problem, “Confidentiality and integrity/authenticity are distinct cryptographic goals” addresses the central condition.

The case is most directly exposed to Scanning unintended assets or treating open ports as proof of compromise creates problems; the alternative describes a different operational risk.

The stated concern is possible elsewhere, but the facts here specifically imply Scanning unintended assets or treating open ports as proof of compromise creates problems.

That outcome fits another condition, A legacy host consults /etc/hosts.allow but a replacement server uses a modern daemon without wrapper support, rather than the current one.

That outcome fits another condition, A compliance reviewer needs to prove that a GPG-signed release manifest was not altered, rather than the current one.

The case is most directly exposed to An unrestricted sudo rule gives unnecessary administrative authority; the alternative describes a different operational risk.

It is not the most direct failure mode. The relevant mechanism is sudo can delegate selected privileged commands without granting broad root access, which risks An unrestricted sudo rule gives unnecessary administrative authority.

The alternative fits An administrator needs to see current CUPS printer status, destinations and pending jobs. The reported issue instead calls for Submit it with lp -d printername or an equivalent supported command, as The CUPS client selects a target print destination explicitly.

The alternative fits A CUPS printer queue contains a stuck job and the user needs to cancel just that job. The reported issue instead calls for Submit it with lp -d printername or an equivalent supported command, as The CUPS client selects a target print destination explicitly.

It fails to address the actual requirement, A user wants to print a PDF to a named printer rather than the system default. The needed change is Submit it with lp -d printername or an equivalent supported command; verify The job appears in the intended named queue and not the default printer.

This option serves the scenario “A user sets LC_ALL for a one-off task and then wonders why LC_NUMERIC no longer controls decimals”. The main exposure is Global override can silently defeat individual localization choices. The present scenario is distinguished by “Changing LANG alone does not repair incorrectly encoded file contents”.

That outcome fits another condition, An hourly job is moved from a user crontab into /etc/crontab and fails to execute, rather than the current one.

That outcome fits another condition, A server in Karachi reports UTC on local console but should display local Pakistan time without changing UTC storage, rather than the current one.

The option would apply to “A host cannot reach a DNS server because its IPv4 interface has an incorrect subnet mask”. The appropriate operation is Compare ip addr and ip route data with the intended subnet design. The present scenario is distinguished by “Run traceroute or tracepath and interpret intermediate router responses cautiously”.

It fails to address the actual requirement, A user reports packet loss only toward one remote hop and wants to locate the failing segment. The needed change is Run traceroute or tracepath and interpret intermediate router responses cautiously; verify The path report identifies where responses change without assuming all ICMP silence means failure.

Although that change may be valid elsewhere, it responds to A system has two NetworkManager profiles on one NIC and activates the wrong address after restart, not to this system state. The relevant fix is Run traceroute or tracepath and interpret intermediate router responses cautiously.

That option does not correct the stated dependency. In this case, In a conventional /24 IPv4 subnet the all-zero host part denotes the network; implement Choose a usable host address that is neither the subnet network nor broadcast address and check The interface uses a valid host address and communicates within the subnet.

The related but distinct situation is “In an LPIC-1 102-500 administration task, A test host uses 255.255.255.0 but another host in the same VLAN uses 255.255.0.0”. The appropriate operation is Normalize the intended IPv4 prefixes and verify routing and broadcast behavior. For the stated problem, “Choose a usable host address that is neither the subnet network nor broadcast address” addresses the central condition.

That option does not correct the stated dependency. In this case, In a conventional /24 IPv4 subnet the all-zero host part denotes the network; implement Choose a usable host address that is neither the subnet network nor broadcast address and check The interface uses a valid host address and communicates within the subnet.

The related but distinct situation is “A user wants to decrypt a GnuPG file received for a different person's key”. The appropriate operation is Use the matching authorized private key and confirm its owner can decrypt. The deciding requirement here is “Restrict its listener to loopback or a designated management interface and confirm enforcement”.

Although that change may be valid elsewhere, it responds to A compliance auditor must demonstrate that normal users cannot read /etc/shadow, not to this system state. The relevant fix is Restrict its listener to loopback or a designated management interface and confirm enforcement.

This alternative addresses the separate case “A host still exposes Telnet but policy allows only encrypted remote administration”. The appropriate operation is Disable the legacy Telnet service or socket and enforce approved SSH access. For the stated problem, “Restrict its listener to loopback or a designated management interface and confirm enforcement” addresses the central condition.

The required verification is The mismatch is explained by the local hosts entry and lookup ordering, not a result meant for A security reviewer needs to query a specific DNS server rather than whichever resolver the host currently uses.

This would test another scenario: A test host uses 255.255.255.0 but another host in the same VLAN uses 255.255.0.0. Here the acceptance evidence is The mismatch is explained by the local hosts entry and lookup ordering.

That observation may validate A system using systemd-resolved shows generated /etc/resolv.conf and an administrator edits it persistently, but it does not establish that The mismatch is explained by the local hosts entry and lookup ordering for the current case.