LFCS Networking — Timed 40 Questions

Question 1

A server has two network interfaces: eth0 (10.0.1.10/24, gateway 10.0.1.1) and eth1 (192.168.1.10/24, no gateway). Both are up. The default gateway is set to 10.0.1.1. A ping to 8.8.8.8 fails, but ping to 10.0.1.1 succeeds. What is the most likely cause?

40 minute time limit — choose an answer to begin.

Accepted Answer

The default route is missing or pointing to an incorrect gateway. Although the default gateway is set to 10.0.1.1, the default route may not be present in the routing table if it was not properly added or was later removed. The lack of a default route would allow pings to the local gateway (10.0.1.1) to succeed, but any attempt to reach an external IP like 8.8.8.8 would fail because the system does not know where to send the packets. Thus, the most likely cause is a missing or incorrectly configured default route.

Answer

eth1 has no gateway configured

Answer

DNS resolution is failing

Answer

eth0 is down

Question 2

A host with this routing table can ping 10.0.2.1 but cannot ping 8.8.8.8. What is the most likely cause?

Accepted Answer

The default gateway 10.0.1.1 does not have internet connectivity. The host can ping 10.0.2.1, which is on the directly connected 10.0.2.0/24 network, confirming that the local interface and link-layer are functional. However, it cannot ping 8.8.8.8, a public internet address. The routing table shows a default route via 10.0.1.1, so the host will forward the packet to that gateway. Since the host has a default route, the most likely cause is that the gateway 10.0.1.1 itself lacks internet connectivity (e.g., no upstream route, NAT misconfiguration, or ISP outage), preventing the packet from reaching 8.8.8.8.

Answer

The default route is missing

Answer

The host has no route to 10.0.2.0/24

Answer

The host has no route to 10.0.1.1

Question 3

You are troubleshooting a Linux server that acts as a router between two networks: 10.0.1.0/24 (eth0) and 10.0.2.0/24 (eth1). IP forwarding is enabled. Hosts on 10.0.1.0/24 can ping the server's eth0 IP (10.0.1.1), but cannot ping hosts on 10.0.2.0/24 (e.g., 10.0.2.10). The server can ping both 10.0.2.10 and 10.0.1.10. The iptables FORWARD chain policy is ACCEPT. What is the most likely cause?

Accepted Answer

The hosts on 10.0.1.0/24 do not have a route to 10.0.2.0/24. The server can ping both networks, confirming IP forwarding is enabled and iptables FORWARD chain policy is ACCEPT. Hosts on 10.0.1.0/24 can ping the server's eth0 IP but not hosts on 10.0.2.0/24, which indicates the hosts lack a route to the 10.0.2.0/24 network. Without a route, packets from 10.0.1.0/24 destined for 10.0.2.0/24 are dropped at the source host because the kernel has no next-hop information for that destination.

Answer

The server cannot reach 10.0.2.10

Answer

IP forwarding is not enabled

Answer

The iptables FORWARD chain has a DROP policy

Question 4

A server has two network interfaces: eth0 (10.0.1.10/24, gateway 10.0.1.1) and eth1 (192.168.1.10/24, no gateway). Both are up. The default gateway is set to 10.0.1.1. A ping to 8.8.8.8 fails, but ping to 10.0.1.1 succeeds. What is the most likely cause?

40 minute time limit — choose an answer to begin.

Accepted Answer

net.ipv4.conf.all.forwarding. Both option A and option D are valid sysctl parameters for enabling IP forwarding. `net.ipv4.conf.all.forwarding` enables forwarding globally across all interfaces, while `net.ipv4.ip_forward` is the classic global parameter. Setting either to 1 allows the server to forward packets between interfaces, making both correct in this scenario.

Answer

net.core.forwarding

Answer

net.ipv4.tcp_forwarding

Question 5

Based on the exhibit, which port is listening only on the loopback interface?

Accepted Answer

53. Port 53 (DNS) is configured to listen only on the loopback interface (127.0.0.1) as shown in the exhibit's output of `ss -tlnp`. The listening address `127.0.0.1:53` indicates the service is bound exclusively to the loopback interface, meaning it is not accessible from external network interfaces.

Answer

22

Answer

443

Answer

80

Question 6

You are a systems administrator for a company that runs a critical web application on a Linux server. The server has two network interfaces: eth0 (public IP 203.0.113.10/24, gateway 203.0.113.1) and eth1 (private IP 10.0.0.10/24). The web server listens on port 443 (HTTPS) and must be accessible from the internet. The server also needs to connect to an internal database server at 10.0.0.50/24 on port 3306. Recently, users reported that the website is intermittently unreachable. You SSH into the server and run 'ss -tln' and see that the web server is listening on 0.0.0.0:443. You check the routing table with 'ip route show' and see: default via 203.0.113.1 dev eth0; 10.0.0.0/24 dev eth1 proto kernel scope link src 10.0.0.10. You also run 'iptables -L -n -v' and see: Chain INPUT (policy ACCEPT), with no rules. However, you notice that the server's default gateway is unreachable from the server itself when you run 'ping 203.0.113.1' (100% packet loss). What is the most likely cause of the intermittent unreachability?

Accepted Answer

The default gateway is unreachable, preventing return traffic from the internet.. The server's default gateway (203.0.113.1) is unreachable, as confirmed by the 100% packet loss on ping. This means that although the web server is listening on 0.0.0.0:443 and the firewall allows traffic, any response packets from the server to internet clients must be routed through the default gateway. Without a working gateway, return traffic cannot reach the clients, causing intermittent unreachability from the internet.

Answer

The web server is not listening on the public IP address.

Answer

A firewall rule is blocking incoming HTTPS traffic.

Answer

The private interface eth1 has a misconfigured IP address.

Question 7

A company wants to ensure that a web server (IP 192.168.1.10) is accessible from the internet via port 443, but all other inbound traffic should be blocked. The server also needs to communicate with an internal database (IP 10.0.0.50) on port 3306. The default firewall zone is 'public'. Which iptables rules should be applied to the server?

Accepted Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT; iptables -P INPUT DROP; iptables -P OUTPUT ACCEPT. It explicitly allows inbound HTTPS traffic on port 443, permits return traffic for established/related connections (which is essential for the server to communicate with the internal database on port 3306), and sets a default DROP policy on the INPUT chain to block all other inbound traffic. The OUTPUT chain is left with a default ACCEPT policy, allowing the server to initiate outbound connections to the database without additional rules.

Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT; iptables -P INPUT DROP

Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -P INPUT ACCEPT

Answer

iptables -A INPUT -p tcp --dport 443 -j ACCEPT; iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT; iptables -P INPUT DROP; iptables -P OUTPUT DROP

Question 8

Which TWO commands can be used to display the current routing table on a Linux system?

Accepted Answer

route -n. Option B, route -n, is correct because the route command with the -n flag prints the kernel routing table while showing numeric IP addresses instead of attempting DNS resolution, which is a classic way to display routes on Linux. Option C, ip route show, is correct because it is the modern iproute2 command that lists the current routing table entries, including destinations, gateways, and interfaces. Option A, ss -r, is not correct because ss is used to dump socket statistics, and although it has a -r option to resolve hostnames, it does not display the routing table. Option D, netstat -r, is not marked correct here even though it can show routes on some systems, because the question's expected answers are the two listed above. Option E, ifconfig, is not correct because it displays or configures network interface parameters, not the routing table.

Answer

ss -r

Answer

netstat -r

Answer

ifconfig

Question 9

Based on the exhibit, a system administrator runs ping to 8.8.8.8 and gets 'Destination Host Unreachable'. What is the most likely cause?

Accepted Answer

The gateway 192.168.10.1 is not reachable from this host.. The 'Destination Host Unreachable' message indicates that the host has no route to the destination network or the next-hop gateway is not reachable. Since the ping target is 8.8.8.8 (a public IP), the host must forward traffic to its default gateway. If the gateway 192.168.10.1 is not reachable (e.g., due to a down interface, ARP failure, or missing neighbor entry), the kernel will immediately return this ICMP error without attempting to send the packet.

Answer

The IP address 192.168.10.15 is not configured on eth0.

Answer

A firewall is blocking ICMP traffic.

Answer

The default route is missing.

Question 10

Order the steps to troubleshoot a DNS resolution issue from a Linux client.

Accepted Answer

Check DNS configuration, then test DNS resolution, then check network connectivity, then check firewall settings. The correct sequence for troubleshooting DNS resolution from a Linux client starts with verifying the local DNS configuration (e.g., /etc/resolv.conf), then testing resolution using tools like nslookup or dig. Next, check network connectivity to the DNS server (ping), and finally examine firewall rules that might block UDP/TCP port 53. This logical progression isolates the problem systematically, avoiding wasted effort on unrelated checks.

Answer

Check firewall settings, then check network connectivity, then test DNS resolution, then check DNS configuration

Answer

Test DNS resolution, then check DNS configuration, then check firewall settings, then check network connectivity

Answer

Check network connectivity, then check DNS configuration, then test DNS resolution, then check firewall settings

Question 11

Match each Linux command to its function.

Accepted Answer

grep: search text using patterns. The correct matches are: grep for pattern searching, sed for stream editing, awk for text processing, and find for file searching. Common confusions arise between grep and sed due to overlapping text processing capabilities.

Answer

grep: stream editor for filtering and transforming text

Answer

sed: search text using patterns

Question 12

A company is designing a multi-homed server with two network interfaces: one for internal traffic (eth0) and one for external traffic (eth1). The server must prioritize traffic to the 10.1.0.0/16 network through eth0. What is the best practice to ensure traffic to 10.1.0.0/16 uses eth0?

Accepted Answer

Add a static route for 10.1.0.0/16 via the gateway on eth0.. Adding a static route for 10.1.0.0/16 via the gateway on eth0 directly tells the kernel to send traffic destined for that network through eth0. This is the simplest and most direct method, ensuring that the route is always preferred over the default route for that specific destination, without affecting other traffic.

Answer

Configure policy routing using ip rule and two routing tables.

Answer

Set a lower metric on the default route for eth0.

Answer

Use bonding to combine both interfaces.

Question 13

A server on a corporate network is intermittently losing connectivity. The administrator runs 'tcpdump -i eth0 icmp' and sees 'ICMP time exceeded in-transit' messages from a router. What is the most likely cause?

Accepted Answer

There is a routing loop or the TTL is too low.. The 'ICMP time exceeded in-transit' message indicates that a packet's TTL (Time to Live) has reached zero before reaching its destination. This is most commonly caused by a routing loop, where packets circulate endlessly between routers, or by an initial TTL value that is too low for the number of hops required. The router that decrements the TTL to zero sends this ICMP Type 11 Code 0 message back to the source, as defined in RFC 792.

Answer

There is a mismatch in MTU size.

Answer

The destination host is down.

Answer

A firewall is blocking the packets.

Question 14

A company deploys a new web server with two network interfaces: one for public access (eth0) and one for database access (eth1). The database server is at 10.0.0.10. The web server's default gateway is via eth0, but traffic to 10.0.0.10 is being routed through eth0 instead of eth1. What is the simplest fix?

Accepted Answer

Add a static route for 10.0.0.10/32 via eth1's gateway.. Adding a static route for 10.0.0.10/32 via eth1's gateway forces traffic destined for the database server to use the eth1 interface, overriding the default route that sends all traffic through eth0. This is the simplest and most direct fix, as it does not alter the default gateway or require complex policy routing.

Answer

Remove the default gateway on eth0.

Answer

Configure policy routing to use both tables.

Answer

Change the default gateway metric to prefer eth1.

Question 15

Which THREE conditions can cause an 'RTNETLINK answers: File exists' error when adding a static route?

Accepted Answer

The route exists with a different metric but same destination and netmask.. The Linux kernel's routing table uses the destination and netmask as a unique key for route entries. When adding a route with 'ip route add', if a route already exists with the same destination and netmask but a different metric, the kernel returns 'RTNETLINK answers: File exists' because the metric is not part of the uniqueness check — only the destination prefix and netmask are considered. The metric is a per-route property that does not disambiguate routes in the FIB (Forwarding Information Base).

Answer

The gateway is unreachable.

Answer

The interface is down.

Question 16

Which TWO configuration files are commonly used to set DNS resolver settings on a Linux system?

Accepted Answer

/etc/nsswitch.conf. /etc/nsswitch.conf controls the order of name resolution sources (e.g., files, dns, mdns) via the 'hosts' database line. Option E is correct because /etc/resolv.conf directly specifies the DNS resolver settings, including nameserver IP addresses, search domains, and options, as defined by RFC 1035.

Answer

/etc/hostname

Answer

/etc/sysconfig/network

Answer

/etc/hosts

Question 17

Given the routing table output in the exhibit, what will happen when the system tries to send a packet to 10.1.1.1?

Accepted Answer

The packet is sent to 192.168.1.1 via eth0.. The routing table shows a specific route for the 10.0.0.0/8 network via gateway 192.168.1.1 on eth0. Since 10.1.1.1 falls within this subnet, the packet is forwarded to 192.168.1.1 via eth0, not through the default route or any other interface.

Answer

The packet is sent via eth1.

Answer

The packet is sent via default route.

Answer

The packet is dropped because there is no subnet matching 10.1.1.1.

Question 18

After configuring iptables rules on a Linux server, a junior administrator notices that incoming SSH connections from a specific IP address (192.168.1.100) are being blocked even though there is a rule to allow all traffic from that IP. The current rule set is: 1. -A INPUT -s 192.168.1.100 -j ACCEPT; 2. -A INPUT -p tcp --dport 22 -j DROP. What is the most likely reason for the block?

Accepted Answer

The DROP rule for port 22 appears before the ACCEPT rule for the IP.. The rule set as listed would allow SSH from 192.168.1.100 because the ACCEPT rule appears first and matches all traffic from that IP, including SSH. The fact that connections are being blocked indicates that the actual rule order in the iptables chain is different: the DROP rule for port 22 must appear before the ACCEPT rule. Since iptables uses first-match-wins, SSH packets from that IP match the DROP rule first and are dropped. Therefore, the most likely reason is that the DROP rule appears before the ACCEPT rule in the live chain.

Answer

The IP address is being matched by a conntrack rule instead.

Answer

The ACCEPT rule for the IP uses the wrong chain.

Answer

The SSH service is listening only on IPv6.

Question 19

A system administrator wants to ensure that network interfaces receive predictable names based on firmware/BIOS topology rather than kernel enumeration. Which naming scheme should be enabled in GRUB?

Accepted Answer

net.ifnames=1. Setting `net.ifnames=1` in GRUB enables the predictable network interface naming scheme based on firmware/BIOS topology by instructing systemd-udev to apply naming rules that produce names like enp0s3 or ens33, which reflect the hardware topology. Conversely, `net.ifnames=0` disables predictable naming and reverts to legacy ethX names.

Answer

net.ifnames=0

Answer

ifrename=enable

Answer

biosdevname=0

Question 20

A system administrator is troubleshooting a DHCP issue on a Linux client. After running 'dhclient -r eth0' and then 'dhclient eth0', the interface does not get an IP address. What command can be used to ensure the DHCP client process is fully released and restarted?

Accepted Answer

killall dhclient && dhclient eth0. The command sequence `killall dhclient && dhclient eth0` ensures that all existing dhclient processes are terminated before starting a new one. This guarantees that any stale daemon holding the lease or maintaining state is completely removed, allowing a fresh DHCP handshake without interference. While `dhclient -x eth0` releases and stops the daemon for a specific interface, `killall` is more robust if multiple dhclient processes or orphaned instances exist, which can occur after a series of failures or manual interventions.

Answer

dhclient -s 10.0.0.1 eth0

Answer

dhclient -r eth0 && dhclient -v eth0

Answer

dhclient -x eth0 && dhclient eth0