LPIC-2 Practice Test 20 — 15 Questions

Question 1

A Linux router is experiencing asymmetric routing issues. The network has two internet connections (ISP1 and ISP2) with default routes. The administrator wants to ensure that traffic originating from a specific source IP uses ISP1 for both incoming and outgoing packets. Which ip rule configuration achieves this?

Accepted Answer

ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1 table isp1; sysctl -w net.ipv4.conf.all.rp_filter=0. Option B is correct because it creates a policy routing rule that matches traffic from source IP 10.0.0.10 and directs it to a custom routing table named 'isp1', which contains a default route via ISP1's gateway (1.1.1.1). Additionally, disabling reverse path filtering (rp_filter=0) is essential to allow asymmetric routing — without it, the kernel would drop return packets arriving via a different interface than the one used for outgoing traffic, which is exactly the scenario in asymmetric routing.

Answer

ip rule add from 10.0.0.10 to 0/0 table isp1; ip route add default via 1.1.1.1 table isp1; ip rule add to 10.0.0.10 table isp1

Answer

ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1 table isp1

Answer

ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1

Question 2

A system administrator wants to allow incoming SSH connections from only the 192.168.1.0/24 network on a Linux server. Which iptables rule accomplishes this?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT. Option D is correct because it appends a rule to the INPUT chain that matches TCP traffic destined for port 22 (SSH) from source IP range 192.168.1.0/24 and accepts it. This restricts incoming SSH connections to only the specified network, which is the intended behavior.

Answer

iptables -A INPUT -p tcp --dport 22 -d 192.168.1.0/24 -j ACCEPT

Answer

iptables -A INPUT -p udp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Answer

iptables -A FORWARD -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Question 3

A Linux server is configured as a DNS resolver with BIND. Users report that they cannot resolve external hostnames. The server can resolve internal names. Which of the following is the most likely cause?

Accepted Answer

The firewall is blocking UDP port 53 outgoing from the server.. The server can resolve internal names, indicating that the local BIND service is functioning correctly for authoritative zones. However, external resolution fails, which typically means the server cannot reach upstream DNS servers. Outgoing UDP port 53 is required for DNS queries to external resolvers; if the firewall blocks this traffic, the server cannot forward queries to the internet, while internal queries (often served from local zones) remain unaffected.

Answer

The server's /etc/resolv.conf points to itself.

Answer

The forwarders directive is missing from named.conf.

Answer

The named daemon is not running.

Question 4

A company has multiple internet connections and wants to route traffic from specific subnets to specific providers. They are using policy-based routing with ip rule and ip route. After adding the rules, the administrator finds that the traffic is not matching the intended routing table. Which command should be used to verify that the rules are being matched correctly?

Accepted Answer

ip route get mark . Option B is correct because 'ip route get' with the 'mark' option simulates a packet lookup using the specified routing mark, allowing the administrator to see which routing table would be matched by the policy rules. This directly verifies whether the ip rule conditions (e.g., fwmark, source subnet) are correctly directing traffic to the intended table.

Answer

ip route show cache

Answer

ip rule show

Answer

ip route show table all

Question 5

Traffic from the 10.1.1.0/24 subnet is seen leaving through eth1 as intended, but reply traffic from the internet never comes back. What is the most likely cause?

Accepted Answer

The kernel parameter net.ipv4.conf.all.rp_filter is set to 1.. When `net.ipv4.conf.all.rp_filter` is set to 1, the kernel performs strict reverse path filtering. This means the kernel checks whether the source address of incoming packets can be reached via the interface they arrived on. If reply traffic from the internet arrives on an interface (e.g., eth0) that does not have a route back to the original source subnet (10.1.1.0/24) through that same interface, the kernel drops the packet. This is the most likely cause because the outbound traffic leaves via eth1, but the reply comes back on a different interface, triggering the rp_filter check and causing the reply to be silently discarded.

Answer

The ip rule priority is not set, causing it to be overridden.

Answer

The default route in table 200 points to 172.16.0.1 which does not have a route back to 10.1.1.0/24.

Answer

The router does not have a route back to 10.1.1.0/24 via eth0.

Question 6

A Linux administrator is setting up an IPsec VPN between two sites using strongSwan. The VPN established successfully, but traffic between the sites is not being encrypted. What is the most probable cause?

Accepted Answer

The IPsec policies are not configured to match the traffic.. Option A is correct because the most probable cause for traffic not being encrypted after a successful IPsec tunnel establishment is that the IPsec policies (e.g., strongSwan's `ipsec.conf` `conn` section with `leftsubnet`/`rightsubnet`) do not match the actual traffic flows. Even if the IKE/SA is up, strongSwan only applies encryption to packets that match the configured selectors; mismatched subnets or protocols result in cleartext traffic bypassing the tunnel.

Answer

The firewall is blocking UDP port 500.

Answer

The kernel does not support IPsec (net.ipv4.ip_forward=0).

Answer

The IPsec daemon is not started.

Question 7

A system administrator wants to combine two 1 Gbps Ethernet interfaces into a single logical bonded interface to increase throughput and provide redundancy. Which mode of bonding will provide both load balancing and fault tolerance without requiring switch configuration?

Accepted Answer

mode 6 (balance-alb). Mode 6 (balance-alb) provides adaptive load balancing (ALB) that distributes outgoing traffic based on the MAC address of the destination, and it also handles incoming traffic by ARP negotiation, allowing both load balancing and fault tolerance without any special switch configuration. Unlike other modes that require switch support (e.g., IEEE 802.3ad LACP for mode 4) or specific hashing policies, balance-alb works entirely at the host level, making it the only correct choice for this scenario.

Answer

mode 2 (balance-xor)

Answer

mode 1 (active-backup)

Answer

mode 0 (balance-rr)

Question 8

Which THREE of the following are valid bonding modes in Linux?

Accepted Answer

mode 2 (balance-xor). Option A (mode 2, balance-xor) is a valid bonding mode that uses a hash policy (typically based on MAC addresses) to select a slave interface for outgoing traffic, providing both load balancing and fault tolerance. It is one of the seven standard bonding modes defined in the Linux kernel bonding driver (modes 0 through 6).

Answer

mode 8

Answer

mode 7

Question 9

A network administrator notices that VLAN tagging is not working on a Linux bridge. The bridge interface br0 has member ports eth0 and eth1. The administrator runs 'bridge vlan show' and sees that only the default VLAN 1 is present. What is the most likely cause?

Accepted Answer

The bridge is not enabled for VLAN filtering. The 'bridge vlan show' command only displays VLAN filtering information when VLAN filtering is enabled on the bridge. By default, Linux bridges operate in a simple switching mode without VLAN awareness, meaning all frames are forwarded regardless of VLAN tags. The administrator must explicitly enable VLAN filtering using 'ip link set dev br0 type bridge vlan_filtering 1' to activate per-VLAN forwarding and filtering, which is why only the default untagged VLAN 1 appears.

Answer

The kernel module for VLAN is not loaded

Answer

The VLAN protocol is not set to 802.1Q

Answer

Ports eth0 and eth1 are not set to promiscuous mode

Question 10

An administrator is configuring netfilter rules to implement a stateful firewall. Which TWO of the following commands are necessary to allow the firewall to correctly forward TCP traffic from internal to external networks (assuming proper default policies)?

Accepted Answer

iptables -A FORWARD -m state --state ESTABLISHED -j ACCEPT. Option B is correct because a stateful firewall must allow packets belonging to already established connections to pass through the FORWARD chain. The `-m state --state ESTABLISHED` match ensures that any packet that is part of an existing TCP connection (i.e., has seen the three-way handshake) is accepted, which is essential for forwarding return traffic from external networks back to internal hosts.

Answer

iptables -A FORWARD -m state --state NEW -j ACCEPT

Answer

iptables -A FORWARD -j ACCEPT

Answer

iptables -A FORWARD -m state --state NEW -p tcp --dport 80 -j ACCEPT

Question 11

To implement 802.1X port-based authentication on a Linux network interface, which combination of software components is typically required when the Linux system acts as the supplicant?

Accepted Answer

wpa_supplicant and hostapd. When a Linux system acts as an 802.1X supplicant, it must authenticate to a network switch (authenticator) using EAP over LAN (EAPoL). wpa_supplicant is the standard Linux supplicant that handles EAP methods and key negotiation, while hostapd is not needed on the supplicant side—it is an authenticator/access point daemon. The correct combination for a supplicant is wpa_supplicant alone; hostapd is irrelevant here, making option A incorrect despite being marked as correct in the answer key.

Answer

hostapd and freeradius

Answer

wpa_supplicant and sssd

Answer

freeradius and wpa_supplicant

Question 12

To create a simple bridge interface that connects two Ethernet interfaces, which of the following commands should be used?

Accepted Answer

ip link add br0 type bridge && ip link set br0 up. Option A is correct because the `ip link add br0 type bridge` command creates a new bridge interface using the modern iproute2 suite, and `ip link set br0 up` activates it. This is the current standard method for bridge creation on Linux, replacing the older brctl tool. The bridge then connects Ethernet interfaces by enslaving them with `ip link set eth0 master br0`.

Answer

brctl addbr br0 && brctl addif br0 eth0 eth1

Answer

ifconfig br0 create && ifconfig br0 up

Answer

Both A and B work correctly

Question 13

Which of the following commands creates a new network namespace named 'test'?

Accepted Answer

ip netns add test. The correct command to create a new network namespace named 'test' is 'ip netns add test'. The 'ip netns' command is part of the iproute2 suite and is the standard tool for managing network namespaces in Linux. The 'add' subcommand creates a new namespace by binding it to a mount point under /var/run/netns/.

Answer

netns add test

Answer

network namespace add test

Answer

ip netns create test

Question 14

Hosts connected to eth1 cannot communicate with hosts on eth0. Based on the exhibit, what is the most likely reason?

Accepted Answer

Spanning Tree Protocol has placed eth1 in blocking state.. The exhibit shows a Linux bridge (br0) with eth0 and eth1 as bridge ports. If hosts on eth1 cannot communicate with hosts on eth0, the most likely cause is that Spanning Tree Protocol (STP) has placed eth1 in a blocking state to prevent a Layer 2 loop. STP blocks redundant paths by transitioning ports through listening, learning, and blocking states, and a blocked port does not forward traffic until the topology converges.

Answer

Physical layer issues on eth1.

Answer

Eth1 is not connected to the bridge.

Answer

The bridge interface has no IP address.

Question 15

An administrator configures a DHCP relay agent using 'dhcrelay' in a network with multiple VLANs. The relay agent is on a Linux server with interfaces eth0 (VLAN 10) and eth1 (VLAN 20). The DHCP server is on VLAN 10. Which command correctly sets up the relay to forward requests from VLAN 20 to the DHCP server at 192.168.1.5?

Accepted Answer

dhcrelay -i eth1 192.168.1.5. Option B is correct because the `-i eth1` flag specifies the interface on which the relay agent should listen for DHCP client broadcasts (VLAN 20). The relay then unicasts those requests to the DHCP server at 192.168.1.5, which resides on VLAN 10. This ensures that only broadcasts from the client-side VLAN are forwarded, not those from the server-side network.

Answer

dhcrelay -i eth0 192.168.1.5

Answer

dhcrelay -i eth0 -i eth1 192.168.1.5

Answer

dhcrelay 192.168.1.5