390.1 OpenLDAP Replication (weight: 3) LPIC-3-MIXED-ENVIRONMENTS Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A consumer is not receiving updates from the provider. The administrator checks the consumer's logs and sees repeated 'no such attribute' errors related to the contextCSN attribute. The provider's database was recently rebuilt from an LDIF export. What is the most likely cause of this issue?

   • AThe provider's contextCSN was reset during the LDIF import, so the consumer's stored contextCSN is now ahead of the provider's, causing the consumer to think it has no changes to apply.
   • BThe consumer's search base is incorrect, so it cannot find the contextCSN attribute on the provider.
   • CThe consumer's bind DN does not have permission to read the contextCSN attribute.
   • DThe provider's replication account password has expired, causing the consumer to fail authentication.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization runs a multi-master OpenLDAP setup with two providers. Both providers replicate the same naming context to each other. A user changes their password on provider A. What is the expected behavior on provider B?

   • AProvider B overwrites the change with its own copy of the password, causing a conflict.
   • BProvider B receives the password change from provider A through the replication agreement and updates its local copy.
   • CProvider B ignores the change until a manual synchronization is triggered by an administrator.
   • DProvider B rejects the change because it is a read-only consumer and cannot accept updates from another provider.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An administrator is configuring a new consumer. The provider requires TLS and uses a self-signed certificate. The administrator has copied the self-signed certificate to the consumer and configured TLS_CACERT to point to it. However, the TLS handshake still fails. What is the most likely reason?

   • AThe self-signed certificate is not a CA certificate, so it cannot be used to verify the provider's certificate chain.
   • BThe consumer's search base is incorrect, causing the provider to reject the connection.
   • CThe consumer's syncrepl configuration is using the wrong replication mode.
   • DThe provider's certificate has expired.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An organization has a provider and a consumer in different data centers connected by a WAN link. The provider requires TLS for replication. The consumer's syncrepl configuration uses ldaps:// and the correct CA certificate. However, replication is failing with a TLS handshake error. The administrator verifies that the provider's certificate is valid and the CA is correct. What is the most likely cause of the TLS handshake failure?

   • AThe consumer is using the wrong replication mode (refreshOnly instead of refreshAndPersist).
   • BThe provider's firewall is blocking the LDAPS port (636) from the consumer's IP address.
   • CThe consumer's search base is incorrect, causing the provider to reject the connection.
   • DThe provider's certificate hostname does not match the hostname used in the consumer's provider URL.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An administrator is configuring a consumer to replicate only the 'ou=People' subtree from the provider. The provider's base DN is 'dc=example,dc=com'. Which search base should be specified in the consumer's syncrepl agreement?

   • Acn=People,dc=example,dc=com
   • Bou=People
   • Cdc=example,dc=com
   • Dou=People,dc=example,dc=com
   Reveal Solution Discussion Select an answer first