LFCS Networking — 50 Questions

Question 1

A system administrator notices that a web server is not reachable from the internet but is reachable from the internal network. The server's IP is 10.0.1.10/24, and the gateway is 10.0.1.1. Which command should be used to verify the default gateway configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ip route show. The `ip route show` command displays the kernel routing table, including the default gateway entry. Since the server is reachable internally but not from the internet, a missing or incorrect default gateway is the likely cause. This command directly verifies whether a default route (e.g., via 10.0.1.1) is present.

Answer

arp -a

Answer

ip addr show

Answer

ss -tln

Question 2

A developer needs to temporarily allow incoming TCP connections on port 8080 for testing. Which iptables command adds a rule to the INPUT chain to accept this traffic?

Accepted Answer

iptables -A INPUT -p tcp --dport 8080 -j ACCEPT. The INPUT chain processes traffic destined for the local system, and the `--dport 8080` flag matches incoming TCP packets with destination port 8080. The `-j ACCEPT` target allows these packets through, which is exactly what is needed to temporarily permit incoming TCP connections on port 8080 for testing.

Answer

iptables -A OUTPUT -p tcp --sport 8080 -j ACCEPT

Answer

iptables -A FORWARD -p tcp --dport 8080 -j ACCEPT

Answer

iptables -I INPUT 1 -p tcp --dport 8080 -j DROP

Question 3

A server has two network interfaces: eth0 (10.0.1.10/24, gateway 10.0.1.1) and eth1 (192.168.1.10/24, no gateway). Both are up. The default gateway is set to 10.0.1.1. A ping to 8.8.8.8 fails, but ping to 10.0.1.1 succeeds. What is the most likely cause?

Accepted Answer

The default route is missing or pointing to an incorrect gateway. Although the default gateway is set to 10.0.1.1, the default route may not be present in the routing table if it was not properly added or was later removed. The lack of a default route would allow pings to the local gateway (10.0.1.1) to succeed, but any attempt to reach an external IP like 8.8.8.8 would fail because the system does not know where to send the packets. Thus, the most likely cause is a missing or incorrectly configured default route.

Answer

eth1 has no gateway configured

Answer

DNS resolution is failing

Answer

eth0 is down

Question 4

An administrator wants to permanently configure a static IP address on a CentOS 7 system. Which file should be edited?

Accepted Answer

/etc/sysconfig/network-scripts/ifcfg-eth0. On CentOS 7, network interface configuration is stored in individual files under /etc/sysconfig/network-scripts/, named ifcfg-<interface>. The ifcfg-eth0 file contains parameters like BOOTPROTO, IPADDR, NETMASK, and GATEWAY, and setting BOOTPROTO=static along with the IP address values permanently configures a static IP. This is the standard method for RHEL/CentOS 7 systems using the legacy network scripts (not NetworkManager's keyfile format).

Answer

/etc/sysconfig/network

Answer

/etc/hostname

Answer

/etc/network/interfaces

Question 5

A network administrator needs to block all incoming SSH traffic (port 22) from the 192.168.2.0/24 subnet. Which iptables command accomplishes this?

Accepted Answer

iptables -A INPUT -s 192.168.2.0/24 -p tcp --dport 22 -j DROP. It appends a rule to the INPUT chain that matches packets originating from the 192.168.2.0/24 subnet (-s 192.168.2.0/24) using TCP protocol with destination port 22 (--dport 22), and then drops them (-j DROP). This precisely blocks all incoming SSH traffic from that subnet while leaving other traffic unaffected.

Answer

iptables -A INPUT -d 192.168.2.0/24 -p tcp --dport 22 -j DROP

Answer

iptables -A OUTPUT -d 192.168.2.0/24 -p tcp --sport 22 -j DROP

Answer

iptables -A INPUT -s 192.168.2.0/24 -j DROP

Question 6

An administrator is troubleshooting intermittent connectivity issues. Running 'ping -c 100 -i 0.2 10.0.0.1' shows about 5% packet loss. What is the primary purpose of the '-i 0.2' option?

Accepted Answer

It sets the interval between pings to 0.2 seconds. The '-i 0.2' option in the ping command sets the interval between sending ICMP Echo Request packets to 0.2 seconds. This allows the administrator to send pings more frequently than the default (typically 1 second), which helps in detecting intermittent connectivity issues over a shorter test duration. By sending 100 packets at a 0.2-second interval, the test completes in about 20 seconds, making it practical for troubleshooting transient packet loss.

Answer

It sets the TTL to 0.2

Answer

It sets the timeout to 0.2 seconds

Answer

It sets the packet size to 0.2 bytes

Question 7

Which command displays the listening UDP ports on a Linux system?

Accepted Answer

ss -uln. `ss -uln` specifically displays listening UDP sockets. The `-u` flag filters for UDP, `-l` shows only listening sockets, and `-n` displays numeric addresses and ports (avoiding DNS resolution). This is the most precise command for listing listening UDP ports.

Answer

ss -a

Answer

ss -tln

Answer

netstat -tln

Question 8

A server needs to forward packets between two networks: 10.0.1.0/24 on eth0 and 10.0.2.0/24 on eth1. Which sysctl parameter must be enabled?

Accepted Answer

net.ipv4.ip_forward = 1. Enabling `net.ipv4.ip_forward = 1` allows the Linux kernel to forward IP packets between network interfaces, which is required for a server to route traffic between the 10.0.1.0/24 and 10.0.2.0/24 subnets. Without this parameter, the kernel drops any packet not destined for the local system, preventing inter-network communication.

Answer

net.ipv4.conf.all.rp_filter = 1

Answer

net.ipv4.conf.all.accept_source_route = 1

Answer

net.ipv4.conf.all.send_redirects = 0

Question 9

Which TWO commands can be used to display the routing table on a Linux system?

Accepted Answer

route -n. The `route -n` command displays the kernel IP routing table with numeric addresses, showing destination, gateway, netmask, and interface. The `ip route show` command is the modern equivalent from the iproute2 suite, which also displays the routing table with more detailed information. Both are standard tools for viewing routing decisions on a Linux system.

Answer

ip addr show

Answer

arp -a

Answer

ss -tln

Question 10

Which THREE conditions must be met for a Linux system to function as a router between two networks?

Accepted Answer

Each interface has an IP address in the respective subnet. Each interface must have an IP address in its respective subnet for the Linux system to receive packets from that network and forward them to the other. Without an IP address in the subnet, the interface cannot participate in ARP resolution or routing decisions for that network.

Answer

Both interfaces have the same MAC address

Answer

The system is configured as the default gateway for both networks

Question 11

Which TWO commands can be used to resolve a hostname to an IP address?

Accepted Answer

host. The `host` command is a simple DNS lookup utility that queries DNS servers to resolve a hostname to an IP address. It directly performs forward DNS resolution using the system's configured resolvers and returns the A or AAAA record for the given name.

Answer

traceroute

Answer

ping

Answer

ifconfig

Question 12

A host with this routing table can ping 10.0.2.1 but cannot ping 8.8.8.8. What is the most likely cause?

Accepted Answer

The default gateway 10.0.1.1 does not have internet connectivity. The host can ping 10.0.2.1, which is on the directly connected 10.0.2.0/24 network, confirming that the local interface and link-layer are functional. However, it cannot ping 8.8.8.8, a public internet address. The routing table shows a default route via 10.0.1.1, so the host will forward the packet to that gateway. Since the host has a default route, the most likely cause is that the gateway 10.0.1.1 itself lacks internet connectivity (e.g., no upstream route, NAT misconfiguration, or ISP outage), preventing the packet from reaching 8.8.8.8.

Answer

The default route is missing

Answer

The host has no route to 10.0.2.0/24

Answer

The host has no route to 10.0.1.1

Question 13

An administrator is unable to SSH into the server from a remote host at 192.168.1.100. Based on the exhibited iptables rules, what is the most likely reason?

Accepted Answer

The SSH rule only allows connections from 10.0.1.0/24, and 192.168.1.100 is not in that subnet. The exhibited iptables rules show an SSH rule that explicitly accepts incoming TCP traffic on port 22 only from the source subnet 10.0.1.0/24. The remote host at 192.168.1.100 is not within that subnet, so the SSH rule does not match, and the packet will fall through to the next rule or the default policy. Since no other rule permits SSH from 192.168.1.100, the connection is implicitly dropped or rejected, preventing SSH access.

Answer

SSH is not allowed from any source

Answer

The INPUT chain policy is ACCEPT, so SSH should be allowed

Answer

The DROP rule for SSH is not matching because of packet count zero

Question 14

You are a systems administrator for a company that runs a critical application on a Linux server with two network interfaces: eth0 (public IP 203.0.113.10/24, gateway 203.0.113.1) and eth1 (private IP 10.0.1.10/24, no gateway). The server must be accessible via SSH (port 22) from the internet, but only from a specific management subnet 198.51.100.0/24. Additionally, the server should be able to access the internet for package updates, but no other inbound traffic from the internet is allowed. The local firewall is iptables. After implementing rules, you find that the server cannot reach the internet (e.g., ping 8.8.8.8 fails), but SSH from the management subnet works. What is the most likely cause?

Accepted Answer

The iptables rules do not include a rule to allow established and related connections. Iptables is stateful: by default, the INPUT chain processes only the first packet of a connection. Without a rule allowing established and related connections (e.g., `-m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT`), return traffic from the server's outbound internet requests (e.g., ping to 8.8.8.8) is blocked by the INPUT chain, causing the failure. SSH from the management subnet works because the initial SYN packet is allowed, but the server's outbound traffic fails because the response packets are not recognized as part of an allowed flow.

Answer

The server's DNS resolver is not configured

Answer

The SSH rule is misconfigured and accidentally blocks all traffic

Answer

The default policy on the INPUT chain is DROP

Question 15

You are troubleshooting a Linux server that acts as a router between two networks: 10.0.1.0/24 (eth0) and 10.0.2.0/24 (eth1). IP forwarding is enabled. Hosts on 10.0.1.0/24 can ping the server's eth0 IP (10.0.1.1), but cannot ping hosts on 10.0.2.0/24 (e.g., 10.0.2.10). The server can ping both 10.0.2.10 and 10.0.1.10. The iptables FORWARD chain policy is ACCEPT. What is the most likely cause?

Accepted Answer

The hosts on 10.0.1.0/24 do not have a route to 10.0.2.0/24. The server can ping both networks, confirming IP forwarding is enabled and iptables FORWARD chain policy is ACCEPT. Hosts on 10.0.1.0/24 can ping the server's eth0 IP but not hosts on 10.0.2.0/24, which indicates the hosts lack a route to the 10.0.2.0/24 network. Without a route, packets from 10.0.1.0/24 destined for 10.0.2.0/24 are dropped at the source host because the kernel has no next-hop information for that destination.

Answer

The server cannot reach 10.0.2.10

Answer

IP forwarding is not enabled

Answer

The iptables FORWARD chain has a DROP policy

Question 16

A company has a server with two network interfaces: eth0 (192.168.1.10/24, gateway 192.168.1.1) and eth1 (10.0.0.10/24, gateway 10.0.0.1). The server needs to reach a remote network 172.16.0.0/16 via a VPN tunnel that terminates at 10.0.0.5 on eth1. Which command should be used to add a route for this traffic?

Accepted Answer

ip route add 172.16.0.0/16 via 10.0.0.5 dev eth1. The VPN tunnel endpoint is at 10.0.0.5 on the eth1 network, so traffic to 172.16.0.0/16 must be forwarded via that next-hop IP address using the eth1 interface. The `ip route add` command with `via 10.0.0.5 dev eth1` explicitly sets the gateway and egress interface, ensuring packets are sent through the VPN tunnel.

Answer

ip route add 172.16.0.0/16 via 10.0.0.5 dev eth0

Answer

ip route add 172.16.0.0/16 via 192.168.1.1 dev eth0

Answer

ip route add 172.16.0.0/16 dev eth1

Question 17

A system administrator is troubleshooting network connectivity from a server that can reach internal resources but cannot access the internet. The server's /etc/sysconfig/network-scripts/ifcfg-eth0 file contains: BOOTPROTO=static, IPADDR=10.0.0.10, NETMASK=255.255.255.0, GATEWAY=10.0.0.1. The administrator runs 'ip route show' and sees: default via 10.0.0.1 dev eth0. However, 'ping 8.8.8.8' fails. Which is the most likely cause?

Accepted Answer

The gateway 10.0.0.1 is not configured to forward traffic to the internet (no NAT or upstream route).. The routing table shows a default gateway (10.0.0.1) is present, so the issue is not a missing route. Since the server can reach internal resources but not the internet, the most likely cause is that the gateway itself (10.0.0.1) is not configured to perform NAT or does not have an upstream route to forward traffic beyond the local subnet. Without this, packets destined for 8.8.8.8 are sent to the gateway but are then dropped because the gateway has no path to the internet.

Answer

The default gateway is missing from the routing table.

Answer

DNS resolution is not configured.

Answer

A firewall is blocking outbound ICMP traffic.

Question 18

A system administrator needs to permanently configure a network interface named ens33 with a static IPv4 address of 192.168.1.100/24 and a default gateway of 192.168.1.1 on a system using NetworkManager. Which command should the administrator use to achieve this?

Accepted Answer

nmcli connection modify 'ens33' ipv4.addresses 192.168.1.100/24 ipv4.gateway 192.168.1.1 ipv4.method manual. It uses the `nmcli` command to modify the NetworkManager connection profile for interface ens33, setting a static IPv4 address with CIDR notation and a default gateway, and explicitly setting the method to 'manual' to ensure the configuration persists across reboots. NetworkManager is the default network service on modern Linux distributions, and `nmcli` is the proper tool for permanent configuration changes.

Answer

ip addr add 192.168.1.100/24 dev ens33

Answer

ifconfig ens33 192.168.1.100 netmask 255.255.255.0 up

Answer

route add default gw 192.168.1.1 ens33

Question 19

A server has two network interfaces: eth0 (10.0.0.10/24) and eth1 (192.168.1.10/24). The server needs to act as a router for a subnet 172.16.0.0/24, forwarding packets between it and the 10.0.0.0/24 network. Which sysctl parameter must be set to a value of 1 to enable IP forwarding?

Accepted Answer

net.ipv4.conf.all.forwarding. Both option A and option D are valid sysctl parameters for enabling IP forwarding. `net.ipv4.conf.all.forwarding` enables forwarding globally across all interfaces, while `net.ipv4.ip_forward` is the classic global parameter. Setting either to 1 allows the server to forward packets between interfaces, making both correct in this scenario.

Answer

net.core.forwarding

Answer

net.ipv4.tcp_forwarding

Question 20

Which TWO are valid methods to configure a network interface on a Linux system?

Accepted Answer

Editing /etc/network/interfaces. /etc/network/interfaces is the traditional configuration file used by the ifup/ifdown system on Debian-based distributions to define network interfaces, including IP addresses, netmasks, and gateways. This file is parsed by the ifup command to bring interfaces up with the specified settings, making it a valid method for persistent network configuration.

Answer

Using sysctl to set net.ipv4.conf.eth0.forwarding

Answer

Using systemctl enable network.service

Answer

Editing /etc/sysconfig/network