LFCS Networking Practice Test 4 — 15 Questions

Question 1

You are a Linux administrator for a small company. A developer has deployed a web application on a server with IP 192.168.1.50. The application needs to connect to a database server at 10.0.0.100 on TCP port 3306. Both servers are on the same physical network but different subnets (192.168.1.0/24 and 10.0.0.0/24) connected by a router. The default gateway for the app server is 192.168.1.1, and for the DB server is 10.0.0.1. You have verified that the app server can ping the DB server by IP address successfully. However, the application fails to connect to the database. You have used telnet from the app server to test connectivity on port 3306 and it fails (connection refused). On the DB server, you check that the MySQL service is listening on 0.0.0.0:3306 and that the local firewall (firewalld) allows incoming connections on port 3306. What is the most likely cause of the connection failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The app server's firewall is blocking outgoing connections to port 3306.. The app server can ping the DB server, confirming Layer 3 connectivity via ICMP. However, the telnet test fails on port 3306, indicating the TCP SYN packet is not reaching the DB server or the SYN-ACK is not returning. While ping uses ICMP, which may be allowed by the app server's firewall, outbound TCP traffic to port 3306 could be blocked by the local firewall (firewalld) on the app server. This is the most plausible cause because the DB server is configured correctly and the network path is functional for ICMP. Option B is correct.

Answer

The network cable is faulty.

Answer

The router does not have a route to 192.168.1.0/24 from the DB server's subnet, so return packets are dropped.

Answer

The database service is only listening on the loopback interface (127.0.0.1).

Question 2

An administrator is configuring a Linux server to act as a web server. The server has two network interfaces: eth0 (public IP 203.0.113.10) and eth1 (private IP 10.0.0.10). The default policy on the INPUT chain is DROP. The administrator wants to allow incoming HTTP (port 80) traffic from any source but only to the public interface. Which TWO iptables rules should be added?

Accepted Answer

iptables -A INPUT -d 203.0.113.10 -p tcp --dport 80 -j ACCEPT. It specifies the destination IP address (203.0.113.10) of the public interface, ensuring that HTTP traffic is only accepted when destined for that IP. Option C is also correct because it uses the `-i eth0` flag to match incoming traffic on the public interface only, which restricts HTTP access to the public-facing interface. Both rules are needed to satisfy the requirement of allowing HTTP from any source but only to the public interface, given the default DROP policy on the INPUT chain.

Answer

iptables -A FORWARD -i eth0 -p tcp --dport 80 -j ACCEPT

Answer

iptables -A INPUT -s 203.0.113.10 -p tcp --dport 80 -j ACCEPT

Answer

iptables -A INPUT -i eth1 -p tcp --dport 80 -j ACCEPT

Question 3

A Linux system administrator is troubleshooting a DNS resolution issue on a Ubuntu 20.04 server. The server is configured with a static IP address on interface eth0 via /etc/netplan/01-netcfg.yaml. The administrator set the DNS servers to 8.8.8.8 and 8.8.4.4 in the cloud-config file. After applying the netplan configuration, the server can resolve hostnames correctly. However, after a few days, users report that the server can no longer resolve external hostnames. The administrator checks /etc/resolv.conf and sees that it contains only a local DNS server (127.0.0.53) and no references to the public DNS servers. The administrator wants to ensure that the public DNS servers are always used and that local DNS is bypassed. What is the best course of action?

Accepted Answer

Modify the netplan configuration to set dns servers and set 'dhcp4-overrides: {use-dns: false}' then apply.. In Ubuntu 20.04, netplan uses systemd-resolved by default, which listens on 127.0.0.53. Setting 'dhcp4-overrides: {use-dns: false}' in the netplan configuration prevents DHCP from overriding the manually specified DNS servers, ensuring that only the public DNS servers (8.8.8.8 and 8.8.4.4) are used for resolution. After applying with 'netplan apply', systemd-resolved will forward queries to those public servers, bypassing the local stub resolver.

Answer

Directly edit /etc/resolv.conf to add the public DNS servers and make it immutable using chattr +i.

Answer

Use the 'host' command to force DNS queries to use a specific server.

Answer

Stop and disable the systemd-resolved service using systemctl.

Question 4

An administrator is configuring network bonding on a RHEL 7 server with two physical NICs (eth0 and eth1) to provide redundancy. The bond interface bond0 is configured with mode 1 (active-backup). The administrator uses the following configuration in /etc/sysconfig/network-scripts/ifcfg-bond0: BONDING_OPTS="miimon=100 mode=1". The slave interfaces are configured with MASTER=bond0 and SLAVE=yes. After restarting the network service, the bond interface comes up with the active link on eth0. To test failover, the administrator disconnects the cable from eth0. The bond interface does not fail over to eth1. The administrator checks /proc/net/bonding/bond0 and sees that both slaves are listed but eth0 is still marked as active even though the cable is disconnected. What is the most likely reason for the failover failure?

Accepted Answer

Add arp_interval=1000 and arp_ip_target=192.168.1.1 to BONDING_OPTS.. In mode 1 (active-backup), the bonding driver uses MII monitoring (miimon) to detect link state changes via the physical carrier signal. However, some switches or NICs do not properly report carrier loss when a cable is disconnected, causing miimon to miss the failure. Adding arp_interval and arp_ip_target forces the bonding driver to use ARP-based monitoring, which actively probes a target IP to verify link availability, thus detecting failures that miimon cannot see.

Answer

Change bonding mode to mode 4 (802.3ad load balancing).

Answer

Remove one slave and re-add it to force a failover.

Answer

Check /var/log/messages for bonding driver errors.

Question 5

A system administrator needs to configure a network bond on a Linux server using NetworkManager. Which TWO steps are required to create a functional bond interface?

Accepted Answer

Use 'nmcli connection add type bond ifname bond0' to create the bond interface.. Option C is correct because creating the bond interface itself is the foundational step: 'nmcli connection add type bond ifname bond0' defines a NetworkManager connection profile of type bond bound to the bond0 device, which is required before any slaves can be attached. Option D is correct because a bond is non-functional without member interfaces, and 'nmcli connection add type ethernet ifname eth0 master bond0' creates an Ethernet connection profile that is enslaved to bond0 via the master property, which is the supported NetworkManager method for adding a slave. Option A is not required because 'balance-rr' is only one possible bonding mode; the default mode (balance-rr is actually the kernel default, but NetworkManager profiles can use other modes such as active-backup) is not mandatory for a functional bond. Option B is not required because NetworkManager automatically loads the bonding kernel module when a bond connection is activated, so a manual 'modprobe bonding' is unnecessary. Option E is not required because slave interfaces do not need to be down beforehand; NetworkManager handles enslaving and bringing up the interfaces as part of activating the bond connection.

Answer

Set the bond mode to 'balance-rr' in the connection profile.

Answer

Load the bonding kernel module using 'modprobe bonding'.

Answer

Ensure that the slave interfaces are down before adding them to the bond.

Question 6

Refer to the exhibit. A system administrator notices that SSH connections to the server are being dropped immediately. Assuming the server's external interface is eth0, which rule is responsible for this behavior?

Accepted Answer

Rule 3. Rule 3 is the rule that drops SSH traffic. In a typical iptables exhibit, rules are evaluated top-down; a DROP or REJECT rule matching TCP port 22 (SSH) on the external interface eth0 will immediately terminate incoming SSH connections. Since the administrator observes SSH connections being dropped immediately, the rule explicitly matching SSH and taking a DROP/REJECT action is responsible.

Answer

Both Rule 2 and Rule 3

Answer

Rule 1

Answer

Rule 2

Question 7

A Linux server hosts a critical web application and is connected to the corporate network via a bonded interface bond0, combining eth0 and eth1 in active-backup mode. The server has a static IP 192.168.1.100/24 and default gateway 192.168.1.1. Recently, users report intermittent connectivity. The administrator runs 'ip link show' and sees that eth0 and eth1 are both state UP, but bond0 shows 'state UP' and 'NO-CARRIER'. The bond primary slave is eth0. Also, 'ping 192.168.1.1' fails. What should the administrator do next?

Accepted Answer

Check the physical cable connection of eth0.. The bond0 interface shows 'NO-CARRIER' despite eth0 and eth1 being UP, indicating that the bond is not receiving a carrier signal from its active slave. Since eth0 is the primary slave and the bond is in active-backup mode, the issue likely lies with eth0's physical connection. Checking the physical cable connection of eth0 is the most appropriate next step to restore connectivity.

Answer

Add a secondary IP address to eth0.

Answer

Restart the NetworkManager service.

Answer

Change the bond mode to balance-rr to load balance traffic.

Question 8

A Linux server has a single network interface named ens3. The administrator needs to temporarily assign the IPv4 address 10.20.30.40/24 to ens3 without disrupting existing connections. Which command accomplishes this?

Accepted Answer

ip addr add 10.20.30.40/24 dev ens3. The ip addr add command attaches an additional IPv4 address to an interface while preserving any existing addresses, satisfying the non-disruptive requirement. It is part of the iproute2 suite, standard on modern Linux systems. Using replace, ifconfig, or a route command would either remove existing addresses, rely on deprecated tools, or fail to assign an address at all.

Answer

ip route add 10.20.30.40/24 dev ens3

Answer

ip addr replace 10.20.30.40/24 dev ens3

Answer

ifconfig ens3 10.20.30.40 netmask 255.255.255.0

Question 9

A Linux server has two interfaces: eth0 (192.168.1.10/24) and eth1 (10.0.0.10/24). You want to allow IP forwarding between them and ensure it persists after reboot. Which command correctly enables IPv4 forwarding at runtime?

Accepted Answer

sysctl -w net.ipv4.ip_forward=1. The correct command is 'sysctl -w net.ipv4.ip_forward=1', which enables IPv4 forwarding at runtime. This is a standard sysctl operation. While writing to /proc/sys works, the sysctl utility is the expected tool. The 'sysctl -p' option loads from a file and does not accept inline assignments. The iptables NAT rule does not enable forwarding.

Answer

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Answer

sysctl -p net.ipv4.ip_forward=1

Answer

echo 1 > /proc/sys/net/ipv4/ip_forward

Question 10

A Linux server has a single Ethernet interface named ens3 that must receive its IPv4 address dynamically, but the administrator also wants to guarantee that the DNS resolver 203.0.113.53 is always used regardless of what the DHCP server advertises. The system uses Netplan on Ubuntu Server 22.04. Which Netplan configuration snippet accomplishes this?

Accepted Answer

network:
  version: 2
  ethernets:
    ens3:
      dhcp4: true
      nameservers:
        addresses: [203.0.113.53]. Netplan combines DHCP for addressing with a static nameservers block to force a specific resolver. The dhcp4: true setting acquires the IP, route, and other options from the DHCP server, while nameservers.addresses overrides whatever DNS the DHCP server advertised. This is the standard pattern for servers that must use an internal resolver regardless of the DHCP scope configuration, and it is applied with netplan apply.

Answer

network:
  version: 2
  ethernets:
    ens3:
      dhcp4: true
      dns: [203.0.113.53]

Answer

network:
  version: 2
  ethernets:
    ens3:
      dhcp4: true
      dhcp4-overrides:
        use-dns: false
      nameservers:
        addresses: [203.0.113.53]

Answer

network:
  version: 2
  ethernets:
    ens3:
      dhcp4: true
      nameservers:
        search: [203.0.113.53]

Question 11

An administrator wants to inspect DNS responses for the domain example.com without performing full resolution, and needs to see the authority section returned by the server. Which command best fits this requirement?

Accepted Answer

dig example.com ANY +noall +authority. The dig utility provides granular control over which sections of a DNS response are printed. Combining +noall with +authority displays only the authority section, which holds the NS records for the queried zone. Other tools such as host, nslookup, and getent do not offer this level of section-level filtering.

Answer

getent hosts example.com

Answer

nslookup -type=SOA example.com

Answer

host -t NS example.com

Question 12

A Linux server needs to resolve hostnames using DNS servers at 8.8.8.8 and 8.8.4.4. The administrator wants to configure these resolvers statically so they persist across reboots, without relying on DHCP. Which two files can be edited to set these DNS servers? (Choose two.)

Accepted Answer

/etc/resolv.conf. DNS servers can be configured statically by editing /etc/resolv.conf directly, or on systemd-resolved systems by editing /etc/systemd/resolved.conf. The resolv.conf file is the traditional location, while resolved.conf is the persistent configuration for systems using the systemd-resolved stub resolver. The other files control name service order, static host mappings, or DHCP client behavior, and do not serve as general static DNS server configuration.

Answer

/etc/hosts

Answer

/etc/nsswitch.conf

Answer

/etc/dhcp/dhclient.conf

Question 13

An administrator is configuring a Linux host to act as a router between two internal networks. The kernel must forward IPv4 packets between interfaces. Which two commands achieve this immediately and persistently? (Choose two.)

Accepted Answer

echo 1 > /proc/sys/net/ipv4/ip_forward. Enabling IPv4 forwarding requires both an immediate runtime change and a persistent configuration. sysctl -w net.ipv4.ip_forward=1 or writing to /proc/sys/net/ipv4/ip_forward flips the kernel parameter right away, while adding net.ipv4.ip_forward = 1 to a sysctl configuration file ensures the setting survives reboots. Together they satisfy the immediate and persistent requirement.

Answer

ip route add default via 192.0.2.1 dev eth0

Answer

Add net.ipv4.ip_forward=1 to /etc/sysctl.d/99-forward.conf and run sysctl --system

Answer

Add net.ipv4.ip_forward = 1 to /etc/sysctl.conf

Question 14

A Linux server has a single NIC named ens3 that must use DHCP for its IPv4 address. The administrator uses Netplan on Ubuntu Server 22.04 and wants the lease to be renewed with a new address immediately after applying the configuration. Which sequence of commands will apply a Netplan configuration that requests a DHCP lease and then force the interface to acquire a new address?

Accepted Answer

Run netplan generate, then run netplan apply, then run networkctl renew ens3.. Netplan translates YAML into backend configuration for systemd-networkd or NetworkManager. Applying the configuration with netplan apply is required, and when systemd-networkd is the renderer, networkctl renew ens3 triggers a DHCP lease renewal. This sequence applies the intended DHCP configuration and forces a fresh address, which is the goal of the scenario.

Answer

Run netplan apply, then run ip link set ens3 down && ip link set ens3 up.

Answer

Run netplan apply, then run netplan renew ens3.

Answer

Run netplan try, then run dhclient -r ens3 && dhclient ens3.

Question 15

A Linux server has a single network interface eth0 with IP address 192.168.1.10/24. The administrator needs to allow incoming SSH connections only from the 192.168.1.0/24 subnet and block all other SSH traffic. Which iptables rule should be added to the INPUT chain to achieve this?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT. To allow SSH from a specific subnet, a rule in the INPUT chain matching TCP port 22 and the source subnet with a target of ACCEPT is needed. Typically, a default DROP policy or a subsequent DROP rule for other sources would enforce the restriction. The rule must be in INPUT because it filters incoming traffic.

Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j DROP

Answer

iptables -A OUTPUT -p tcp --sport 22 -d 192.168.1.0/24 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -d 192.168.1.0/24 -j ACCEPT