LPIC-2 Practice Test 7 — 10 Questions

Question 1

A network administrator notices that VLAN tagging is not working on a Linux bridge. The bridge interface br0 has member ports eth0 and eth1. The administrator runs 'bridge vlan show' and sees that only the default VLAN 1 is present. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bridge is not enabled for VLAN filtering. The 'bridge vlan show' command only displays VLAN filtering information when VLAN filtering is enabled on the bridge. By default, Linux bridges operate in a simple switching mode without VLAN awareness, meaning all frames are forwarded regardless of VLAN tags. The administrator must explicitly enable VLAN filtering using 'ip link set dev br0 type bridge vlan_filtering 1' to activate per-VLAN forwarding and filtering, which is why only the default untagged VLAN 1 appears.

Answer

The kernel module for VLAN is not loaded

Answer

The VLAN protocol is not set to 802.1Q

Answer

Ports eth0 and eth1 are not set to promiscuous mode

Question 2

A company's Linux router uses iptables. The administrator needs to log all dropped packets (by default policy) before they are dropped. Where should the LOG rule be placed?

Accepted Answer

In the FORWARD chain with -j LOG --log-prefix 'DROPPED' and then -j DROP. The LOG rule must be placed in the FORWARD chain before the DROP action to log packets that are dropped by the default policy. In iptables, the LOG target does not terminate the rule; it logs the packet and then continues to the next rule. By placing `-j LOG --log-prefix 'DROPPED'` followed by `-j DROP`, the packet is logged before being explicitly dropped, ensuring that packets matching the default policy (which drops at the end of the chain) are captured in the log. The FORWARD chain is the correct chain for a router handling traffic that is not destined for the router itself.

Answer

In the FORWARD chain with target LOG

Answer

In the INPUT chain before the drop rule

Answer

In a custom chain called LOGDROP and jump to it

Question 3

A medium-sized company uses a Linux server as its internet gateway. The server runs Ubuntu 20.04 and has two network interfaces: eth0 (IP 192.168.1.1/24) connected to the internal LAN, and eth1 (DHCP client, obtains IP 203.0.113.10/24, gateway 203.0.113.1) connected to the ISP modem. The server uses iptables for NAT with the rule 'iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE'. IP forwarding is enabled (net.ipv4.ip_forward=1). Firewalld is running with the default zone set to 'public'. For the past week, internal clients on 192.168.1.0/24 have reported intermittent connectivity to external websites. The administrator notices that during the failures, packets sent to external websites leave the internal network (tcpdump on eth1 shows SYN), but the response SYN-ACK never reaches the client. The administrator checks that the iptables FORWARD chain has a default policy of ACCEPT and no restrictive rules. Which of the following is the most likely cause?

Accepted Answer

The firewall is dropping incoming packets on eth1 due to default zone settings.. Firewalld, when running with the default zone set to 'public', applies a default 'reject' or 'drop' policy for incoming traffic on interfaces assigned to that zone. Since eth1 (the external interface) is likely assigned to the public zone, incoming SYN-ACK packets (which are part of established connections) are dropped by firewalld before they can be processed by iptables. This explains why tcpdump on eth1 shows outgoing SYN packets but no incoming SYN-ACK, even though iptables FORWARD chain is permissive.

Answer

The server's routing table is missing a route back to the internal network.

Answer

The MASQUERADE rule is missing the source network specification.

Answer

The default gateway on the internal clients is not set to the Linux server's internal IP.

Question 4

Which TWO of the following tools are used to capture and analyze network packets on a Linux system?

Accepted Answer

tcpdump. tcpdump is a command-line packet analyzer that captures raw network packets from the wire by placing the network interface into promiscuous mode and using libpcap to read packets. It allows filtering based on protocols, ports, and hosts using BPF (Berkeley Packet Filter) syntax, making it a fundamental tool for network troubleshooting and security analysis.

Answer

iptables

Answer

netstat

Answer

nmap

Question 5

An administrator needs to create a Linux bridge (br0) and add an Ethernet interface (eth1) to it for KVM virtual machine networking. Which set of commands accomplishes this task?

Accepted Answer

brctl addbr br0; brctl addif br0 eth1. `brctl addbr br0` creates a new bridge interface named br0, and `brctl addif br0 eth1` adds the physical Ethernet interface eth1 as a port of that bridge. This is the standard sequence using the legacy bridge utilities to set up a bridge for KVM virtual machine networking, where eth1 becomes a member of br0, allowing VMs to share the physical network.

Answer

ifconfig br0 up; ifconfig eth1 up; brctl addbr br0; brctl addif br0 eth1

Answer

ip link add br0 type bridge; ip link set eth1 master br0

Answer

brctl addbr br0; bridge fdb add dev eth1 master br0

Question 6

A system administrator needs to configure a VPN tunnel using WireGuard. The private key of the local peer is stored in /etc/wireguard/private.key. Which command should be used to set the private key via wg-quick?

Accepted Answer

PrivateKey = $(cat /etc/wireguard/private.key). The `PrivateKey` directive in a WireGuard configuration file expects the actual private key value, not a file path. Using `$(cat /etc/wireguard/private.key)` performs command substitution to read the key file and insert its contents directly into the configuration, which is the proper method for `wg-quick`.

Answer

PostUp = wg set %i private-key /etc/wireguard/private.key

Answer

PrivateKey = /etc/wireguard/private.key

Answer

Key = private-key /etc/wireguard/private.key

Question 7

A DNS server returns SERVFAIL for queries to a zone that is configured as a slave. The master server is reachable. What should the administrator check?

Accepted Answer

The zone transfer is allowed from the slave.. When a slave DNS server returns SERVFAIL for a zone it is configured to serve, but the master is reachable, the most common cause is that the master's zone transfer ACL does not include the slave's IP address. Without an explicit 'allow-transfer' directive (or equivalent) on the master permitting the slave, the master will refuse the zone transfer, leaving the slave with no valid zone data and thus returning SERVFAIL. This is a fundamental access control check in BIND and other DNS servers.

Answer

The serial number on the master is greater than on the slave.

Answer

The slave's allow-query includes the master.

Answer

The TSIG key is correct.

Question 8

Which Postfix configuration parameter specifies the domain that is appended to unqualified email addresses?

Accepted Answer

myorigin. The `myorigin` parameter in Postfix controls the domain that is appended to locally-originated mail from unqualified addresses (e.g., 'user' becomes 'user@example.com'). By default, it uses the value of `myhostname`, but it is commonly set to `$mydomain` to append the domain rather than the full hostname. This ensures that outbound mail has a consistent and clean sender domain.

Answer

myhostname

Answer

mydomain

Answer

mydomainname

Question 9

Refer to the exhibit. What is wrong with the reverse DNS resolution for 192.0.2.1?

Accepted Answer

The PTR record for 192.0.2.1 is missing.. The reverse DNS resolution for 192.0.2.1 requires a PTR record in the reverse zone file. The query returns NXDOMAIN, which indicates that the PTR record for 1.2.0.192.in-addr.arpa does not exist, meaning the record is missing. Without this PTR record, the reverse lookup fails.

Answer

The reverse zone is not delegated.

Answer

The query should be for 1.2.0.192.in-addr.arpa.

Answer

The server is not authoritative for the reverse zone.

Question 10

A sysadmin is configuring VLAN tagging on a Linux server that will act as a router-on-a-stick for multiple VLANs (10, 20, 30). The server has a single physical interface enp0s3 connected to a switch trunk port that allows VLANs 10, 20, and 30. The administrator uses systemd-networkd and creates VLAN interfaces enp0s3.10, enp0s3.20, enp0s3.30 with IP addresses 10.0.10.1/24, 10.0.20.1/24, and 10.0.30.1/24 respectively. They enable IP forwarding and, for security, set the iptables FORWARD chain default policy to DROP, but they add no specific rules. Clients in VLAN 10 can ping their gateway (10.0.10.1) but cannot ping clients in VLAN 20 (10.0.20.2). The switch confirms correct configuration. Which of the following is the most likely cause?

Accepted Answer

The server's iptables FORWARD chain is set to DROP by default.. The default policy of the iptables FORWARD chain is set to DROP, and no specific rules are added to allow traffic between VLANs. Since the server is acting as a router-on-a-stick, inter-VLAN traffic must be forwarded by the kernel, which requires explicit ACCEPT rules in the FORWARD chain. Without these rules, packets from VLAN 10 to VLAN 20 are dropped, even though the VLAN interfaces and switch configuration are correct.

Answer

The VLAN interface enp0s3.10 is missing the 'vlan' flag or is not properly bound.

Answer

The server's MAC address is not allowed on the switch for VLAN 10.

Answer

The switch port is configured as an access port instead of a trunk.