LFCS Networking Practice Test 11 — 15 Questions

Question 1

A Linux server has a single interface ens3 with address 203.0.113.10/24. The administrator runs `ss -tulnp` and sees that a service is listening on 127.0.0.1:8080 only. Remote clients on the Internet report they cannot reach the service on port 8080 even though the firewall allows the port. Which change is the most appropriate to allow remote access while preserving the service's intended exposure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Restart the service after changing its configuration to bind to 0.0.0.0 or the specific external address instead of 127.0.0.1.. A listener bound to 127.0.0.1 accepts only connections that originate on the local machine. Firewall rules and routing cannot change this. The correct remedy is to reconfigure the service to bind to 0.0.0.0 or the external address, then restart it so the new socket is created.

Answer

Add a route for 127.0.0.1 via ens3 so that external packets can reach the loopback address.

Answer

Enable IP forwarding with `sysctl -w net.ipv4.ip_forward=1` so that packets can be forwarded to the loopback listener.

Answer

Configure a DNAT rule redirecting external port 8080 to 127.0.0.1:8080 on the same host.

Question 2

A Linux router has two interfaces: wan0 with address 198.51.100.10/24 and lan0 with address 10.10.0.1/24. Hosts on 10.10.0.0/24 can ping the router's lan0 address but cannot reach any Internet host. The administrator has already enabled net.ipv4.ip_forward=1. Which command is required to allow the internal hosts to reach external networks?

Accepted Answer

iptables -t nat -A POSTROUTING -s 10.10.0.0/24 -o wan0 -j MASQUERADE. Forwarding lets packets pass between interfaces, but private RFC 1918 sources cannot traverse the public Internet. The router must rewrite the source address of outbound packets to its public address, which is done with source NAT. A POSTROUTING MASQUERADE rule on the WAN interface accomplishes this dynamically, using the interface's current address, and enables return traffic to be mapped back to the correct internal host.

Answer

iptables -A FORWARD -i lan0 -o wan0 -j ACCEPT

Answer

ip route add default via 198.51.100.1 dev lan0

Answer

iptables -t nat -A PREROUTING -i wan0 -j DNAT --to-destination 10.10.0.1

Question 3

A Linux server running NetworkManager has a Wi-Fi interface wlp3s0 that must connect to the corporate WPA2-Enterprise network 'CorpNet' with 802.1X PEAP authentication, using identity 'jdoe' and password 'S3cr3t!'. The administrator wants to create and activate this connection entirely from the command line without editing configuration files manually. Which sequence of commands will accomplish this?

Accepted Answer

nmcli con add type wifi ifname wlp3s0 con-name CorpNet ssid CorpNet, then nmcli con modify CorpNet wifi-sec.key-mgmt wpa-eap 802-1x.eap peap 802-1x.identity jdoe 802-1x.password 'S3cr3t!', then nmcli con up CorpNet. The correct approach uses 'nmcli con add type wifi' to create a profile, then 'nmcli con modify' to set 'wifi-sec.key-mgmt wpa-eap' and the 802.1X parameters (EAP method, identity, password), and finally 'nmcli con up' to activate it. WPA2-Enterprise requires 802.1X/EAP configuration, not a pre-shared key, and the connection type must match the wireless interface for NetworkManager to manage it properly.

Answer

nmcli con add type ethernet ifname wlp3s0 con-name CorpNet, then nmcli con up CorpNet

Answer

nmcli con add type wifi ifname wlp3s0 con-name CorpNet ssid CorpNet wifi-sec.key-mgmt wpa-psk wifi-sec.psk 'S3cr3t!'

Answer

nmcli dev wifi connect CorpNet password 'S3cr3t!'

Question 4

An administrator needs to assign a temporary IPv4 address of 10.20.30.40/24 to interface enp0s3 for immediate testing. The change should not persist after a reboot. Which command accomplishes this?

Accepted Answer

ip addr add 10.20.30.40/24 dev enp0s3. Temporary address changes are made directly in the kernel with the `ip` utility. Adding an address with `ip addr add` affects only the current runtime state, so a reboot restores the previous configuration. Persistent tools such as NetworkManager or editing configuration files are used when the change must survive restarts.

Answer

nmcli con mod enp0s3 ipv4.addresses 10.20.30.40/24

Answer

ifconfig enp0s3 10.20.30.40 netmask 255.255.255.0 up

Answer

ip route add 10.20.30.40/24 dev enp0s3

Question 5

A storage administrator must add a persistent secondary IPv4 address 192.0.2.50/24 to interface eth1 on a RHEL 9 server using NetworkManager. The primary address is already configured. Which command adds the address so that it survives a reboot?

Accepted Answer

nmcli con mod eth1 +ipv4.addresses 192.0.2.50/24 && nmcli con up eth1. On RHEL 9, NetworkManager stores connection profiles, and nmcli con mod edits them persistently. Using the + prefix before ipv4.addresses appends the new address to the existing list, preserving the primary address. Reactivating the connection with nmcli con up applies the change immediately, and the profile ensures the secondary address returns after a reboot.

Answer

ip addr add 192.0.2.50/24 dev eth1

Answer

echo 'IPADDR1=192.0.2.50' >> /etc/sysconfig/network-scripts/ifcfg-eth1 && systemctl restart network

Answer

nmcli con mod eth1 ipv4.addresses 192.0.2.50/24 && nmcli con up eth1

Question 6

A Linux server uses NetworkManager and has a wired connection profile named 'Wired connection 1'. The administrator needs to set a static IPv4 address 10.20.30.40/24 with gateway 10.20.30.1, and ensure the change persists across reboots. Which sequence of commands accomplishes this?

Accepted Answer

nmcli con mod 'Wired connection 1' ipv4.addresses 10.20.30.40/24 ipv4.gateway 10.20.30.1 ipv4.method manual && nmcli con up 'Wired connection 1'. The correct approach uses 'nmcli con mod' to alter the existing connection profile's IPv4 settings and set the method to manual, then brings the connection up to apply the changes. This persists the static address and gateway in NetworkManager's configuration, satisfying the reboot requirement. Lower-level ip commands are temporary and do not modify profiles, while creating a duplicate profile or using an invalid command would not achieve the goal.

Answer

nmcli dev modify eth0 ipv4.addresses 10.20.30.40/24 ipv4.gateway 10.20.30.1 ipv4.method manual

Answer

ip addr add 10.20.30.40/24 dev eth0 && ip route add default via 10.20.30.1

Answer

nmcli con add type ethernet con-name 'Wired connection 1' ifname eth0 ip4 10.20.30.40/24 gw4 10.20.30.1

Question 7

An administrator is diagnosing why a server cannot reach the host 198.51.100.25. The server has one interface, eth0, with address 192.0.2.10/24. Running `ip route show` returns only the default route via 192.0.2.1. Which two commands will help determine whether the problem is at layer 2 or layer 3? (Choose two.)

Accepted Answer

ip neigh show 192.0.2.1. To isolate layer 2 versus layer 3, check the neighbor table for the gateway and trace the path to the destination. An unresolved neighbor entry points to a layer 2 problem, while a resolved entry with a traceroute that stops beyond the first hop points to layer 3 or higher. Interface state and DNS queries do not make this distinction.

Answer

ss -tulnp | grep 198.51.100.25

Answer

ip link show eth0

Answer

dig +short 198.51.100.25

Question 8

A Linux server is configured with two network interfaces: eth0 (192.168.1.10/24) and eth1 (10.0.0.10/24). The default route is via 192.168.1.1. A network administrator wants to ensure that traffic to the 10.0.0.0/24 network uses eth1 and that the source address for that traffic is 10.0.0.10. Which command will achieve this?

Accepted Answer

ip route add 10.0.0.0/24 dev eth1 src 10.0.0.10. To direct traffic for a specific directly attached network out a particular interface and use a specific source address, the ip route add command with the dev and src options is used. This ensures packets to 10.0.0.0/24 leave via eth1 with source 10.0.0.10, fulfilling the requirement without affecting other traffic.

Answer

ip route add 10.0.0.0/24 via 10.0.0.1 dev eth1

Answer

ip route add 10.0.0.0/24 dev eth1

Answer

ip route add default via 10.0.0.1 dev eth1

Question 9

A Linux administrator needs to display the IP addresses and netmasks of all network interfaces on a server. Which command provides this information in a concise, modern format?

Accepted Answer

ip addr show. The 'ip addr show' command is the modern, preferred tool for displaying interface IP addresses and netmasks. It is part of iproute2, which is standard on current Linux systems, and its output clearly shows each interface's addresses in CIDR notation. The other commands either show different information (netstat -i, route -n) or are deprecated and not always installed (ifconfig).

Answer

netstat -i

Answer

route -n

Answer

ifconfig -a

Question 10

An administrator needs to allow incoming SSH connections on port 22 from the 192.168.50.0/24 subnet while blocking all other incoming SSH traffic, without disrupting existing established connections. Which command sequence using nftables accomplishes this?

Accepted Answer

nft add rule inet filter input tcp dport 22 ip saddr 192.168.50.0/24 accept; nft add rule inet filter input tcp dport 22 drop. nftables evaluates rules in the order they appear within a chain. To allow a specific source and block the rest, the accept rule for that source must precede the drop rule for the port. Reversing the order or inverting the match conditions produces the opposite of the desired policy.

Answer

nft add rule inet filter input tcp dport 22 drop; nft add rule inet filter input tcp dport 22 ip saddr 192.168.50.0/24 accept

Answer

nft add rule inet filter input tcp dport 22 ip saddr 192.168.50.0/24 drop; nft add rule inet filter input tcp dport 22 accept

Answer

nft add rule inet filter input ip saddr 192.168.50.0/24 tcp dport 22 accept; nft add rule inet filter input tcp dport 22 reject

Question 11

A junior administrator must temporarily assign the address 172.16.5.20/24 to interface eth1 on a running server so that a migration can be tested, and the change must not survive a reboot. Which command accomplishes this?

Accepted Answer

ip addr add 172.16.5.20/24 dev eth1. Temporary address changes are made directly in the kernel with the iproute2 ip addr add command. This affects the running system only and is lost on reboot, which is exactly what the migration test requires. Persistent configuration tools such as NetworkManager profiles or network configuration files would write the change to disk and reapply it at boot.

Answer

ip link set eth1 up && ip route add 172.16.5.20/24 dev eth1

Answer

ifconfig eth1 172.16.5.20 netmask 255.255.255.0

Answer

nmcli con mod eth1 ipv4.addresses 172.16.5.20/24 && nmcli con up eth1

Question 12

A Linux server has a single Ethernet interface eth0. The administrator needs to assign a static IPv4 address 192.0.2.10/24 with gateway 192.0.2.1 on a system that uses systemd-networkd. Which file should be created or edited to configure this interface?

Accepted Answer

/etc/systemd/network/10-eth0.network. systemd-networkd uses .network files stored in /etc/systemd/network/ (or /run and /usr/lib). A file such as 10-eth0.network with a [Match] section for eth0 and a [Network] section specifying Address=192.0.2.10/24 and Gateway=192.0.2.1 is the correct way to assign a static IPv4 configuration. The other paths belong to different network management frameworks.

Answer

/etc/network/interfaces

Answer

/etc/netplan/01-netcfg.yaml

Answer

/etc/sysconfig/network-scripts/ifcfg-eth0

Question 13

An administrator is troubleshooting name resolution on a server. Queries for internal names succeed, but every query for external names fails with 'connection timed out; no servers could be reached'. The file /etc/resolv.conf contains 'nameserver 10.20.30.40' and 'nameserver 10.20.30.41'. The internal DNS servers are reachable, and the administrator wants to test which external name servers actually respond. Which command best performs this test?

Accepted Answer

dig @8.8.8.8 example.com. To determine whether an external resolver responds, the query must be sent directly to that resolver rather than to the servers in resolv.conf. The dig command's @server syntax does exactly this, bypassing local configuration. If a direct query to a public resolver succeeds, the problem is with the internal servers' forwarding or recursion; if it fails, outbound DNS traffic is likely blocked.

Answer

getent hosts example.com

Answer

nslookup 8.8.8.8 example.com

Answer

dig example.com

Question 14

An administrator needs to view the current IPv4 addresses, link state, and interface names on a Linux server without making any changes. Which command provides this information in a single invocation?

Accepted Answer

ip addr show. The ip command from iproute2 is the current standard for network configuration and inspection. ip addr show lists every interface with its operational state, MAC address, and assigned IPv4/IPv6 addresses, which is precisely the information requested. The other commands either show unrelated data or belong to deprecated tooling.

Answer

ifconfig -a

Answer

ss -tuln

Answer

ip route show

Question 15

A server must resolve internal hostnames using a DNS server at 10.0.0.53 before falling back to public resolvers. The administrator edits /etc/systemd/resolved.conf and sets DNS=10.0.0.53 and FallbackDNS=8.8.8.8. After restarting systemd-resolved, queries for internal names still fail. Which additional step is most likely required?

Accepted Answer

Ensure /etc/resolv.conf is a symlink to /run/systemd/resolve/stub-resolv.conf or /run/systemd/resolve/resolv.conf.. systemd-resolved reads DNS server settings from resolved.conf, but applications reach it through /etc/resolv.conf. If that file is not symlinked to the stub or full resolv.conf generated by systemd-resolved, the configured servers are ignored. Recreating the symlink ensures queries go through systemd-resolved and reach 10.0.0.53.

Answer

Add the search domain to /etc/hosts so internal names resolve locally.

Answer

Run resolvectl flush-caches to clear stale entries.

Answer

Set DNSSEC=no in resolved.conf because DNSSEC validation is blocking internal responses.