LFCS Networking Practice Test 9 — 15 Questions

Question 1

A network interface eth0 is not receiving an IP address via DHCP. Which command can be used to troubleshoot the DHCP client process?

Accepted Answer

dhclient -v eth0. The `dhclient -v eth0` command runs the DHCP client in verbose mode on interface eth0, which is the correct tool to troubleshoot the DHCP client process. It shows detailed messages about the DHCPDISCOVER, DHCPOFFER, DHCPREQUEST, and DHCPACK exchange, helping identify where the process fails. This directly addresses the issue of the interface not receiving an IP address via DHCP.

Answer

systemctl status dhcpd

Answer

nmcli dev show eth0

Answer

dhcpd -t

Question 2

An administrator is configuring a bridge using iproute2. Which command correctly attaches eth0 to bridge br0?

Accepted Answer

ip link set eth0 master br0. The `ip link set eth0 master br0` command attaches the physical interface `eth0` as a slave port of the bridge `br0` using the iproute2 suite. The `master` keyword specifies the bridge device that should become the master of the specified interface, which is the standard way to add an interface to a bridge with iproute2.

Answer

ip link set br0 master eth0

Answer

nmcli device modify eth0 master br0

Answer

brctl addif br0 eth0

Question 3

A system administrator runs 'ss -tuln' and sees that port 80 is listening. What does the 'u' option represent?

Accepted Answer

UDP. In the `ss` command, the `-u` option filters output to show only UDP sockets. Since the question shows `ss -tuln`, which combines `-t` (TCP), `-u` (UDP), `-l` (listening), and `-n` (numeric), the `u` specifically represents UDP. This is confirmed by the `ss` man page and standard Linux networking tools.

Answer

User

Answer

Unix sockets

Answer

Unicast

Question 4

A system administrator needs to check the firewall rules on a Linux server using firewalld. Which two commands can be used to list the current rules? (Choose two.)

Accepted Answer

firewall-cmd --list-all-zones. `firewall-cmd --list-all-zones` displays the firewall rules for all zones configured in firewalld, showing services, ports, and rules per zone. Option E is correct because `firewall-cmd --list-all` lists the rules for the default zone, providing a concise view of active firewall configuration. Both commands are native to firewalld and directly query its runtime and permanent rules via D-Bus.

Answer

systemctl status firewalld

Answer

iptables -S

Answer

iptables -L

Question 5

An administrator is troubleshooting DNS resolution and wants to query the SOA record for a domain. Which three commands can be used? (Choose three.)

Accepted Answer

nslookup -type=soa example.com. The `nslookup -type=soa` command queries the DNS for the Start of Authority (SOA) record of a domain. The `-type=soa` flag explicitly sets the query type to SOA, which returns authoritative information about the zone, including the primary name server and administrator email.

Answer

nmcli dev show

Answer

getent hosts example.com

Question 6

You administer a Linux server that acts as a network gateway. It has two network interfaces: eth0 (external, with IP 203.0.113.10/24, gateway 203.0.113.1) and eth1 (internal, with IP 192.168.1.1/24). The server is running firewalld and has IP forwarding enabled. Internal hosts (192.168.1.0/24) can access the internet through NAT, which is configured using firewalld's masquerade on the external zone. However, you need to allow a specific internal server (192.168.1.100) to be reachable from the internet on TCP port 443 (HTTPS). You add a port forwarding rule using firewall-cmd: 'firewall-cmd --zone=external --add-forward-port=port=443:proto=tcp:toport=443:toaddr=192.168.1.100'. After reloading the firewall, external users still cannot connect to 203.0.113.10:443. You verify that the internal server is running HTTPS and that its local firewall allows port 443. What is the most likely reason the port forwarding is not working?

Accepted Answer

The rule needs to include masquerade for the destination address; use a rich rule with 'masquerade'.. A simple port forward rule in firewalld does not automatically rewrite the source IP address for return traffic. Without masquerade on the forwarded traffic, the internal server sees the original external source IP and sends its response directly to that IP, bypassing the gateway. Adding a rich rule with 'masquerade' for the destination address ensures that the gateway performs SNAT on the forwarded packets, so the internal server sees the gateway as the source and returns traffic through it.

Answer

The port forwarding rule should be added to the internal zone instead of the external zone.

Answer

The internal server has a different default gateway.

Answer

IP forwarding is not enabled on the system.

Question 7

You are a senior Linux administrator for a large data center. A junior admin reports that a newly deployed application server (192.168.100.50/24, default gateway 192.168.100.1) cannot communicate with a legacy server (192.168.200.50/24, default gateway 192.168.200.1). The two subnets are connected via a router (192.168.100.1 and 192.168.200.1). From the app server, you can ping the legacy server's IP successfully. However, when you try to establish an SSH session from the app server to the legacy server, it times out. You check the legacy server's firewall (ufw) and find that it allows SSH (port 22) from the entire 192.168.0.0/16 range. You also confirm that the SSH daemon is running and listening on 0.0.0.0:22. What is the most likely cause?

Accepted Answer

The app server's firewall (ufw) is blocking incoming SSH responses.. The app server can ping the legacy server successfully, which confirms that ICMP traffic (Layer 3) passes through the router and that the legacy server's firewall allows ICMP. However, SSH (TCP port 22) fails because the app server's own firewall (ufw) is blocking the incoming SSH response packets (SYN-ACK) from the legacy server. Since the SSH client initiates the connection from the app server, the response packets must be allowed by the app server's firewall; if ufw on the app server blocks established or related incoming traffic, the TCP handshake cannot complete, resulting in a timeout.

Answer

The router is dropping TCP packets due to ACLs.

Answer

The legacy server's firewall is not allowing SSH; the rule might be misconfigured.

Answer

The legacy server's SSH service is not listening on the correct interface.

Question 8

You manage a Linux server that provides DHCP services to a small office network using the dhcpd daemon. The server has two network interfaces: eth0 (192.168.1.1/24) serving the internal network, and eth1 (192.168.0.1/24) connected to a DMZ. The DHCP server is configured to serve addresses only on eth0. Users on the internal network report that they are not receiving IP addresses. You check the DHCP server and find that the dhcpd service is running and listening on UDP port 67. From a client, you run tcpdump and see DHCPDISCOVER packets being sent, but no DHCPOFFER from the server. You also verify that no firewall rules are blocking DHCP traffic on either side. What is the most likely reason for the failure?

Accepted Answer

The dhcpd configuration file does not have a subnet declaration for the 192.168.1.0/24 network.. The dhcpd daemon will only respond to DHCPDISCOVER packets on interfaces for which it has a matching subnet declaration in its configuration file (typically /etc/dhcp/dhcpd.conf). Without a subnet declaration for 192.168.1.0/24, dhcpd ignores all DHCP traffic on eth0, even though the service is running and listening on UDP port 67. The absence of DHCPOFFER packets despite seeing DHCPDISCOVERs confirms that the server is not processing the requests for that subnet.

Answer

The DHCP server's IP address is not in the same subnet as the clients.

Answer

The dhcpd service is not running.

Answer

The network switch is blocking broadcast packets.

Question 9

A system administrator is managing a RHEL 8 server that requires a static IP address on interface ens192. The administrator modifies /etc/sysconfig/network-scripts/ifcfg-ens192 to set BOOTPROTO=static, IPADDR=192.168.1.100, PREFIX=24, GATEWAY=192.168.1.1, and DNS1=8.8.8.8. After saving, the administrator runs 'systemctl restart NetworkManager'. The interface obtains the correct static IP and network connectivity works. However, after a reboot of the server, the interface fails to come up with the static IP and instead obtains an IP via DHCP from the local network. The administrator verifies that the DHCP server is active and that the physical connection is good. What is the most likely cause of the issue?

Accepted Answer

The ONBOOT parameter is set to no or missing in the configuration file.. The ONBOOT parameter controls whether the interface is activated at system boot. If set to 'no' or missing entirely, NetworkManager will not bring up the interface automatically after a reboot, causing it to fall back to DHCP if a DHCP client is active. Setting BOOTPROTO=static and IPADDR correctly only takes effect when ONBOOT=yes is present.

Answer

The kernel parameter nomodeset is set in /etc/default/grub.

Answer

The firewall is blocking the static IP assignment.

Answer

The network service is not enabled to start at boot.

Question 10

A systems administrator is responsible for a production Linux server running CentOS 7 that provides SSH access to users. The administrator decides to tighten security by restricting SSH access to a specific management subnet 10.0.0.0/24. While connected to the server via SSH from a workstation on 10.0.0.50, the administrator adds the following iptables rule: iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/24 -j ACCEPT followed by iptables -P INPUT DROP. Immediately after the rule change, the administrator loses all connectivity to the server, including SSH. The administrator suspects that the new default policy dropped the existing SSH session. What is the most reliable method for the administrator to regain access to the server without rebooting?

Accepted Answer

Use IPMI or iDRAC to access the server's console and remove or modify the iptables rules.. IPMI (Intelligent Platform Management Interface) or iDRAC (Integrated Dell Remote Access Controller) provides out-of-band management access to the server's console, independent of the operating system's network stack. This allows the administrator to log in locally, remove or modify the iptables rules that dropped the SSH session, and restore connectivity without rebooting. Since the default INPUT policy was set to DROP, all new and existing SSH packets are blocked, but out-of-band management bypasses iptables entirely.

Answer

Use netcat to send a TCP reset packet to the SSH server.

Answer

Use iptables-save and iptables-restore from another host on the same subnet.

Answer

Boot the server into single-user mode and flush iptables rules.

Question 11

A Linux server acting as a VPN gateway uses an nftables ruleset in the inet filter table. The administrator wants all forwarded traffic from the 10.8.0.0/24 VPN subnet to the 192.168.50.0/24 LAN to be accepted, while dropping any other forwarded traffic. Which nftables rule should be added to the forward chain to accomplish this?

Accepted Answer

nft add rule inet filter forward ip saddr 10.8.0.0/24 ip daddr 192.168.50.0/24 accept. Forwarded traffic between two networks is evaluated in the forward chain of the inet filter table. The rule must use ip saddr for the VPN subnet and ip daddr for the LAN subnet with an accept verdict. Placing this rule before any default drop policy permits only the specified flow, and other forwarded traffic is refused by the chain policy.

Answer

nft add rule inet filter forward ip daddr 10.8.0.0/24 ip saddr 192.168.50.0/24 accept

Answer

nft add rule inet filter forward ip saddr 10.8.0.0/24 ip daddr 192.168.50.0/24 drop

Answer

nft add rule inet filter input ip saddr 10.8.0.0/24 ip daddr 192.168.50.0/24 accept

Question 12

A Linux server has a single network interface ens3. You need to assign the static address 10.10.10.5/24 with gateway 10.10.10.1 using NetworkManager. The connection profile is named 'static-ens3'. Which command correctly applies the IPv4 address, disables DHCP, and sets the gateway, all in one step?

Accepted Answer

nmcli con mod static-ens3 ipv4.addresses 10.10.10.5/24 ipv4.gateway 10.10.10.1 ipv4.method manual. The correct command uses 'nmcli con mod' to modify the existing connection profile named static-ens3. It sets the IPv4 address, gateway, and changes the method to manual, which disables DHCP. This is the standard way to apply a static configuration with NetworkManager. After modification, the connection must be reactivated for the changes to take effect.

Answer

nmcli con mod static-ens3 ipv4.addresses 10.10.10.5/24 ipv4.gateway 10.10.10.1 ipv4.method auto

Answer

nmcli con up static-ens3 ipv4.addresses 10.10.10.5/24 ipv4.gateway 10.10.10.1 ipv4.method manual

Answer

nmcli con add type ethernet ifname ens3 ipv4.addresses 10.10.10.5/24 ipv4.gateway 10.10.10.1 ipv4.method manual

Question 13

An administrator needs to temporarily assign the IPv4 address 172.16.5.20/24 to interface ens3, which is currently up but unconfigured. The change should not persist across reboots. Which command accomplishes this?

Accepted Answer

ip addr add 172.16.5.20/24 dev ens3. Runtime address assignment on Linux is performed with the iproute2 ip addr add command, which targets a named interface and does not alter persistent configuration. NetworkManager's nmcli modifies stored profiles and persists changes, while ifconfig is legacy. The ip command is the current, supported tool for non-persistent interface changes.

Answer

nmcli con mod ens3 ipv4.addresses 172.16.5.20/24

Answer

ip link set ens3 address 172.16.5.20/24

Answer

ifconfig ens3 172.16.5.20 netmask 255.255.255.0 up

Question 14

A Linux server has a single network interface enp3s0 that must obtain its IPv4 address automatically from a DHCP server on the local subnet. The administrator prefers to manage this connection with NetworkManager and wants the setting to persist across reboots. Which command will configure the connection profile named 'Wired connection 1' to use DHCP?

Accepted Answer

nmcli con mod 'Wired connection 1' ipv4.method auto. NetworkManager stores connection settings in profiles, and the ipv4.method property controls how IPv4 addressing is obtained. Setting it to auto enables DHCP for that profile. Modifying the profile with nmcli con mod makes the change persistent, unlike temporary ip commands. The other options either configure static addressing, use an invalid command syntax, or only activate an existing profile without changing its addressing method.

Answer

nmcli dev connect enp3s0

Answer

ip addr add dev enp3s0 dhcp

Answer

nmcli con mod 'Wired connection 1' ipv4.method manual

Question 15

An administrator is configuring a Linux server as a router. The server has two interfaces: eth0 (192.168.10.1/24) connected to the internal LAN and eth1 (203.0.113.2/24) connected to the internet. After enabling IP forwarding, internal clients still cannot reach external websites. Which command is required to allow the internal subnet to be translated to the external interface?

Accepted Answer

iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o eth1 -j MASQUERADE. For internal clients to reach the internet through a Linux router, their private source addresses must be translated to the router's public address. The correct rule uses the nat table's POSTROUTING chain with MASQUERADE on the outbound interface, enabling source NAT for the internal subnet.

Answer

iptables -A FORWARD -s 192.168.10.0/24 -o eth1 -j ACCEPT

Answer

iptables -t nat -A PREROUTING -s 192.168.10.0/24 -o eth1 -j MASQUERADE

Answer

iptables -t nat -A POSTROUTING -d 192.168.10.0/24 -i eth1 -j SNAT --to-source 203.0.113.2