LPIC-1 Essential System Services and Networking Practice Test 2 — 15 Questions

Question 1

Which THREE steps are required to configure a static IP address on a modern Linux system using systemd-networkd?

Accepted Answer

Create a .network file in /etc/systemd/network/. Systemd-networkd uses .network files in /etc/systemd/network/ to define static IP configurations. These files contain sections like [Match] and [Network] to specify the interface and address details, replacing traditional ifcfg scripts or manual ip commands.

Answer

Edit /etc/hosts to map IP to hostname

Answer

Run 'ip addr add <IP> dev eth0'

Question 2

A host on the 192.168.1.0/24 network cannot reach the internet. Based on the exhibit, which is the most likely cause?

Accepted Answer

The gateway for internet traffic is incorrect; the host uses 10.0.1.254 for internal network, but the default gateway 10.0.1.1 may not be reachable from 192.168.1.0/24.. The host on 192.168.1.0/24 uses 10.0.1.254 as its default gateway, but the internet-bound traffic must be routed through 10.0.1.1, which is on a different subnet. Without a route or NAT between these subnets, the host cannot reach the internet, as the gateway 10.0.1.254 is likely an internal router that does not forward to 10.0.1.1.

Answer

There is no route to 192.168.1.0/24.

Answer

The default route is missing.

Answer

The routing table is empty.

Question 3

An administrator notices that SSH connections to a remote Linux server are timing out. After confirming network connectivity, which command should the administrator run on the server to check whether the SSH daemon is actively listening?

Accepted Answer

systemctl status sshd. The `systemctl status sshd` command checks the status of the SSH daemon service managed by systemd, directly reporting whether it is active (running) or inactive (stopped). This is the most straightforward way to verify that the SSH daemon is actively listening, as it queries the service manager rather than relying on network-level probing.

Answer

ls /etc/ssh/

Answer

nc -zv localhost 22

Answer

netstat -tuln

Question 4

On a Linux server using systemd and Postfix for email service, an administrator needs to diagnose a delivery failure for a local user. Which command should be used to view the most recent mail-related system journal entries?

Accepted Answer

journalctl -u postfix. `journalctl -u postfix` queries the systemd journal for all log entries associated with the `postfix` unit. Since the server uses systemd, Postfix logs are captured by journald rather than written to traditional files like `/var/log/maillog`. This command shows the most recent mail-related entries, including delivery failures, in reverse chronological order.

Answer

tail -f /var/log/maillog

Answer

systemctl status postfix

Answer

less /var/log/syslog

Question 5

An administrator wants to combine two network interfaces into a single logical interface for redundancy and increased throughput. The system uses NetworkManager. Which method is currently recommended to achieve this?

Accepted Answer

Configure a bond using nmcli. NetworkManager is the default network service on modern Linux distributions, and its recommended tool for managing network bonds is `nmcli`. Using `nmcli`, an administrator can create a bond master interface and assign slave interfaces with the `nmcli connection add type bond` and `nmcli connection add type bond-slave` commands, which ensures proper integration with NetworkManager's configuration and state management. This method is preferred over legacy tools like `ifenslave` or `teamd` because it aligns with the current systemd and NetworkManager ecosystem.

Answer

Use ifenslave to enslave interfaces

Answer

Set up a team interface using teamd

Answer

Edit /proc/net/bonding directly

Question 6

Which two commands can be used to send a test email from the command line to verify SMTP functionality? (Choose two.)

Accepted Answer

mail -s test user@example.com. The `mail` command (option C) sends an email via the local MTA, directly testing SMTP delivery. The `sendmail` command (option D) with a piped message also invokes the MTA to deliver the email, verifying SMTP functionality. Both commands rely on the system's configured MTA to handle SMTP communication.

Answer

telnet localhost 25

Answer

mutt -s test user@example.com

Answer

sendmail -bv user@example.com

Question 7

Refer to the exhibit. An administrator runs ss -tuln and gets the output above. Which of the following statements about this server is true?

Accepted Answer

The server runs SSH, HTTP, HTTPS, NTP, and mDNS.. The `ss -tuln` command displays listening TCP and UDP sockets with numeric addresses and ports. The output shows ports 22 (SSH), 80 (HTTP), 443 (HTTPS), 123 (NTP), and 5353 (mDNS). Therefore, the server is listening for SSH, HTTP, HTTPS, NTP, and mDNS services. Option D correctly lists all these services.

Answer

The server only runs SSH and DNS.

Answer

The server runs SSH and NTP only.

Answer

The server only runs SSH and HTTP.

Question 8

A system administrator notices that the system clock is consistently 5 minutes ahead of the actual time. The NTP service is enabled and running. Which command should the administrator run to force an immediate time synchronization?

Accepted Answer

ntpdate pool.ntp.org. `ntpdate` is a legacy command that forces an immediate, one-time synchronization of the system clock with an NTP server (e.g., pool.ntp.org). Even though NTP is running, it may take several polling intervals (typically 64–1024 seconds) to correct a large offset; `ntpdate` bypasses this gradual adjustment and sets the clock instantly.

Answer

ntpq -p

Answer

systemctl restart ntpd

Answer

timedatectl set-time ...

Question 9

A mail server using Postfix is rejecting emails from a partner domain. The administrator checks the maillog and sees 'relay access denied'. Which Postfix configuration parameter is most likely misconfigured?

Accepted Answer

mynetworks. (mynetworks) is correct because it defines which client IP addresses are allowed to relay mail through the server. The 'relay access denied' error indicates that the partner domain's mail server is not in the trusted network list. Option A (mydestination) specifies local destination domains, not relay permissions. Option B (inet_interfaces) controls listening interfaces. Option C (relayhost) sets the next-hop relay for outbound mail. Therefore, mynetworks is the likely misconfiguration.

Answer

mydestination

Answer

inet_interfaces

Answer

relayhost

Question 10

A security administrator needs to allow SSH access from the 10.0.0.0/8 network but deny all other traffic to port 22. The firewall uses iptables with default policy ACCEPT on the INPUT chain. Which set of rules should be added?

Accepted Answer

iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP. Iptables processes rules in order, and the first match determines the action. By placing the ACCEPT rule for the 10.0.0.0/8 source first, traffic from that network is allowed. The subsequent DROP rule for all other traffic to port 22 ensures that any packet not matching the first rule is denied, effectively implementing the required allow-from-specific-source, deny-all-others policy.

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT

Answer

iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Answer

iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT

Question 11

Refer to the exhibit. The administrator is unable to SSH into the server (TCP port 22) from a remote host. The iptables rules are as shown. What is the most likely cause?

Accepted Answer

The second rule drops all incoming traffic, including SSH.. The second rule in the iptables ruleset explicitly drops all incoming traffic with `iptables -A INPUT -j DROP`. Since SSH traffic on TCP port 22 is incoming from a remote host, it matches this rule before any later rule could accept it. The default policy being ACCEPT does not override explicit DROP rules; iptables processes rules sequentially, and the DROP rule terminates the packet's traversal, preventing SSH access.

Answer

The default policy is ACCEPT, so SSH should be accepted.

Answer

The SSH service is not running.

Answer

The first rule only allows loopback, not SSH.

Question 12

Refer to the exhibit. The administrator expects logs to be sent to a remote syslog server at 192.168.1.100 on UDP port 514. However, no logs are being received at the remote server. Which is the most likely issue?

Accepted Answer

The remote syslog server's firewall is blocking incoming UDP port 514.. The most likely issue is that the remote syslog server's firewall is blocking incoming UDP port 514. Syslog uses UDP port 514 by default, and if the remote server's firewall is not configured to allow this traffic, the logs will never reach it. This is a common misconfiguration when setting up centralized logging.

Answer

The local7 rule overrides the remote rule.

Answer

The wildcard *.* does not include kernel messages.

Answer

The syntax should use @@ for UDP.

Question 13

A small business runs a web application on a Linux server that uses Apache to serve dynamic content via PHP-FPM. The server currently uses the default Apache configuration, but the administrator wants to improve security by limiting access to the server's administrative interface (located at /admin) to only the local network (192.168.1.0/24). The administrative interface is accessed via a separate VirtualHost on port 443. The administrator has created a new VirtualHost configuration file for the admin site. However, after reloading Apache, users from outside the local network can still access the /admin page. The administrator has verified that the VirtualHost is being parsed and that mod_authz_core is enabled. Which of the following actions would most likely resolve the issue?

Accepted Answer

Add the following inside the block for the admin site: Require ip 192.168.1.0/24 . The administrator needs to restrict access to the /admin path at the directory level using Apache's mod_authz_core. By placing a block inside the VirtualHost that specifies the filesystem path to the admin files and using 'Require ip 192.168.1.0/24', Apache will enforce IP-based access control for that directory. Since the VirtualHost is already being parsed and mod_authz_core is enabled, this is the direct and proper way to limit access to the local network.

Answer

Add the following to the server's iptables:
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

Answer

Add the following inside the block: Require valid-user AuthType Basic AuthUserFile /etc/httpd/.htpasswd

Answer

Set the DocumentRoot of the default VirtualHost to /var/www/admin.

Question 14

A system administrator notices that the system time is slowly drifting from the actual time. The system uses chrony for NTP synchronization. The administrator runs 'chronyc sources' and sees no reachable sources. The firewall is enabled and configured. Which action should the administrator take to resolve the time synchronization issue?

Accepted Answer

Add a firewall rule to allow UDP 123 outbound to NTP servers.. Chrony uses UDP port 123 for NTP communication. Since the firewall is enabled and configured, and 'chronyc sources' shows no reachable sources, the most likely cause is that outbound NTP traffic is being blocked. Adding a firewall rule to allow UDP 123 outbound to NTP servers will permit chrony to reach its NTP sources and synchronize the system clock, resolving the drift.

Answer

Configure chrony to use a different port for NTP.

Answer

Restart chronyd service.

Answer

Use ntpdate to set the time manually once.

Question 15

Which TWO commands can be used to display the current routing table on a Linux system?

Accepted Answer

route -n. Option B (route -n) is correct because the legacy net-tools route command with the -n flag prints the kernel routing table numerically, showing Destination, Gateway, Genmask, Flags, Metric, Ref, Use, and Iface without DNS resolution. Option E (ip route show) is correct because it is the modern iproute2 equivalent that lists the current routing table entries, including default routes and per-prefix next hops. Option A (ss -r) is wrong because ss displays socket statistics and its -r option resolves service names rather than showing routes. Option C (iptables -L) is wrong because it lists firewall filter rules, not the routing table. Option D (ifconfig -r) is wrong because ifconfig configures interfaces and has no -r routing option.

Answer

ss -r

Answer

iptables -L

Answer

ifconfig -r