LFCS Practice Test 8 — 10 Questions

Question 1

You are a senior Linux administrator for a large data center. A junior admin reports that a newly deployed application server (192.168.100.50/24, default gateway 192.168.100.1) cannot communicate with a legacy server (192.168.200.50/24, default gateway 192.168.200.1). The two subnets are connected via a router (192.168.100.1 and 192.168.200.1). From the app server, you can ping the legacy server's IP successfully. However, when you try to establish an SSH session from the app server to the legacy server, it times out. You check the legacy server's firewall (ufw) and find that it allows SSH (port 22) from the entire 192.168.0.0/16 range. You also confirm that the SSH daemon is running and listening on 0.0.0.0:22. What is the most likely cause?

Accepted Answer

The app server's firewall (ufw) is blocking incoming SSH responses.. The app server can ping the legacy server successfully, which confirms that ICMP traffic (Layer 3) passes through the router and that the legacy server's firewall allows ICMP. However, SSH (TCP port 22) fails because the app server's own firewall (ufw) is blocking the incoming SSH response packets (SYN-ACK) from the legacy server. Since the SSH client initiates the connection from the app server, the response packets must be allowed by the app server's firewall; if ufw on the app server blocks established or related incoming traffic, the TCP handshake cannot complete, resulting in a timeout.

Answer

The router is dropping TCP packets due to ACLs.

Answer

The legacy server's firewall is not allowing SSH; the rule might be misconfigured.

Answer

The legacy server's SSH service is not listening on the correct interface.

Question 2

You manage a Linux server that provides DHCP services to a small office network using the dhcpd daemon. The server has two network interfaces: eth0 (192.168.1.1/24) serving the internal network, and eth1 (192.168.0.1/24) connected to a DMZ. The DHCP server is configured to serve addresses only on eth0. Users on the internal network report that they are not receiving IP addresses. You check the DHCP server and find that the dhcpd service is running and listening on UDP port 67. From a client, you run tcpdump and see DHCPDISCOVER packets being sent, but no DHCPOFFER from the server. You also verify that no firewall rules are blocking DHCP traffic on either side. What is the most likely reason for the failure?

Accepted Answer

The dhcpd configuration file does not have a subnet declaration for the 192.168.1.0/24 network.. Option B is correct because the dhcpd daemon will only respond to DHCPDISCOVER packets on interfaces for which it has a matching subnet declaration in its configuration file (typically /etc/dhcp/dhcpd.conf). Without a subnet declaration for 192.168.1.0/24, dhcpd ignores all DHCP traffic on eth0, even though the service is running and listening on UDP port 67. The absence of DHCPOFFER packets despite seeing DHCPDISCOVERs confirms that the server is not processing the requests for that subnet.

Answer

The DHCP server's IP address is not in the same subnet as the clients.

Answer

The dhcpd service is not running.

Answer

The network switch is blocking broadcast packets.

Question 3

An administrator wants to enforce that users in the 'contractors' group must change their password every 30 days, with a warning 7 days before expiry. Which command should be used?

Accepted Answer

chage -M 30 -W 7 contractors. The `chage` command is specifically designed to manage user password aging policies. The `-M 30` option sets the maximum number of days a password is valid (30 days), and `-W 7` sets the number of days before expiry to start warning the user (7 days). This directly fulfills the requirement for the 'contractors' group by applying the policy to each user in that group.

Answer

groupmod -p 30 contractors

Answer

passwd -x 30 -w 7 contractors

Answer

usermod -e 30 contractors

Question 4

A system administrator notices that a web server is not reachable from the internet but is reachable from the internal network. The server's IP is 10.0.1.10/24, and the gateway is 10.0.1.1. Which command should be used to verify the default gateway configuration?

Accepted Answer

ip route show. The `ip route show` command displays the kernel routing table, including the default gateway entry. Since the server is reachable internally but not from the internet, a missing or incorrect default gateway is the likely cause. This command directly verifies whether a default route (e.g., via 10.0.1.1) is present.

Answer

arp -a

Answer

ip addr show

Answer

ss -tln

Question 5

Which TWO commands can be used to resolve a hostname to an IP address?

Accepted Answer

host. The `host` command is a simple DNS lookup utility that queries DNS servers to resolve a hostname to an IP address. It directly performs forward DNS resolution using the system's configured resolvers and returns the A or AAAA record for the given name.

Answer

traceroute

Answer

ping

Answer

ifconfig

Question 6

A developer needs to temporarily allow incoming TCP connections on port 8080 for testing. Which iptables command adds a rule to the INPUT chain to accept this traffic?

Accepted Answer

iptables -A INPUT -p tcp --dport 8080 -j ACCEPT. Option B is correct because the INPUT chain processes traffic destined for the local system, and the `--dport 8080` flag matches incoming TCP packets with destination port 8080. The `-j ACCEPT` target allows these packets through, which is exactly what is needed to temporarily permit incoming TCP connections on port 8080 for testing.

Answer

iptables -A OUTPUT -p tcp --sport 8080 -j ACCEPT

Answer

iptables -A FORWARD -p tcp --dport 8080 -j ACCEPT

Answer

iptables -I INPUT 1 -p tcp --dport 8080 -j DROP

Question 7

Which command displays the listening UDP ports on a Linux system?

Accepted Answer

ss -uln. Option C is correct because `ss -uln` specifically displays listening UDP sockets. The `-u` flag filters for UDP, `-l` shows only listening sockets, and `-n` displays numeric addresses and ports (avoiding DNS resolution). This is the most precise command for listing listening UDP ports.

Answer

ss -a

Answer

ss -tln

Answer

netstat -tln

Question 8

A host with this routing table can ping 10.0.2.1 but cannot ping 8.8.8.8. What is the most likely cause?

Accepted Answer

The default gateway 10.0.1.1 does not have internet connectivity. The host can ping 10.0.2.1, which is on the directly connected 10.0.2.0/24 network, confirming that the local interface and link-layer are functional. However, it cannot ping 8.8.8.8, a public internet address. The routing table shows a default route via 10.0.1.1, so the host will forward the packet to that gateway. Since the host has a default route, the most likely cause is that the gateway 10.0.1.1 itself lacks internet connectivity (e.g., no upstream route, NAT misconfiguration, or ISP outage), preventing the packet from reaching 8.8.8.8.

Answer

The default route is missing

Answer

The host has no route to 10.0.2.0/24

Answer

The host has no route to 10.0.1.1

Question 9

Which TWO of the following are valid methods to check the status of a systemd service named 'httpd'? (Select TWO.)

Accepted Answer

systemctl status httpd. Option D is correct because `systemctl status httpd` is the standard command to query the status of a systemd service. It displays the service's current state, recent log entries, and process information, directly interfacing with systemd's unit management.

Answer

initctl status httpd

Answer

systemd-analyze status httpd

Answer

/etc/init.d/httpd status

Question 10

Which TWO of the following commands can be used to display the current kernel ring buffer messages? (Select TWO.)

Accepted Answer

journalctl -k. A is correct because `journalctl -k` queries the systemd journal for kernel messages only, displaying the current kernel ring buffer content. This is the modern way to access kernel logs on systems using systemd, equivalent to `dmesg` but with structured journal output.

Answer

syslog -k

Answer

cat /proc/kmsg

Answer

tail /var/log/messages