LFCS Networking Practice Test 10 — 15 Questions

Question 1

A Linux server has two interfaces, ens5 (203.0.113.10/24) and ens6 (10.20.0.0/24 gateway for internal clients). Internal clients must reach the internet through ens5. The administrator has enabled net.ipv4.ip_forward=1 and configured NAT on ens5, but clients still cannot reach external hosts. Which two additional checks are most likely to resolve the problem? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Confirm that the MASQUERADE or SNAT rule matches the outbound interface and source subnet correctly.. When IP forwarding and NAT appear configured but clients still fail, the two most common culprits are a restrictive FORWARD chain that drops inter-interface traffic and a NAT rule whose interface or source match is wrong. Both must be verified because either alone prevents end-to-end connectivity for the internal subnet.

Answer

Disable the reverse path filter by setting net.ipv4.conf.all.rp_filter to 2.

Answer

Add a static route on the internal clients pointing to the public internet address 203.0.113.10 as the next hop.

Answer

Ensure that the server's default route points to the upstream router on the ens5 network.

Question 2

A technician needs to view the current IPv4 addresses, netmasks, and interface states for all network interfaces on a Linux server. Which command displays this information in a structured, modern format?

Accepted Answer

ip addr show. The ip addr show command is the standard modern tool for displaying interface addresses, netmasks, and states. It is part of iproute2 and provides both IPv4 and IPv6 details in a structured format. The other commands either show routing tables, socket statistics, or rely on deprecated tools that do not present the requested information in the required format.

Answer

netstat -rn

Answer

ss -tuln

Answer

ifconfig -a

Question 3

An administrator must ensure that a Linux router forwards IPv4 packets between its two interfaces, eth0 and eth1, without rebooting. Which command enables this behavior immediately?

Accepted Answer

sysctl -w net.ipv4.ip_forward=1. Enabling IPv4 forwarding requires setting the kernel parameter net.ipv4.ip_forward to 1. The sysctl -w command applies this change at runtime, immediately allowing the router to forward packets between interfaces. Firewall rules and interface states are separate concerns; they do not substitute for the kernel forwarding parameter.

Answer

iptables -A FORWARD -j ACCEPT

Answer

echo 1 > /proc/sys/net/ipv4/ip_forward

Answer

ip link set eth0 up && ip link set eth1 up

Question 4

A Linux server has an interface eth0 with IP 192.168.1.100/24. You need to temporarily add a secondary IP address 192.168.1.101/24 to the same interface for testing, and then verify that both addresses are present. Which two commands will accomplish this? (Choose two.)

Accepted Answer

ip addr show dev eth0. To add a secondary IP address temporarily, use 'ip addr add 192.168.1.101/24 dev eth0'. To verify, use 'ip addr show dev eth0'. The ifconfig command would replace the primary address, not add a secondary. The ip route command is for routing, and ip link set up only changes the interface state.

Answer

ip link set eth0 up

Answer

ip route add 192.168.1.101/24 dev eth0

Answer

ifconfig eth0 192.168.1.101 netmask 255.255.255.0

Question 5

A Linux router has two interfaces: eth0 (203.0.113.10/24) connected to the internet and eth1 (10.10.0.1/24) connected to an internal network. Internal clients can ping the router's eth1 address but cannot reach external websites. IP forwarding is enabled, and no firewall rules are present. Which command will allow the internal clients to reach the internet by masquerading their traffic?

Accepted Answer

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE. For internal clients to reach the internet through a router, their private source addresses must be translated to the router's public address. This is done with a MASQUERADE rule in the nat table's POSTROUTING chain, applied to packets leaving the external interface. The other options either use the wrong chain, only permit forwarding without translation, or masquerade in the wrong direction.

Answer

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

Answer

iptables -t nat -A PREROUTING -i eth1 -j MASQUERADE

Answer

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

Question 6

An administrator is diagnosing a Linux router that forwards packets between two internal subnets. Users on 10.20.30.0/24 can reach hosts on 10.20.40.0/24, but responses from 10.20.40.0/24 arrive with the router's external address as the source. The administrator wants to inspect the NAT rules without modifying them. Which command displays the current rules in the nat table with packet and byte counters?

Accepted Answer

iptables -t nat -L -n -v. The nat table holds the PREROUTING, OUTPUT, and POSTROUTING chains where SNAT, DNAT, and MASQUERADE rules live. To inspect them with hit counters, iptables must be invoked with -t nat and the verbose flag -v, plus -n to avoid DNS lookups. This gives a clear picture of which rule is rewriting source addresses on the return path, without altering any rule.

Answer

nft list ruleset

Answer

iptables -L -n -v

Answer

iptables -t nat -S

Question 7

A Linux server has two interfaces: enp3s0 (192.168.10.5/24) and enp4s0 (10.0.0.5/24). The default route is via 192.168.10.1. A junior admin adds a static route to 10.1.0.0/16 via 10.0.0.1 using the command: ip route add 10.1.0.0/16 via 10.0.0.1. After this, users report that traffic to 10.1.1.0/24 fails. Which command should the administrator run to confirm that the kernel is selecting the correct route and interface for destination 10.1.1.10?

Accepted Answer

ip route get 10.1.1.10. The kernel chooses routes based on longest prefix match and metric. To verify which route and interface are selected for a specific destination, the ip route get command is used. It performs a route lookup and displays the resolved source address, gateway, and output interface, directly answering why traffic to 10.1.1.0/24 may fail despite a static route being added.

Answer

ip -s link show enp4s0

Answer

ip route show table all

Answer

traceroute -n 10.1.1.10

Question 8

A Linux server needs to resolve the hostname db.internal.example.com to an IP address. The administrator wants to query the DNS server directly without relying on the local resolver cache. Which command should be used?

Accepted Answer

dig db.internal.example.com. The dig command is the standard tool for querying DNS servers directly. It sends a DNS query and displays the response, bypassing local caching mechanisms like nscd or systemd-resolved. Other commands either rely on the system resolver, display local host information, or show configuration files without performing a lookup.

Answer

hostname -f

Answer

ping db.internal.example.com

Answer

cat /etc/resolv.conf

Question 9

You need to check the default gateway on a Linux server. Which command displays the current routing table, including the default route?

Accepted Answer

ip route show. The correct command is 'ip route show', which displays the routing table including the default route. The other commands show interface configuration (ifconfig), interface statistics (netstat -i), or listening sockets (ss -tuln), none of which reveal the default gateway.

Answer

ifconfig -a

Answer

ss -tuln

Answer

netstat -i

Question 10

A junior administrator needs to verify that the host can resolve the name db.internal.example.com to an IPv4 address before deploying a database client. The system uses systemd-resolved. Which command queries the configured resolver and displays the answer without relying on the local nsswitch.conf ordering?

Accepted Answer

resolvectl query db.internal.example.com. resolvectl query is the native client for systemd-resolved. It sends the query through the resolver daemon, showing the answer, the link used, and the DNS server that responded. This isolates DNS resolution from nsswitch.conf sources like /etc/hosts, which is exactly what is needed to confirm the configured resolver can resolve the name.

Answer

dig db.internal.example.com

Answer

host db.internal.example.com

Answer

getent hosts db.internal.example.com

Question 11

A Linux server is configured as a router with IP forwarding enabled. It has two interfaces: eth0 (203.0.113.5/24) and eth1 (192.168.1.1/24). Clients on 192.168.1.0/24 need to reach the internet via eth0. The administrator has set up NAT using iptables with the rule: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE. However, clients cannot access external websites. Which two actions should the administrator take to resolve the issue? (Choose two.)

Accepted Answer

Verify that IP forwarding is enabled by checking the value of net.ipv4.ip_forward.. For a Linux router to forward traffic between interfaces, IP forwarding must be enabled, and the FORWARD chain must permit the traffic. Even with MASQUERADE configured, if either condition is not met, packets will be dropped. The administrator should verify net.ipv4.ip_forward and ensure FORWARD rules allow traffic from the internal to external interface.

Answer

Add a SNAT rule instead of MASQUERADE for better performance.

Answer

Disable the firewall on the clients to allow outbound connections.

Answer

Configure a default route on the router pointing to the ISP gateway.

Question 12

A Linux server has two network interfaces: eth0 (192.168.1.10/24) and eth1 (10.0.0.10/24). The administrator wants to configure the server to route traffic between the two networks. Which two actions are required? (Choose two.)

Accepted Answer

Configure iptables FORWARD rules to accept traffic between the interfaces.. To route traffic between two directly connected networks, the server must have IP forwarding enabled and firewall rules that permit forwarding. Connected routes already exist, so static routes for those networks are not needed. NAT is not required for internal routing, and client gateway configuration is done on the clients, not the server.

Answer

Set the default gateway on both client networks to point to the server's respective interface addresses.

Answer

Enable NAT (masquerading) on the server for both networks.

Answer

Add static routes on the server for both networks.

Question 13

A Linux server has a DNS resolver configuration in /etc/resolv.conf. You need to add a new DNS server at 8.8.8.8 and ensure it is used before the existing server. Which line should you add to the top of /etc/resolv.conf?

Accepted Answer

nameserver 8.8.8.8. The correct line is 'nameserver 8.8.8.8'. The resolver reads nameserver entries in order, so placing it at the top makes it the first server used. The other options use invalid keywords or syntax that would not be recognized by the resolver.

Answer

dns 8.8.8.8

Answer

nameserver 8.8.8.8:53

Answer

search 8.8.8.8

Question 14

A technician must verify which network services are listening on TCP ports and which processes own them on a production server. Which command provides this information directly?

Accepted Answer

ss -tlnp. The ss utility with the -tlnp flags enumerates TCP listening sockets, keeps addresses numeric, and shows the owning process for each. This single command answers both parts of the requirement: which ports are listening and which processes hold them. The other tools either display unrelated tables or cover only a single port.

Answer

lsof -i :22

Answer

netstat -rn

Answer

ip neigh show

Question 15

A Linux server's primary interface is ens3. Administrators report that after a recent reboot, the server's hostname resolves to 127.0.1.1 instead of its static address 203.0.113.25. The file /etc/hosts currently contains only the default '127.0.0.1 localhost' line. Which single change will make the hostname resolve to 203.0.113.25 for local lookups while leaving DNS resolution for all other names untouched?

Accepted Answer

Add the line '203.0.113.25 server1.example.com server1' to /etc/hosts.. Local name resolution follows the order defined in nsswitch.conf, which by default checks the hosts file before DNS. Because the hosts file only contains the loopback line, the hostname has no local mapping. Adding a hosts entry that pairs the hostname and FQDN with the actual interface address makes the machine resolve its own name to 203.0.113.25 without disturbing DNS lookups for any other domain.

Answer

Add the line '127.0.1.1 server1.example.com server1' to /etc/hosts.

Answer

Add 'hosts: dns files' to /etc/nsswitch.conf so DNS is consulted before the hosts file.

Answer

Add an A record for server1.example.com pointing to 203.0.113.25 in the zone file on the authoritative DNS server.