LFCS Networking Practice Test 7 — 15 Questions

Question 1

A system administrator needs to ensure that a Linux server can communicate with other hosts on the same subnet. Which command should be used to verify the IP address and netmask configuration?

Accepted Answer

ip addr show. The `ip addr show` command is the modern, recommended tool in Linux for viewing IP addresses and netmasks (prefix lengths) assigned to network interfaces. It directly displays the configuration needed to verify subnet communication, unlike legacy tools that may not show the netmask clearly or mix routing information.

Answer

netstat -rn

Answer

route -n

Answer

ifconfig

Question 2

A user reports that they cannot reach a remote server by hostname but can reach it by IP address. Which configuration file is most likely misconfigured?

Accepted Answer

/etc/resolv.conf. The /etc/resolv.conf file configures the system's DNS resolver, specifying the nameservers to query for hostname-to-IP resolution. If a user can reach a server by IP but not by hostname, it indicates that DNS resolution is failing, which is most commonly due to a missing or incorrect nameserver entry in /etc/resolv.conf.

Answer

/etc/sysconfig/network

Answer

/etc/hosts

Answer

/etc/nsswitch.conf

Question 3

A system administrator wants to allow incoming SSH connections from a specific IP range 192.168.10.0/24 using firewalld. Which command should be used?

Accepted Answer

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.10.0/24" service name="ssh" accept' --permanent. It explicitly targets the 'public' zone (the default zone for external-facing interfaces) and uses a rich rule to allow SSH traffic only from the 192.168.10.0/24 source IP range. The --permanent flag ensures the rule persists across reloads. This is the precise syntax required by firewalld for source-specific service access.

Answer

firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.10.0/24" service name="ssh" accept' --permanent

Answer

firewall-cmd --add-service=ssh --add-source=192.168.10.0/24 --zone=internal --permanent

Answer

firewall-cmd --add-source=192.168.10.0/24 --add-service=ssh --permanent

Question 4

A network interface eth0 is not receiving an IP address via DHCP. Which command can be used to troubleshoot the DHCP client process?

Accepted Answer

dhclient -v eth0. The `dhclient -v eth0` command runs the DHCP client in verbose mode on interface eth0, which is the correct tool to troubleshoot the DHCP client process. It shows detailed messages about the DHCPDISCOVER, DHCPOFFER, DHCPREQUEST, and DHCPACK exchange, helping identify where the process fails. This directly addresses the issue of the interface not receiving an IP address via DHCP.

Answer

systemctl status dhcpd

Answer

nmcli dev show eth0

Answer

dhcpd -t

Question 5

A server has two network interfaces: eth0 (192.168.1.10/24) and eth1 (10.0.0.10/24). The default gateway is 192.168.1.1. The administrator wants traffic to 10.0.1.0/24 to go through eth1's gateway 10.0.0.1. Which command adds this route?

Accepted Answer

Both B and C are correct. Both B and C are valid `ip route add` syntax variations that achieve the same result: adding a route to 10.0.1.0/24 via gateway 10.0.0.1 on interface eth1. The `ip route` command accepts the `via` and `dev` keywords in either order, making both B and C syntactically correct. Option D uses the legacy `route` command with improper syntax (missing `dev` keyword before the interface name), which would fail or produce unexpected behavior.

Answer

ip route add 10.0.1.0/24 via 10.0.0.1 dev eth1

Answer

ip route add 10.0.1.0/24 dev eth1 via 10.0.0.1

Answer

route add -net 10.0.1.0 netmask 255.255.255.0 gw 10.0.0.1 eth1

Question 6

An administrator is configuring a bridge using iproute2. Which command correctly attaches eth0 to bridge br0?

Accepted Answer

ip link set eth0 master br0. The `ip link set eth0 master br0` command attaches the physical interface `eth0` as a slave port of the bridge `br0` using the iproute2 suite. The `master` keyword specifies the bridge device that should become the master of the specified interface, which is the standard way to add an interface to a bridge with iproute2.

Answer

ip link set br0 master eth0

Answer

nmcli device modify eth0 master br0

Answer

brctl addif br0 eth0

Question 7

To permanently disable IPv6 on a network interface, which configuration should be added to /etc/sysctl.conf?

Accepted Answer

net.ipv6.conf.all.disable_ipv6 = 1. The sysctl parameter `net.ipv6.conf.all.disable_ipv6 = 1` is the proper kernel interface to globally disable IPv6 on all network interfaces. This setting is applied via the sysctl system, which reads `/etc/sysctl.conf` at boot to configure kernel parameters. The key must use the exact `disable_ipv6` suffix (not `disable`) and the `all` scope ensures the setting applies to every interface, including future ones.

Answer

net.ipv6.conf.all.disable=1

Answer

ipv6.disable=1

Answer

net.ipv6.conf.eth0.disable_ipv6 = 1

Question 8

A system administrator runs 'ss -tuln' and sees that port 80 is listening. What does the 'u' option represent?

Accepted Answer

UDP. In the `ss` command, the `-u` option filters output to show only UDP sockets. Since the question shows `ss -tuln`, which combines `-t` (TCP), `-u` (UDP), `-l` (listening), and `-n` (numeric), the `u` specifically represents UDP. This is confirmed by the `ss` man page and standard Linux networking tools.

Answer

User

Answer

Unix sockets

Answer

Unicast

Question 9

A system administrator needs to check the firewall rules on a Linux server using firewalld. Which two commands can be used to list the current rules? (Choose two.)

Accepted Answer

firewall-cmd --list-all-zones. `firewall-cmd --list-all-zones` displays the firewall rules for all zones configured in firewalld, showing services, ports, and rules per zone. Option E is correct because `firewall-cmd --list-all` lists the rules for the default zone, providing a concise view of active firewall configuration. Both commands are native to firewalld and directly query its runtime and permanent rules via D-Bus.

Answer

systemctl status firewalld

Answer

iptables -S

Answer

iptables -L

Question 10

A server with two network interfaces needs to forward IP packets between them. Which two steps are required to enable IP forwarding? (Choose two.)

Accepted Answer

Run sysctl -p. `sysctl -p` reloads kernel parameters from `/etc/sysctl.conf`, making the `net.ipv4.ip_forward=1` setting active without a reboot. Option C is correct because setting `net.ipv4.ip_forward=1` in `/etc/sysctl.conf` enables IP forwarding persistently across reboots. Together, these two steps ensure the kernel forwards IP packets between network interfaces.

Answer

Run systemctl restart network

Answer

Add a route to the second interface

Answer

Set net.ipv4.conf.all.forwarding=1

Question 11

An administrator is troubleshooting DNS resolution and wants to query the SOA record for a domain. Which three commands can be used? (Choose three.)

Accepted Answer

nslookup -type=soa example.com. The `nslookup -type=soa` command queries the DNS for the Start of Authority (SOA) record of a domain. The `-type=soa` flag explicitly sets the query type to SOA, which returns authoritative information about the zone, including the primary name server and administrator email.

Answer

nmcli dev show

Answer

getent hosts example.com

Question 12

You are a Linux administrator for a small company. A developer has deployed a web application on a server with IP 192.168.1.50. The application needs to connect to a database server at 10.0.0.100 on TCP port 3306. Both servers are on the same physical network but different subnets (192.168.1.0/24 and 10.0.0.0/24) connected by a router. The default gateway for the app server is 192.168.1.1, and for the DB server is 10.0.0.1. You have verified that the app server can ping the DB server by IP address successfully. However, the application fails to connect to the database. You have used telnet from the app server to test connectivity on port 3306 and it fails (connection refused). On the DB server, you check that the MySQL service is listening on 0.0.0.0:3306 and that the local firewall (firewalld) allows incoming connections on port 3306. What is the most likely cause of the connection failure?

Accepted Answer

The app server's firewall is blocking outgoing connections to port 3306.. The app server can ping the DB server, confirming Layer 3 connectivity via ICMP. However, the telnet test fails on port 3306, indicating the TCP SYN packet is not reaching the DB server or the SYN-ACK is not returning. While ping uses ICMP, which may be allowed by the app server's firewall, outbound TCP traffic to port 3306 could be blocked by the local firewall (firewalld) on the app server. This is the most plausible cause because the DB server is configured correctly and the network path is functional for ICMP. Option B is correct.

Answer

The network cable is faulty.

Answer

The router does not have a route to 192.168.1.0/24 from the DB server's subnet, so return packets are dropped.

Answer

The database service is only listening on the loopback interface (127.0.0.1).

Question 13

You administer a Linux server that acts as a network gateway. It has two network interfaces: eth0 (external, with IP 203.0.113.10/24, gateway 203.0.113.1) and eth1 (internal, with IP 192.168.1.1/24). The server is running firewalld and has IP forwarding enabled. Internal hosts (192.168.1.0/24) can access the internet through NAT, which is configured using firewalld's masquerade on the external zone. However, you need to allow a specific internal server (192.168.1.100) to be reachable from the internet on TCP port 443 (HTTPS). You add a port forwarding rule using firewall-cmd: 'firewall-cmd --zone=external --add-forward-port=port=443:proto=tcp:toport=443:toaddr=192.168.1.100'. After reloading the firewall, external users still cannot connect to 203.0.113.10:443. You verify that the internal server is running HTTPS and that its local firewall allows port 443. What is the most likely reason the port forwarding is not working?

Accepted Answer

The rule needs to include masquerade for the destination address; use a rich rule with 'masquerade'.. A simple port forward rule in firewalld does not automatically rewrite the source IP address for return traffic. Without masquerade on the forwarded traffic, the internal server sees the original external source IP and sends its response directly to that IP, bypassing the gateway. Adding a rich rule with 'masquerade' for the destination address ensures that the gateway performs SNAT on the forwarded packets, so the internal server sees the gateway as the source and returns traffic through it.

Answer

The port forwarding rule should be added to the internal zone instead of the external zone.

Answer

The internal server has a different default gateway.

Answer

IP forwarding is not enabled on the system.

Question 14

You are a senior Linux administrator for a large data center. A junior admin reports that a newly deployed application server (192.168.100.50/24, default gateway 192.168.100.1) cannot communicate with a legacy server (192.168.200.50/24, default gateway 192.168.200.1). The two subnets are connected via a router (192.168.100.1 and 192.168.200.1). From the app server, you can ping the legacy server's IP successfully. However, when you try to establish an SSH session from the app server to the legacy server, it times out. You check the legacy server's firewall (ufw) and find that it allows SSH (port 22) from the entire 192.168.0.0/16 range. You also confirm that the SSH daemon is running and listening on 0.0.0.0:22. What is the most likely cause?

Accepted Answer

The app server's firewall (ufw) is blocking incoming SSH responses.. The app server can ping the legacy server successfully, which confirms that ICMP traffic (Layer 3) passes through the router and that the legacy server's firewall allows ICMP. However, SSH (TCP port 22) fails because the app server's own firewall (ufw) is blocking the incoming SSH response packets (SYN-ACK) from the legacy server. Since the SSH client initiates the connection from the app server, the response packets must be allowed by the app server's firewall; if ufw on the app server blocks established or related incoming traffic, the TCP handshake cannot complete, resulting in a timeout.

Answer

The router is dropping TCP packets due to ACLs.

Answer

The legacy server's firewall is not allowing SSH; the rule might be misconfigured.

Answer

The legacy server's SSH service is not listening on the correct interface.

Question 15

You manage a Linux server that provides DHCP services to a small office network using the dhcpd daemon. The server has two network interfaces: eth0 (192.168.1.1/24) serving the internal network, and eth1 (192.168.0.1/24) connected to a DMZ. The DHCP server is configured to serve addresses only on eth0. Users on the internal network report that they are not receiving IP addresses. You check the DHCP server and find that the dhcpd service is running and listening on UDP port 67. From a client, you run tcpdump and see DHCPDISCOVER packets being sent, but no DHCPOFFER from the server. You also verify that no firewall rules are blocking DHCP traffic on either side. What is the most likely reason for the failure?

Accepted Answer

The dhcpd configuration file does not have a subnet declaration for the 192.168.1.0/24 network.. The dhcpd daemon will only respond to DHCPDISCOVER packets on interfaces for which it has a matching subnet declaration in its configuration file (typically /etc/dhcp/dhcpd.conf). Without a subnet declaration for 192.168.1.0/24, dhcpd ignores all DHCP traffic on eth0, even though the service is running and listening on UDP port 67. The absence of DHCPOFFER packets despite seeing DHCPDISCOVERs confirms that the server is not processing the requests for that subnet.

Answer

The DHCP server's IP address is not in the same subnet as the clients.

Answer

The dhcpd service is not running.

Answer

The network switch is blocking broadcast packets.