LPIC-2 Advanced Networking Configuration — 20 Questions

Question 1

An administrator wants to configure a virtual IP address on interface eth0 with IP 192.168.1.100/24. Which command correctly adds the virtual IP as an alias?

Accepted Answer

ip addr add 192.168.1.100/24 dev eth0:0. The `ip addr add` command with `dev eth0:0` directly assigns the IP address to the virtual interface `eth0:0`, which is the standard method in the `iproute2` suite for creating an alias. The `ip` command does not use an `alias` keyword; instead, the device name itself (e.g., `eth0:0`) defines the alias. This approach is consistent with modern Linux networking, replacing the deprecated `ifconfig` method.

Answer

ip addr add 192.168.1.100/24 dev eth0 alias eth0:0

Answer

ip addr add 192.168.1.100/24 dev eth0 label eth0:0

Answer

ifconfig eth0:0 192.168.1.100 netmask 255.255.255.0

Question 2

A system administrator notices that the default gateway is missing after a reboot. The network configuration uses ifup/ifdown scripts. Which file should be modified to ensure the default gateway is persistent?

Accepted Answer

/etc/network/interfaces. On Debian-based systems using ifup/ifdown scripts, persistent network configuration—including the default gateway—is defined in /etc/network/interfaces. The gateway is set with the 'gateway' directive under the appropriate interface stanza, ensuring it is applied automatically on boot. This file is the central configuration source for the ifupdown suite.

Answer

/etc/resolv.conf

Answer

/etc/network/routes

Answer

/etc/sysconfig/network

Question 3

A server with IP 10.0.0.1 needs to forward packets from network 192.168.1.0/24 to 10.0.0.0/24. The administrator runs: 'iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j MASQUERADE'. However, traffic from 192.168.1.0/24 cannot reach 10.0.0.0/24. What is the most likely missing configuration?

Accepted Answer

The FORWARD chain in the filter table must have a rule to allow traffic.. The MASQUERADE rule in the POSTROUTING chain handles source NAT, but it does not automatically allow forwarding of packets. By default, the FORWARD chain in the filter table has a policy of DROP or lacks an explicit ACCEPT rule. Without a rule like `iptables -A FORWARD -s 192.168.1.0/24 -d 10.0.0.0/24 -j ACCEPT`, the kernel's netfilter will drop the forwarded packets, preventing traffic from reaching the destination.

Answer

A DNAT rule is also needed to translate the destination address.

Answer

A route must be added on the 10.0.0.0/24 network pointing back to 10.0.0.1.

Answer

The IP address 10.0.0.1 is not configured on the external interface.

Question 4

An administrator needs to configure a wireless interface wlan0 with WPA2-PSK authentication and a static IP address 192.168.2.50/24. Which tool should be used to configure the wireless settings?

Accepted Answer

wpa_supplicant with a configuration file containing the PSK. WPA2-PSK authentication requires the wpa_supplicant daemon, which handles the 4-way handshake and key derivation. A configuration file with the PSK (pre-shared key) is the standard method to define the network SSID and passphrase, allowing wpa_supplicant to manage the wireless association securely.

Answer

NetworkManager with nmcli

Answer

iwconfig with key s:password

Answer

ifconfig wlan0 up and route add default gw 192.168.2.1

Question 5

After adding a new network interface, the system assigns it the name 'enp0s3' instead of 'eth0'. Which of the following best describes the reason for this change?

Accepted Answer

The system uses the new predictable network interface naming scheme.. The system uses the predictable network interface naming scheme (also known as Consistent Network Device Naming), introduced in systemd/udev. This scheme assigns names like 'enp0s3' based on the physical location of the device (e.g., 'en' for Ethernet, 'p0' for PCI bus 0, 's3' for slot 3), replacing the traditional 'eth0' naming that could change unpredictably across reboots or hardware additions.

Answer

The kernel assigns names randomly to avoid conflicts.

Answer

The network card is faulty, causing the kernel to rename it.

Answer

The interface is a virtual device, so it gets a non-standard name.

Question 6

An administrator wants to check the ARP cache for a specific IP address 192.168.1.1. Which command will display the ARP entry for that address?

Accepted Answer

arp -n | grep 192.168.1.1. `arp -n` displays the ARP cache in numeric format, and piping it through `grep 192.168.1.1` filters the output to show only the entry for that specific IP address. The `-n` flag prevents reverse DNS lookups, ensuring the output contains raw IP addresses, which is essential for reliable filtering.

Answer

ip neigh show 192.168.1.1

Answer

arp -a 192.168.1.1

Answer

route -n

Question 7

A company has a server with two network interfaces: eth0 (public IP) and eth1 (private IP). The administrator wants to allow SSH from the public network only. Which iptables rule set achieves this?

Accepted Answer

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -i eth1 -p tcp --dport 22 -j DROP. It explicitly allows SSH (TCP port 22) traffic arriving on the public interface (eth0) and then drops SSH traffic on the private interface (eth1). This ensures SSH is only accessible from the public network while blocking it on the private network. The order of rules matters: the ACCEPT rule for eth0 must come before any default DROP policy or later rules that might affect it.

Answer

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP

Question 8

Which TWO commands can be used to display the routing table on a Linux system?

Accepted Answer

route -n. The `route -n` command displays the kernel IP routing table with numeric addresses, avoiding DNS lookups for faster output. It is a traditional tool that directly reads the /proc/net/route file to show destination, gateway, netmask, and interface information. This makes it a valid and commonly used command for viewing the routing table on Linux.

Answer

ss -r

Answer

ip link show

Answer

netstat -r

Question 9

Which THREE conditions must be met for a Linux system to act as a router between two networks?

Accepted Answer

IP forwarding must be enabled in the kernel (net.ipv4.ip_forward = 1).. The Linux kernel must have IP forwarding enabled to forward packets between network interfaces. This is controlled by the sysctl parameter net.ipv4.ip_forward = 1, which allows the kernel to act as a router by forwarding IP packets from one interface to another based on the routing table.

Answer

The system must have a default gateway configured.

Answer

The firewall must allow forwarding (FORWARD chain policy ACCEPT).

Question 10

Which TWO statements about the /etc/hosts file are true?

Accepted Answer

It can contain a line like '127.0.0.1 localhost'.. The /etc/hosts file maps hostnames to IP addresses, and the line '127.0.0.1 localhost' is the standard entry for the IPv4 loopback interface. This file is consulted by the system's resolver library before DNS queries are made, allowing local overrides for hostname resolution.

Answer

It configures the DNS servers to use.

Answer

It is consulted after DNS by default.

Answer

It can define aliases for network interfaces.

Question 11

A Linux host has a routing table entry that sends all traffic destined for the 10.0.0.0/8 network out interface eth1. A packet is sent from 192.168.1.100 to 10.0.0.5. Which interface will the packet exit?

Accepted Answer

eth1. The routing decision is made by looking up the destination address in the routing table. Since the destination is 10.0.0.5, which matches the route for 10.0.0.0/8 via eth1, the packet is sent out eth1. The source address does not affect the routing decision; the kernel selects the exit interface based solely on the destination IP and the routing table.

Answer

eth0, then eth1 after ARP

Answer

eth0

Answer

lo

Question 12

Refer to the exhibit. If a user on the local machine tries to SSH to a remote host on eth1, what will happen?

Accepted Answer

The connection will succeed because the OUTPUT chain accepts all.. The OUTPUT chain has a default policy of ACCEPT, meaning all outgoing packets, including SSH traffic (TCP port 22), are allowed by default. Since the user is initiating an SSH connection from the local machine, the packet traverses the OUTPUT chain, and with no explicit DROP or REJECT rule, it is permitted. The INPUT chain's default DROP policy only affects incoming packets, not outgoing connections.

Answer

The connection will succeed only if the remote host is on eth0.

Answer

The connection will fail because there is no rule accepting outgoing SSH.

Answer

The connection will fail because the INPUT chain drops all.

Question 13

You are a network administrator for a medium-sized company. The company has a Linux server acting as a router/firewall with three network interfaces: eth0 (public, 203.0.113.2/24, gateway 203.0.113.1), eth1 (DMZ, 10.0.1.1/24), and eth2 (internal, 192.168.1.1/24). The DMZ hosts a web server with IP 10.0.1.100, and the internal network has client machines. The firewall rules are currently set to default DROP on INPUT and FORWARD, ACCEPT on OUTPUT. The administrator wants to allow internal clients (192.168.1.0/24) to access the web server (10.0.1.100) on port 80. Additionally, the administrator wants to allow external users (from the internet) to access the web server's public IP (203.0.113.2) on port 80, which should be DNATed to 10.0.1.100. The administrator has enabled IP forwarding and added the following rules:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.0.1.100:80
iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp --sport 80 -j ACCEPT

Internal clients cannot access the web server. External users are able to access the web server successfully. What is the most likely reason internal clients cannot access the web server?

Accepted Answer

The DNAT rule does not apply to traffic coming from the internal network because it is not received on eth0.. The DNAT rule is placed in the PREROUTING chain of the nat table, which only processes packets arriving on the specified interface (eth0). Internal clients (192.168.1.0/24) sending traffic to the web server (10.0.1.100) do not enter via eth0; they are routed through eth2. Therefore, the DNAT rule never matches their packets, and the destination remains 10.0.1.100, which is directly reachable without NAT. However, the FORWARD rules only allow traffic from eth0 to eth1 and back, so internal client traffic from eth2 to eth1 is implicitly dropped by the default FORWARD policy, causing the failure.

Answer

The web server cannot route back to the internal clients because it is in the DMZ.

Answer

The FORWARD rule for return traffic does not match because the destination is the client.

Answer

IP forwarding is not enabled for the internal interface.

Question 14

A network administrator notices that a Linux router with two network interfaces is not forwarding packets between them, despite having IP forwarding enabled in the kernel. The administrator has verified that the firewall rules are not blocking the traffic. What is the most likely cause of the issue?

Accepted Answer

The default gateway on the router is not set correctly.. A Linux router needs a default gateway to forward packets to networks not directly connected to any of its interfaces. Even with IP forwarding enabled and no firewall blocking, if the default gateway is not set or is incorrect, the router will drop packets destined for remote networks. The administrator has verified that firewall rules are not blocking traffic, and ARP cache issues would not cause persistent failure, so the most likely cause is a missing or incorrectly configured default gateway.

Answer

The ARP cache on the router is stale.

Answer

The iptables FORWARD chain policy is set to DROP.

Answer

The routing table does not contain a route for the destination network.

Question 15

Which TWO of the following are valid methods to configure a Linux system to use a specific DNS server for name resolution?

Accepted Answer

Use NetworkManager to set DNS servers for a connection.. NetworkManager provides a centralized way to manage network connections, including DNS settings. When you configure DNS servers via NetworkManager (e.g., using `nmcli` or the GUI), it writes the appropriate `nameserver` lines to `/etc/resolv.conf` (or manages it via its own internal resolver), ensuring the system uses those DNS servers for name resolution. Option E is correct because directly editing `/etc/resolv.conf` and adding a `nameserver` line is the traditional, low-level method to specify DNS servers, which the resolver library reads directly.

Answer

Add an entry to /etc/hosts with the DNS server's IP.

Answer

Write the DNS server IP to /etc/resolv.conf using systemd-resolved.

Answer

Set the 'hosts' line in /etc/nsswitch.conf to include 'dns'.

Question 16

A client on the internet sends a TCP SYN packet to 10.0.1.10:8080. The router receives it on eth0. According to the exhibit, what will happen to the packet?

Accepted Answer

The packet is forwarded to 10.0.2.5:80 via eth1, with source IP unchanged.. The router performs destination NAT (DNAT) on the packet, changing the destination from 10.0.1.10:8080 to 10.0.2.5:80, and forwards it out eth1 with the source IP unchanged. Therefore, option D is correct. Option A is incorrect because the packet is not dropped. Option B is incorrect because the packet is not simply forwarded to the default gateway; the DNAT rule overrides the destination. Option C is incorrect because no source NAT (SNAT) is performed, so the source IP remains the same.

Answer

The packet is dropped because the destination IP is not directly connected.

Answer

The packet is forwarded to 10.0.1.1 because it is the default gateway.

Answer

The packet is forwarded to 10.0.2.5:80 via eth1, with source IP changed to 10.0.2.20.

Question 17

An administrator needs to prioritize traffic for a VoIP application over other traffic on a Linux router. Which tool should be used to implement traffic shaping and prioritization?

Accepted Answer

tc (traffic control). B is correct because the `tc` (traffic control) command is the standard Linux utility for traffic shaping, prioritization, and bandwidth management. It operates at the kernel's QoS layer, allowing the administrator to define queuing disciplines (qdiscs) such as HTB or PRIO to prioritize VoIP packets based on classification rules, ensuring low latency for real-time traffic.

Answer

ip route with priority

Answer

tcpdump with filters

Answer

iptables with the mangle table

Question 18

A company has a Linux server with two network interfaces: eth0 connected to the internal 192.168.1.0/24 network, and eth1 connected to the internet via a public IP of 203.0.113.10. The server runs a web server on port 80 and needs to allow internal clients to access the internet while hiding their private IPs (MASQUERADE). Additionally, external users should be able to reach the web server using the public IP. The administrator has enabled IP forwarding and configured iptables with the following rules:

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

However, internal clients can access the internet, but external users cannot reach the web server. What should the administrator do to fix the issue?

Accepted Answer

Add a DNAT rule in the PREROUTING chain of the nat table to translate destination 203.0.113.10:80 to 192.168.1.100:80.. The current iptables rules perform SNAT/MASQUERADE for outbound traffic and allow forwarding of related/established inbound traffic, but they do not redirect incoming connections destined for the public IP (203.0.113.10:80) to the internal web server (e.g., 192.168.1.100:80). A DNAT rule in the PREROUTING chain of the nat table is required to translate the destination address and port, so that external packets are forwarded to the internal server and the response traffic is handled by the existing MASQUERADE rule.

Answer

Add a FORWARD rule to allow new connections from eth1 to eth0.

Answer

Add a rule in the INPUT chain to accept traffic on port 80.

Answer

Change the MASQUERADE rule to SNAT with the public IP.

Question 19

A company has multiple subnets and wants to implement policy-based routing to direct traffic from a specific development subnet (192.168.10.0/24) through a specialized firewall for content filtering, while all other traffic uses the default gateway. Which of the following steps is required to achieve this using iproute2 tools?

Accepted Answer

Create a new routing table (e.g., table 100), add a default route via the firewall in that table, and add an ip rule to use table 100 for traffic from 192.168.10.0/24.. Policy-based routing (PBR) with iproute2 requires creating a separate routing table, adding a default route via the firewall in that table, and then using an ip rule to match traffic from the source subnet (192.168.10.0/24) and direct it to that custom table. This allows traffic from the development subnet to follow a different path than the default gateway, while all other traffic continues to use the main routing table.

Answer

Use iptables to mark packets from the development subnet and then use ip rule to use the main table for marked packets.

Answer

Add an ip rule to route traffic from 192.168.10.0/24 to the firewall without creating a new table.

Answer

Add a static route to the main routing table for 192.168.10.0/24 pointing to the firewall.

Question 20

Which TWO network diagnostic steps should be performed to isolate a problem where a Linux server (IP 10.0.0.10/24) cannot reach a remote server (IP 192.168.1.50/24) while other hosts on the same subnet can reach it? Assume routing is properly configured.

Accepted Answer

Check iptables rules for any OUTPUT chain that might be dropping packets.. If the affected server can reach the remote server via other hosts on the same subnet, the issue is likely local to the affected server itself. Checking iptables rules on the OUTPUT chain can reveal whether a firewall rule is specifically dropping outbound packets destined for 192.168.1.50, which would not affect other hosts on the same subnet. This is a common cause of asymmetric connectivity problems where routing is otherwise properly configured.

Answer

Check the routing table on the remote server.

Answer

Ping the remote server from another host on the same subnet to verify connectivity.

Answer

Traceroute to the remote server from the affected server.