LPI 102-500 Bundle

This option serves the scenario “A privileged application account should not have an ordinary interactive login shell”. The governing principle is Special-purpose service accounts need not permit general human logins. The present scenario is distinguished by “Name service switch resolution can include accounts not stored in local passwd files”.

The proposed principle does not identify the crucial dependency in this case: Name service switch resolution can include accounts not stored in local passwd files.

The related but distinct situation is “A support team needs to inspect one user's groups but /etc/group alone seems to omit the primary group”. This behavior is explained by The primary GID is stored in the passwd record and can be resolved through group databases. For the stated problem, “Name service switch resolution can include accounts not stored in local passwd files” addresses the central condition.

The option would apply to “A user without authorization attempts to create one-time at tasks despite a deny policy”. The safest fitting response is Check /etc/at.allow and /etc/at.deny according to the installed at policy. The present scenario is distinguished by “Set and verify the intended /etc/cron.allow or cron.deny access control”.

That option does not correct the stated dependency. In this case, Cron access files constrain which users can install or manage crontabs; implement Set and verify the intended /etc/cron.allow or cron.deny access control and check The project identity can create a test crontab but the guest identity cannot.

This option serves the scenario “A monthly security scan requires a reminder on the first day at midnight and a separate weekly report”. The appropriate operation is Define two independent cron expressions and verify their time fields. This question instead requires “Set and verify the intended /etc/cron.allow or cron.deny access control”.

The option would apply to “A user must authenticate to an SSH host without typing a password for an approved automation task”. The conclusive result is A restricted test login succeeds with the approved key and no shared password. This question instead requires “The valid signature passes for the unmodified file and fails after a test alteration”.

The related but distinct situation is “A compliance auditor must demonstrate that normal users cannot read /etc/shadow”. The conclusive result is An unprivileged read fails and the authorized account database still operates. For the stated problem, “The valid signature passes for the unmodified file and fails after a test alteration” addresses the central condition.

This option serves the scenario “An SSH server rotates host keys but clients are told to disable strict host checking permanently”. The best evidence is A test session accepts only the verified new fingerprint. The present scenario is distinguished by “The valid signature passes for the unmodified file and fails after a test alteration”.

The related but distinct situation is “A server permits interactive authentication for accounts during scheduled emergency lockout”. Here, The nologin file can prevent ordinary nonroot logins depending on the login service. The deciding requirement here is “xinetd can start daemons on demand through its own configuration”.

The alternative can apply elsewhere, but xinetd can start daemons on demand through its own configuration is the governing fact here; test by checking The legacy listener no longer accepts connections after the approved change.

This alternative addresses the separate case “A network daemon is not required but systemd starts it through socket activation after service disable”. The relevant Linux mechanism is Socket activation can launch a service even if its service unit is otherwise inactive. For the stated problem, “xinetd can start daemons on demand through its own configuration” addresses the central condition.

Although that change may be valid elsewhere, it responds to A command-line mail client reports queued messages and an administrator needs to inspect them, not to this system state. The relevant fix is Verify a suitable local MTA or relay interface exists before relying on mailed alerts.

The alternative fits A mail alias is added to /etc/aliases but messages still go to the old address. The reported issue instead calls for Verify a suitable local MTA or relay interface exists before relying on mailed alerts, as The mail utility depends on a functioning transport path to deliver notifications.

This command or configuration addresses a different case: An administrator wants new application messages to enter the systemd journal without creating a custom log file. Here, The mail utility depends on a functioning transport path to deliver notifications, so the targeted action is Verify a suitable local MTA or relay interface exists before relying on mailed alerts.

That option does not correct the stated dependency. In this case, The mail user agent constructs a message while the MTA performs its delivery; implement Use the supported mail command's subject option with a functioning MTA and check A test mail arrives with the intended subject and body content.

The option would apply to “A user's local mail should be forwarded to an approved external team mailbox”. The appropriate operation is Configure the user's ~/.forward file with the correct recipient. The present scenario is distinguished by “Use the supported mail command's subject option with a functioning MTA”.

Although that change may be valid elsewhere, it responds to An administrator needs to see current CUPS printer status, destinations and pending jobs, not to this system state. The relevant fix is Use the supported mail command's subject option with a functioning MTA.

The option would apply to “A developer edits a systemd timer file but the system continues following its earlier schedule”. The conclusive result is systemctl list-timers reflects the revised next activation time. This question instead requires “systemctl list-timers shows the timer and the service runs after boot and periodically”.

The required verification is systemctl list-timers shows the timer and the service runs after boot and periodically, not a result meant for A privileged application account should not have an ordinary interactive login shell.

This would test another scenario: A task should execute once at 17:00 today, not on a repeating daily schedule. Here the acceptance evidence is systemctl list-timers shows the timer and the service runs after boot and periodically.

This would test another scenario: A system using systemd-resolved shows generated /etc/resolv.conf and an administrator edits it persistently. Here the acceptance evidence is The active interface receives the intended settings after applying the relevant .network unit.

This option serves the scenario “A new static IPv4 connection created with nmcli disappears after reboot because it was not saved correctly”. The best evidence is After reboot nmcli connection show reports the saved IP settings. This question instead requires “The active interface receives the intended settings after applying the relevant .network unit”.

A passing result on that unrelated check cannot certify the present correction; require The active interface receives the intended settings after applying the relevant .network unit.

This would test another scenario: A diagnostic script needs to send errors to a log without mixing them into standard result output. Here the acceptance evidence is The program prints stable C-locale output while later commands retain their original locale.

This alternative addresses the separate case “An interactive Bash alias is available locally but missing in a noninteractive cron task”. Expect The scheduled task succeeds when commands use controlled paths and environment. The deciding requirement here is “The program prints stable C-locale output while later commands retain their original locale”.

This would test another scenario: An operator changes PATH in one terminal but new child shells still use the old search path. Here the acceptance evidence is The program prints stable C-locale output while later commands retain their original locale.

This alternative addresses the separate case “Printing stops after an operator disables a CUPS queue during maintenance”. The safest fitting response is Reenable the approved printer destination and verify it accepts jobs. For the stated problem, “Trace each local alias and .forward destination and remove the cyclic route” addresses the central condition.

That option does not correct the stated dependency. In this case, Mail forwarding chains must terminate in reachable destinations without recursion; implement Trace each local alias and .forward destination and remove the cyclic route and check A probe message follows a finite route and reaches the intended mailbox once.

This option serves the scenario “In an LPIC-1 102-500 administration task, A Linux server must deliver mail addressed to root to an on-call administrator”. The safest fitting response is Configure the system mail alias for root and rebuild the aliases database with newaliases. This question instead requires “Trace each local alias and .forward destination and remove the cyclic route”.

That option does not correct the stated dependency. In this case, The timezone environment selects local display; UTC output avoids location assumptions; implement Run date with TZ=UTC or explicitly request UTC output and check Two test users with different timezones generate the same UTC instant.

Although that change may be valid elsewhere, it responds to A Linux host keeps accurate software time but its hardware RTC is configured to a different local timezone, not to this system state. The relevant fix is Run date with TZ=UTC or explicitly request UTC output.

Although that change may be valid elsewhere, it responds to A service needs the current timestamp as ISO text for an audit record, not to this system state. The relevant fix is Run date with TZ=UTC or explicitly request UTC output.