LPIC-2 Practice Test 3 — 25 Questions

Question 1

The server is unable to communicate with hosts on the 192.168.2.0/24 network. Based on the exhibit, what is the most likely cause?

Accepted Answer

The interface has no default gateway configured.. The exhibit shows the interface has an IP address of 192.168.1.10/24 and a default gateway of 0.0.0.0, meaning no default gateway is configured. Without a default gateway, the host cannot route packets to the 192.168.2.0/24 network because that network is not directly connected (it is on a different subnet), and the host has no route to forward traffic beyond its local link. The `route -n` output would confirm the absence of a gateway entry, which is the most likely cause of the communication failure.

Answer

The interface has a duplicate IP address.

Answer

The hardware address is corrupted.

Answer

The subnet mask is incorrect.

Question 2

Traffic from the 10.1.1.0/24 subnet is seen leaving through eth1 as intended, but reply traffic from the internet never comes back. What is the most likely cause?

Accepted Answer

The kernel parameter net.ipv4.conf.all.rp_filter is set to 1.. When `net.ipv4.conf.all.rp_filter` is set to 1, the kernel performs strict reverse path filtering. This means the kernel checks whether the source address of incoming packets can be reached via the interface they arrived on. If reply traffic from the internet arrives on an interface (e.g., eth0) that does not have a route back to the original source subnet (10.1.1.0/24) through that same interface, the kernel drops the packet. This is the most likely cause because the outbound traffic leaves via eth1, but the reply comes back on a different interface, triggering the rp_filter check and causing the reply to be silently discarded.

Answer

The ip rule priority is not set, causing it to be overridden.

Answer

The default route in table 200 points to 172.16.0.1 which does not have a route back to 10.1.1.0/24.

Answer

The router does not have a route back to 10.1.1.0/24 via eth0.

Question 3

An administrator is troubleshooting IPv6 connectivity on a Linux host. The host has an IPv6 address configured on eth0, but cannot ping6 the default gateway. The output of 'ip -6 route show' shows a default route via fe80::1 dev eth0. Which tool should be used to verify that the neighbor discovery process is working?

Accepted Answer

ip neigh show. The 'ip neigh show' command displays the neighbor cache (equivalent to ARP table for IPv6), which is populated by the Neighbor Discovery Protocol (NDP). Since the default gateway is a link-local address (fe80::1), the host must have resolved the gateway's MAC address via NDP before it can send packets. If the neighbor entry is missing or incomplete (e.g., STALE or FAILED), it indicates that the neighbor discovery process is not working, which would explain the ping failure.

Answer

tcpdump -i eth0 icmp6

Answer

traceroute6

Answer

ndp -n

Question 4

A Linux router is experiencing asymmetric routing issues. The network has two internet connections (ISP1 and ISP2) with default routes. The administrator wants to ensure that traffic originating from a specific source IP uses ISP1 for both incoming and outgoing packets. Which ip rule configuration achieves this?

Accepted Answer

ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1 table isp1; sysctl -w net.ipv4.conf.all.rp_filter=0. It creates a policy routing rule that matches traffic from source IP 10.0.0.10 and directs it to a custom routing table named 'isp1', which contains a default route via ISP1's gateway (1.1.1.1). Additionally, disabling reverse path filtering (rp_filter=0) is essential to allow asymmetric routing — without it, the kernel would drop return packets arriving via a different interface than the one used for outgoing traffic, which is exactly the scenario in asymmetric routing.

Answer

ip rule add from 10.0.0.10 to 0/0 table isp1; ip route add default via 1.1.1.1 table isp1; ip rule add to 10.0.0.10 table isp1

Answer

ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1 table isp1

Answer

ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1

Question 5

A system administrator wants to allow incoming SSH connections from only the 192.168.1.0/24 network on a Linux server. Which iptables rule accomplishes this?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT. It appends a rule to the INPUT chain that matches TCP traffic destined for port 22 (SSH) from source IP range 192.168.1.0/24 and accepts it. This restricts incoming SSH connections to only the specified network, which is the intended behavior.

Answer

iptables -A INPUT -p tcp --dport 22 -d 192.168.1.0/24 -j ACCEPT

Answer

iptables -A INPUT -p udp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Answer

iptables -A FORWARD -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Question 6

A network administrator is configuring source-based routing. They have created a new routing table and added a default route. They then run: ip rule add to 10.0.0.0/24 lookup 100. Traffic from 10.0.0.0/24 still uses the main table. What is the problem?

Accepted Answer

The rule uses 'to' instead of 'from' to match the source subnet.. The `ip rule add to 10.0.0.0/24 lookup 100` command uses the `to` keyword, which matches the destination address, not the source address. For source-based routing, you must use the `from` keyword to match the source subnet. Since the rule matches destination 10.0.0.0/24 instead of source, traffic originating from 10.0.0.0/24 is not matched by this rule and continues to use the main routing table.

Answer

The rule is not persistent.

Answer

The rule priority is too high.

Answer

The routing table 100 does not have a default route.

Question 7

A system administrator wants to combine two 1 Gbps Ethernet interfaces into a single logical bonded interface to increase throughput and provide redundancy. Which mode of bonding will provide both load balancing and fault tolerance without requiring switch configuration?

Accepted Answer

mode 6 (balance-alb). Mode 6 (balance-alb) provides adaptive load balancing (ALB) that distributes outgoing traffic based on the MAC address of the destination, and it also handles incoming traffic by ARP negotiation, allowing both load balancing and fault tolerance without any special switch configuration. Unlike other modes that require switch support (e.g., IEEE 802.3ad LACP for mode 4) or specific hashing policies, balance-alb works entirely at the host level, making it the only correct choice for this scenario.

Answer

mode 2 (balance-xor)

Answer

mode 1 (active-backup)

Answer

mode 0 (balance-rr)

Question 8

Which THREE of the following are correct statements about LVM thin provisioning? (Select THREE)

Accepted Answer

Snapshots of thin volumes use the same pool.. LVM thin provisioning uses a shared thin pool to store data for all thin volumes and their snapshots. When a snapshot of a thin volume is created, it does not allocate separate physical storage; instead, it references the same thin pool, allowing efficient space usage and copy-on-write semantics.

Answer

A thin pool can be resized smaller without data loss.

Answer

Thin volumes must be created before the thin pool.

Question 9

Which of the following commands creates a new network namespace named 'test'?

Accepted Answer

ip netns add test. The correct command to create a new network namespace named 'test' is 'ip netns add test'. The 'ip netns' command is part of the iproute2 suite and is the standard tool for managing network namespaces in Linux. The 'add' subcommand creates a new namespace by binding it to a mount point under /var/run/netns/.

Answer

netns add test

Answer

network namespace add test

Answer

ip netns create test

Question 10

Which TWO conditions must be met for a Linux bridge to forward traffic between its ports?

Accepted Answer

The bridge has at least two ports added.. A Linux bridge requires at least two ports to forward traffic; a bridge with only one port cannot forward frames between interfaces. Option C is correct because the bridge kernel module must be loaded (e.g., via `modprobe bridge`) to provide the bridging functionality; without it, bridge operations are impossible.

Answer

The bridge has an IP address.

Answer

The interfaces are in promiscuous mode.

Answer

Spanning Tree Protocol is disabled.

Question 11

A network administrator notices that VLAN tagging is not working on a Linux bridge. The bridge interface br0 has member ports eth0 and eth1. The administrator runs 'bridge vlan show' and sees that only the default VLAN 1 is present. What is the most likely cause?

Accepted Answer

The bridge is not enabled for VLAN filtering. The 'bridge vlan show' command only displays VLAN filtering information when VLAN filtering is enabled on the bridge. By default, Linux bridges operate in a simple switching mode without VLAN awareness, meaning all frames are forwarded regardless of VLAN tags. The administrator must explicitly enable VLAN filtering using 'ip link set dev br0 type bridge vlan_filtering 1' to activate per-VLAN forwarding and filtering, which is why only the default untagged VLAN 1 appears.

Answer

The kernel module for VLAN is not loaded

Answer

The VLAN protocol is not set to 802.1Q

Answer

Ports eth0 and eth1 are not set to promiscuous mode

Question 12

A company's Linux router uses iptables. The administrator needs to log all dropped packets (by default policy) before they are dropped. Where should the LOG rule be placed?

Accepted Answer

In the FORWARD chain with -j LOG --log-prefix 'DROPPED' and then -j DROP. The LOG rule must be placed in the FORWARD chain before the DROP action to log packets that are dropped by the default policy. In iptables, the LOG target does not terminate the rule; it logs the packet and then continues to the next rule. By placing `-j LOG --log-prefix 'DROPPED'` followed by `-j DROP`, the packet is logged before being explicitly dropped, ensuring that packets matching the default policy (which drops at the end of the chain) are captured in the log. The FORWARD chain is the correct chain for a router handling traffic that is not destined for the router itself.

Answer

In the FORWARD chain with target LOG

Answer

In the INPUT chain before the drop rule

Answer

In a custom chain called LOGDROP and jump to it

Question 13

A medium-sized company uses a Linux server as its internet gateway. The server runs Ubuntu 20.04 and has two network interfaces: eth0 (IP 192.168.1.1/24) connected to the internal LAN, and eth1 (DHCP client, obtains IP 203.0.113.10/24, gateway 203.0.113.1) connected to the ISP modem. The server uses iptables for NAT with the rule 'iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE'. IP forwarding is enabled (net.ipv4.ip_forward=1). Firewalld is running with the default zone set to 'public'. For the past week, internal clients on 192.168.1.0/24 have reported intermittent connectivity to external websites. The administrator notices that during the failures, packets sent to external websites leave the internal network (tcpdump on eth1 shows SYN), but the response SYN-ACK never reaches the client. The administrator checks that the iptables FORWARD chain has a default policy of ACCEPT and no restrictive rules. Which of the following is the most likely cause?

Accepted Answer

The firewall is dropping incoming packets on eth1 due to default zone settings.. Firewalld, when running with the default zone set to 'public', applies a default 'reject' or 'drop' policy for incoming traffic on interfaces assigned to that zone. Since eth1 (the external interface) is likely assigned to the public zone, incoming SYN-ACK packets (which are part of established connections) are dropped by firewalld before they can be processed by iptables. This explains why tcpdump on eth1 shows outgoing SYN packets but no incoming SYN-ACK, even though iptables FORWARD chain is permissive.

Answer

The server's routing table is missing a route back to the internal network.

Answer

The MASQUERADE rule is missing the source network specification.

Answer

The default gateway on the internal clients is not set to the Linux server's internal IP.

Question 14

Which TWO of the following tools are used to capture and analyze network packets on a Linux system?

Accepted Answer

tcpdump. tcpdump is a command-line packet analyzer that captures raw network packets from the wire by placing the network interface into promiscuous mode and using libpcap to read packets. It allows filtering based on protocols, ports, and hosts using BPF (Berkeley Packet Filter) syntax, making it a fundamental tool for network troubleshooting and security analysis.

Answer

iptables

Answer

netstat

Answer

nmap

Question 15

An administrator needs to create a Linux bridge (br0) and add an Ethernet interface (eth1) to it for KVM virtual machine networking. Which set of commands accomplishes this task?

Accepted Answer

brctl addbr br0; brctl addif br0 eth1. `brctl addbr br0` creates a new bridge interface named br0, and `brctl addif br0 eth1` adds the physical Ethernet interface eth1 as a port of that bridge. This is the standard sequence using the legacy bridge utilities to set up a bridge for KVM virtual machine networking, where eth1 becomes a member of br0, allowing VMs to share the physical network.

Answer

ifconfig br0 up; ifconfig eth1 up; brctl addbr br0; brctl addif br0 eth1

Answer

ip link add br0 type bridge; ip link set eth1 master br0

Answer

brctl addbr br0; bridge fdb add dev eth1 master br0

Question 16

A system administrator needs to configure a VPN tunnel using WireGuard. The private key of the local peer is stored in /etc/wireguard/private.key. Which command should be used to set the private key via wg-quick?

Accepted Answer

PrivateKey = $(cat /etc/wireguard/private.key). The `PrivateKey` directive in a WireGuard configuration file expects the actual private key value, not a file path. Using `$(cat /etc/wireguard/private.key)` performs command substitution to read the key file and insert its contents directly into the configuration, which is the proper method for `wg-quick`.

Answer

PostUp = wg set %i private-key /etc/wireguard/private.key

Answer

PrivateKey = /etc/wireguard/private.key

Answer

Key = private-key /etc/wireguard/private.key

Question 17

A DNS server returns SERVFAIL for queries to a zone that is configured as a slave. The master server is reachable. What should the administrator check?

Accepted Answer

The zone transfer is allowed from the slave.. When a slave DNS server returns SERVFAIL for a zone it is configured to serve, but the master is reachable, the most common cause is that the master's zone transfer ACL does not include the slave's IP address. Without an explicit 'allow-transfer' directive (or equivalent) on the master permitting the slave, the master will refuse the zone transfer, leaving the slave with no valid zone data and thus returning SERVFAIL. This is a fundamental access control check in BIND and other DNS servers.

Answer

The serial number on the master is greater than on the slave.

Answer

The slave's allow-query includes the master.

Answer

The TSIG key is correct.

Question 18

Which Postfix configuration parameter specifies the domain that is appended to unqualified email addresses?

Accepted Answer

myorigin. The `myorigin` parameter in Postfix controls the domain that is appended to locally-originated mail from unqualified addresses (e.g., 'user' becomes 'user@example.com'). By default, it uses the value of `myhostname`, but it is commonly set to `$mydomain` to append the domain rather than the full hostname. This ensures that outbound mail has a consistent and clean sender domain.

Answer

myhostname

Answer

mydomain

Answer

mydomainname

Question 19

Refer to the exhibit. What is wrong with the reverse DNS resolution for 192.0.2.1?

Accepted Answer

The PTR record for 192.0.2.1 is missing.. The reverse DNS resolution for 192.0.2.1 requires a PTR record in the reverse zone file. The query returns NXDOMAIN, which indicates that the PTR record for 1.2.0.192.in-addr.arpa does not exist, meaning the record is missing. Without this PTR record, the reverse lookup fails.

Answer

The reverse zone is not delegated.

Answer

The query should be for 1.2.0.192.in-addr.arpa.

Answer

The server is not authoritative for the reverse zone.

Question 20

A sysadmin is configuring VLAN tagging on a Linux server that will act as a router-on-a-stick for multiple VLANs (10, 20, 30). The server has a single physical interface enp0s3 connected to a switch trunk port that allows VLANs 10, 20, and 30. The administrator uses systemd-networkd and creates VLAN interfaces enp0s3.10, enp0s3.20, enp0s3.30 with IP addresses 10.0.10.1/24, 10.0.20.1/24, and 10.0.30.1/24 respectively. They enable IP forwarding and, for security, set the iptables FORWARD chain default policy to DROP, but they add no specific rules. Clients in VLAN 10 can ping their gateway (10.0.10.1) but cannot ping clients in VLAN 20 (10.0.20.2). The switch confirms correct configuration. Which of the following is the most likely cause?

Accepted Answer

The server's iptables FORWARD chain is set to DROP by default.. The default policy of the iptables FORWARD chain is set to DROP, and no specific rules are added to allow traffic between VLANs. Since the server is acting as a router-on-a-stick, inter-VLAN traffic must be forwarded by the kernel, which requires explicit ACCEPT rules in the FORWARD chain. Without these rules, packets from VLAN 10 to VLAN 20 are dropped, even though the VLAN interfaces and switch configuration are correct.

Answer

The VLAN interface enp0s3.10 is missing the 'vlan' flag or is not properly bound.

Answer

The server's MAC address is not allowed on the switch for VLAN 10.

Answer

The switch port is configured as an access port instead of a trunk.