LPI 102-500 Bundle

The alternative can apply elsewhere, but Socket activation can launch a service even if its service unit is otherwise inactive is the governing fact here; test by checking The unused listening socket disappears and the service remains unavailable after reboot.

The related but distinct situation is “An old host uses xinetd to launch a service that is no longer allowed”. This behavior is explained by xinetd can start daemons on demand through its own configuration. For the stated problem, “Socket activation can launch a service even if its service unit is otherwise inactive” addresses the central condition.

This would be the main explanation for A service listens on all network interfaces though only local clients should use it. It does not account for A network daemon is not required but systemd starts it through socket activation after service disable.

This option serves the scenario “A developer assumes HTTPS normally uses TCP port 80 like unencrypted HTTP”. The best evidence is A connection to the approved HTTPS endpoint succeeds on TCP 443. This question instead requires “A controlled protocol test illustrates the intended connection and datagram behavior”.

That observation may validate A technician must check whether the server can connect to a TCP service on port 443, but it does not establish that A controlled protocol test illustrates the intended connection and datagram behavior for the current case.

That observation may validate An administrator assigns the IPv4 address 10.1.1.0 with a /24 mask to a host, but it does not establish that A controlled protocol test illustrates the intended connection and datagram behavior for the current case.

This option serves the scenario “A technician must check whether the server can connect to a TCP service on port 443”. The relevant Linux mechanism is A TCP socket test validates a specific port rather than only ICMP reachability. The present scenario is distinguished by “ICMP echo tests network responsiveness but does not establish TCP service reachability”.

This alternative addresses the separate case “An application listens on UDP 123 and a colleague wrongly associates it with SSH”. Here, Well-known service assignments distinguish NTP clock synchronization from SSH login. The deciding requirement here is “ICMP echo tests network responsiveness but does not establish TCP service reachability”.

That statement explains another situation: A server in 192.168.20.0/24 must communicate with a host in 192.168.21.0/24. The current observation instead depends on ICMP echo tests network responsiveness but does not establish TCP service reachability.

It fails to address the actual requirement, A privileged application account should not have an ordinary interactive login shell. The needed change is Create or modify the service identity with a suitable nologin shell and minimal permissions; verify getent passwd shows the restricted shell and the service runs with its intended identity.

That option does not correct the stated dependency. In this case, Special-purpose service accounts need not permit general human logins; implement Create or modify the service identity with a suitable nologin shell and minimal permissions and check getent passwd shows the restricted shell and the service runs with its intended identity.

It fails to address the actual requirement, A privileged application account should not have an ordinary interactive login shell. The needed change is Create or modify the service identity with a suitable nologin shell and minimal permissions; verify getent passwd shows the restricted shell and the service runs with its intended identity.

That option does not correct the stated dependency. In this case, SSH host keys authenticate the server and a changed key may indicate compromise; implement Verify the new host key fingerprint through a trusted out-of-band source before updating known_hosts and check The verified fingerprint matches the approved replacement and SSH reconnects safely.

The alternative fits An administrator edits /etc/sudoers directly and syntax errors block future privilege escalation. The reported issue instead calls for Verify the new host key fingerprint through a trusted out-of-band source before updating known_hosts, as SSH host keys authenticate the server and a changed key may indicate compromise.

This command or configuration addresses a different case: A compliance reviewer needs to prove that a GPG-signed release manifest was not altered. Here, SSH host keys authenticate the server and a changed key may indicate compromise, so the targeted action is Verify the new host key fingerprint through a trusted out-of-band source before updating known_hosts.

The related but distinct situation is “A VM's clock drifts despite a running NTP daemon because it cannot reach its upstream reference”. Verify that Source status shows a valid peer and the time offset declines to the policy limit. The deciding requirement here is “The tracking report shows an accepted synchronized source with bounded offset”.

This alternative addresses the separate case “A newly provisioned node should use the shared organizational NTP pool instead of an arbitrary public peer”. The best evidence is Time source inspection shows the approved pool and reports stable synchronization. For the stated problem, “The tracking report shows an accepted synchronized source with bounded offset” addresses the central condition.

The option would apply to “An administrator wants new application messages to enter the systemd journal without creating a custom log file”. Expect journalctl shows the emitted diagnostic with the intended tag and timestamp. The present scenario is distinguished by “The tracking report shows an accepted synchronized source with bounded offset”.

That danger is associated more closely with An administrator assigns the IPv4 address 10.1.1.0 with a /24 mask to a host. Here the primary exposure is A wrong subnet mask can produce invalid neighbor requests or missing gateway routing.

It is not the most direct failure mode. The relevant mechanism is Incorrect prefix length changes what the kernel considers directly connected, which risks A wrong subnet mask can produce invalid neighbor requests or missing gateway routing.

The stated concern is possible elsewhere, but the facts here specifically imply A wrong subnet mask can produce invalid neighbor requests or missing gateway routing.

This alternative addresses the separate case “A nightly cleanup loop processes filenames containing spaces by iterating over unquoted command substitution”. The best evidence is A test fixture with spaced filenames is handled without splitting or deleting the wrong path. For the stated problem, “The script performs exactly eight checks including a service with a hyphenated name” addresses the central condition.

A passing result on that unrelated check cannot certify the present correction; require The script performs exactly eight checks including a service with a hyphenated name.

That observation may validate A new analyst logs in through SSH but a custom tool in /opt/tools is not found by name, but it does not establish that The script performs exactly eight checks including a service with a hyphenated name for the current case.

The option would apply to “A network interface shows no IP address after a configuration change”. Here, An interface can be administratively up while lacking a usable IP configuration. This question instead requires “NetworkManager profile selection can affect which saved configuration becomes active”.

The related but distinct situation is “A server needs a fixed default gateway for a persistent NetworkManager Ethernet profile”. The relevant Linux mechanism is Persistent gateway settings belong to the active network configuration manager. For the stated problem, “NetworkManager profile selection can affect which saved configuration becomes active” addresses the central condition.

That statement explains another situation: A host uses systemd-networkd, but an engineer repeatedly modifies NetworkManager profiles with no effect. The current observation instead depends on NetworkManager profile selection can affect which saved configuration becomes active.

The related but distinct situation is “A script requires a fixed global time reference and must not depend on the user's configured TZ”. The relevant Linux mechanism is The timezone environment selects local display; UTC output avoids location assumptions. The deciding requirement here is “A UTC RTC removes local daylight-saving ambiguity during system startup”.

It is less specific than A UTC RTC removes local daylight-saving ambiguity during system startup, which directly explains the scenario and supports Convert the hardware clock policy to UTC and configure the proper system timezone.

The option would apply to “A Linux host keeps accurate software time but its hardware RTC is configured to a different local timezone”. The governing principle is Keeping the RTC in UTC avoids daylight-saving and timezone ambiguity on Linux hosts. The present scenario is distinguished by “A UTC RTC removes local daylight-saving ambiguity during system startup”.

This alternative addresses the separate case “A nightly cleanup loop processes filenames containing spaces by iterating over unquoted command substitution”. The best evidence is A test fixture with spaced filenames is handled without splitting or deleting the wrong path. The deciding requirement here is “A test path containing a backslash is stored verbatim”.

The option would apply to “A maintenance script captures the literal text $(hostname) instead of the machine name”. Expect A test assignment records the current hostname rather than the literal syntax. This question instead requires “A test path containing a backslash is stored verbatim”.

The related but distinct situation is “An administrator needs to inspect only exported variables passed to spawned processes”. Expect A deliberately unexported test variable is absent from env output. For the stated problem, “A test path containing a backslash is stored verbatim” addresses the central condition.