LFCS Networking Practice Questions

Question 1

A server has two network interfaces: eth0 (10.0.1.10/24, gateway 10.0.1.1) and eth1 (192.168.1.10/24, no gateway). Both are up. The default gateway is set to 10.0.1.1. A ping to 8.8.8.8 fails, but ping to 10.0.1.1 succeeds. What is the most likely cause?

Accepted Answer

The default route is missing or pointing to an incorrect gateway. Although the default gateway is set to 10.0.1.1, the default route may not be present in the routing table if it was not properly added or was later removed. The lack of a default route would allow pings to the local gateway (10.0.1.1) to succeed, but any attempt to reach an external IP like 8.8.8.8 would fail because the system does not know where to send the packets. Thus, the most likely cause is a missing or incorrectly configured default route.

Answer

eth1 has no gateway configured

Answer

DNS resolution is failing

Answer

eth0 is down

Question 2

A host with this routing table can ping 10.0.2.1 but cannot ping 8.8.8.8. What is the most likely cause?

Accepted Answer

The default gateway 10.0.1.1 does not have internet connectivity. The host can ping 10.0.2.1, which is on the directly connected 10.0.2.0/24 network, confirming that the local interface and link-layer are functional. However, it cannot ping 8.8.8.8, a public internet address. The routing table shows a default route via 10.0.1.1, so the host will forward the packet to that gateway. Since the host has a default route, the most likely cause is that the gateway 10.0.1.1 itself lacks internet connectivity (e.g., no upstream route, NAT misconfiguration, or ISP outage), preventing the packet from reaching 8.8.8.8.

Answer

The default route is missing

Answer

The host has no route to 10.0.2.0/24

Answer

The host has no route to 10.0.1.1

Question 3

You are troubleshooting a Linux server that acts as a router between two networks: 10.0.1.0/24 (eth0) and 10.0.2.0/24 (eth1). IP forwarding is enabled. Hosts on 10.0.1.0/24 can ping the server's eth0 IP (10.0.1.1), but cannot ping hosts on 10.0.2.0/24 (e.g., 10.0.2.10). The server can ping both 10.0.2.10 and 10.0.1.10. The iptables FORWARD chain policy is ACCEPT. What is the most likely cause?

Accepted Answer

The hosts on 10.0.1.0/24 do not have a route to 10.0.2.0/24. The server can ping both networks, confirming IP forwarding is enabled and iptables FORWARD chain policy is ACCEPT. Hosts on 10.0.1.0/24 can ping the server's eth0 IP but not hosts on 10.0.2.0/24, which indicates the hosts lack a route to the 10.0.2.0/24 network. Without a route, packets from 10.0.1.0/24 destined for 10.0.2.0/24 are dropped at the source host because the kernel has no next-hop information for that destination.

Answer

The server cannot reach 10.0.2.10

Answer

IP forwarding is not enabled

Answer

The iptables FORWARD chain has a DROP policy

Question 4

A server has two network interfaces: eth0 (10.0.0.10/24) and eth1 (192.168.1.10/24). The server needs to act as a router for a subnet 172.16.0.0/24, forwarding packets between it and the 10.0.0.0/24 network. Which sysctl parameter must be set to a value of 1 to enable IP forwarding?

Accepted Answer

net.ipv4.conf.all.forwarding. Both option A and option D are valid sysctl parameters for enabling IP forwarding. `net.ipv4.conf.all.forwarding` enables forwarding globally across all interfaces, while `net.ipv4.ip_forward` is the classic global parameter. Setting either to 1 allows the server to forward packets between interfaces, making both correct in this scenario.

Answer

net.core.forwarding

Answer

net.ipv4.tcp_forwarding

Question 5

Based on the exhibit, which port is listening only on the loopback interface?

Accepted Answer

53. Port 53 (DNS) is configured to listen only on the loopback interface (127.0.0.1) as shown in the exhibit's output of `ss -tlnp`. The listening address `127.0.0.1:53` indicates the service is bound exclusively to the loopback interface, meaning it is not accessible from external network interfaces.

Answer

22

Answer

443

Answer

80

Question 6

You are a systems administrator for a company that runs a critical web application on a Linux server. The server has two network interfaces: eth0 (public IP 203.0.113.10/24, gateway 203.0.113.1) and eth1 (private IP 10.0.0.10/24). The web server listens on port 443 (HTTPS) and must be accessible from the internet. The server also needs to connect to an internal database server at 10.0.0.50/24 on port 3306. Recently, users reported that the website is intermittently unreachable. You SSH into the server and run 'ss -tln' and see that the web server is listening on 0.0.0.0:443. You check the routing table with 'ip route show' and see: default via 203.0.113.1 dev eth0; 10.0.0.0/24 dev eth1 proto kernel scope link src 10.0.0.10. You also run 'iptables -L -n -v' and see: Chain INPUT (policy ACCEPT), with no rules. However, you notice that the server's default gateway is unreachable from the server itself when you run 'ping 203.0.113.1' (100% packet loss). What is the most likely cause of the intermittent unreachability?

Accepted Answer

The default gateway is unreachable, preventing return traffic from the internet.. The server's default gateway (203.0.113.1) is unreachable, as confirmed by the 100% packet loss on ping. This means that although the web server is listening on 0.0.0.0:443 and the firewall allows traffic, any response packets from the server to internet clients must be routed through the default gateway. Without a working gateway, return traffic cannot reach the clients, causing intermittent unreachability from the internet.

Answer

The web server is not listening on the public IP address.

Answer

A firewall rule is blocking incoming HTTPS traffic.

Answer

The private interface eth1 has a misconfigured IP address.

Question 7

A company wants to ensure that a web server (IP 192.168.1.10) is accessible from the internet via port 443, but all other inbound traffic should be blocked. The server also needs to communicate with an internal database (IP 10.0.0.50) on port 3306. The default firewall zone is 'public'. Which iptables rules should be applied to the server?

Accepted Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT; iptables -P INPUT DROP; iptables -P OUTPUT ACCEPT. It explicitly allows inbound HTTPS traffic on port 443, permits return traffic for established/related connections (which is essential for the server to communicate with the internal database on port 3306), and sets a default DROP policy on the INPUT chain to block all other inbound traffic. The OUTPUT chain is left with a default ACCEPT policy, allowing the server to initiate outbound connections to the database without additional rules.

Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT; iptables -P INPUT DROP

Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -P INPUT ACCEPT

Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT; iptables -P INPUT DROP; iptables -P OUTPUT DROP

Question 8

Which TWO commands can be used to display the current routing table on a Linux system?

Accepted Answer

route -n. Option B, route -n, is correct because the route command with the -n flag prints the kernel routing table while showing numeric IP addresses instead of attempting DNS resolution, which is a classic way to display routes on Linux. Option C, ip route show, is correct because it is the modern iproute2 command that lists the current routing table entries, including destinations, gateways, and interfaces. Option A, ss -r, is not correct because ss is used to dump socket statistics, and although it has a -r option to resolve hostnames, it does not display the routing table. Option D, netstat -r, is not marked correct here even though it can show routes on some systems, because the question's expected answers are the two listed above. Option E, ifconfig, is not correct because it displays or configures network interface parameters, not the routing table.

Answer

ss -r

Answer

netstat -r

Answer

ifconfig

Question 9

Based on the exhibit, a system administrator runs ping to 8.8.8.8 and gets 'Destination Host Unreachable'. What is the most likely cause?

Accepted Answer

The gateway 192.168.10.1 is not reachable from this host.. The 'Destination Host Unreachable' message indicates that the host has no route to the destination network or the next-hop gateway is not reachable. Since the ping target is 8.8.8.8 (a public IP), the host must forward traffic to its default gateway. If the gateway 192.168.10.1 is not reachable (e.g., due to a down interface, ARP failure, or missing neighbor entry), the kernel will immediately return this ICMP error without attempting to send the packet.

Answer

The IP address 192.168.10.15 is not configured on eth0.

Answer

A firewall is blocking ICMP traffic.

Answer

The default route is missing.

Question 10

Order the steps to troubleshoot a DNS resolution issue from a Linux client.

Accepted Answer

Check DNS configuration, then test DNS resolution, then check network connectivity, then check firewall settings. The correct sequence for troubleshooting DNS resolution from a Linux client starts with verifying the local DNS configuration (e.g., /etc/resolv.conf), then testing resolution using tools like nslookup or dig. Next, check network connectivity to the DNS server (ping), and finally examine firewall rules that might block UDP/TCP port 53. This logical progression isolates the problem systematically, avoiding wasted effort on unrelated checks.

Answer

Check firewall settings, then check network connectivity, then test DNS resolution, then check DNS configuration

Answer

Test DNS resolution, then check DNS configuration, then check firewall settings, then check network connectivity

Answer

Check network connectivity, then check DNS configuration, then test DNS resolution, then check firewall settings

Networking

LFCS Networking — Key Topics

Where candidates lose marks on Networking