210.2 PAM Authentication (weight: 3) LPIC-2 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   After modifying /etc/pam.d/system-auth, a Linux engineer finds that no users can log in, including root. The engineer suspects a syntax error in the PAM configuration. What is the safest and most effective way to diagnose and recover the system?

   • AUse the 'pam_tally2' command to reset the login failure counter, which will unlock all accounts.
   • BReboot the system into single-user mode, which bypasses PAM, and restore the original /etc/pam.d/system-auth file from a backup.
   • CRun 'authconfig --test' to validate the PAM configuration and automatically fix any errors.
   • DCheck the /var/log/secure log for PAM errors, then use the 'pam_console' module to bypass the broken configuration.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which PAM module is responsible for updating the password hash in /etc/shadow when a user changes their password?

   • Apam_cracklib
   • Bpam_ldap
   • Cpam_unix
   • Dpam_krb5
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which PAM module type is responsible for verifying the user's identity, typically by checking a password?

   • Asession
   • Bpassword
   • Cauth
   • Daccount
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How does a system service such as sshd integrate with PAM?

   • AThe service sends authentication requests to a central PAM daemon over a Unix socket.
   • BThe service calls PAM library functions, which then load and execute the modules specified in the service's PAM configuration.
   • CThe service invokes the pam_auth command-line tool to perform authentication.
   • DThe service directly reads and parses /etc/pam.d/sshd to implement its own authentication logic.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A user is unable to log in via SSH, but can log in locally. The /etc/pam.d/sshd file contains the following stack: auth required pam_env.so auth required pam_faillock.so preauth auth sufficient pam_unix.so auth [default=die] pam_faillock.so authfail auth sufficient pam_sss.so auth required pam_deny.so The user has not exceeded the faillock threshold. What is the most likely cause of the SSH login failure?

   • AThe pam_faillock.so preauth module is incorrectly denying access even though the threshold has not been reached.
   • BThe pam_unix.so module is failing because the user's password is incorrect.
   • CThe pam_env.so module is failing, which prevents the rest of the stack from executing.
   • DThe pam_sss.so module is failing because the SSSD service is not running or is misconfigured.
   Reveal Solution Discussion Select an answer first