LPIC-2 Advanced Networking Configuration Practice Test 2 — 15 Questions

Question 1

A client on the internet sends a TCP SYN packet to 10.0.1.10:8080. The router receives it on eth0. According to the exhibit, what will happen to the packet?

Accepted Answer

The packet is forwarded to 10.0.2.5:80 via eth1, with source IP unchanged.. The router performs destination NAT (DNAT) on the packet, changing the destination from 10.0.1.10:8080 to 10.0.2.5:80, and forwards it out eth1 with the source IP unchanged. Therefore, option D is correct. Option A is incorrect because the packet is not dropped. Option B is incorrect because the packet is not simply forwarded to the default gateway; the DNAT rule overrides the destination. Option C is incorrect because no source NAT (SNAT) is performed, so the source IP remains the same.

Answer

The packet is dropped because the destination IP is not directly connected.

Answer

The packet is forwarded to 10.0.1.1 because it is the default gateway.

Answer

The packet is forwarded to 10.0.2.5:80 via eth1, with source IP changed to 10.0.2.20.

Question 2

An administrator needs to prioritize traffic for a VoIP application over other traffic on a Linux router. Which tool should be used to implement traffic shaping and prioritization?

Accepted Answer

tc (traffic control). B is correct because the `tc` (traffic control) command is the standard Linux utility for traffic shaping, prioritization, and bandwidth management. It operates at the kernel's QoS layer, allowing the administrator to define queuing disciplines (qdiscs) such as HTB or PRIO to prioritize VoIP packets based on classification rules, ensuring low latency for real-time traffic.

Answer

ip route with priority

Answer

tcpdump with filters

Answer

iptables with the mangle table

Question 3

A company has a Linux server with two network interfaces: eth0 connected to the internal 192.168.1.0/24 network, and eth1 connected to the internet via a public IP of 203.0.113.10. The server runs a web server on port 80 and needs to allow internal clients to access the internet while hiding their private IPs (MASQUERADE). Additionally, external users should be able to reach the web server using the public IP. The administrator has enabled IP forwarding and configured iptables with the following rules:

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

However, internal clients can access the internet, but external users cannot reach the web server. What should the administrator do to fix the issue?

Accepted Answer

Add a DNAT rule in the PREROUTING chain of the nat table to translate destination 203.0.113.10:80 to 192.168.1.100:80.. The current iptables rules perform SNAT/MASQUERADE for outbound traffic and allow forwarding of related/established inbound traffic, but they do not redirect incoming connections destined for the public IP (203.0.113.10:80) to the internal web server (e.g., 192.168.1.100:80). A DNAT rule in the PREROUTING chain of the nat table is required to translate the destination address and port, so that external packets are forwarded to the internal server and the response traffic is handled by the existing MASQUERADE rule.

Answer

Add a FORWARD rule to allow new connections from eth1 to eth0.

Answer

Add a rule in the INPUT chain to accept traffic on port 80.

Answer

Change the MASQUERADE rule to SNAT with the public IP.

Question 4

A company has multiple subnets and wants to implement policy-based routing to direct traffic from a specific development subnet (192.168.10.0/24) through a specialized firewall for content filtering, while all other traffic uses the default gateway. Which of the following steps is required to achieve this using iproute2 tools?

Accepted Answer

Create a new routing table (e.g., table 100), add a default route via the firewall in that table, and add an ip rule to use table 100 for traffic from 192.168.10.0/24.. Policy-based routing (PBR) with iproute2 requires creating a separate routing table, adding a default route via the firewall in that table, and then using an ip rule to match traffic from the source subnet (192.168.10.0/24) and direct it to that custom table. This allows traffic from the development subnet to follow a different path than the default gateway, while all other traffic continues to use the main routing table.

Answer

Use iptables to mark packets from the development subnet and then use ip rule to use the main table for marked packets.

Answer

Add an ip rule to route traffic from 192.168.10.0/24 to the firewall without creating a new table.

Answer

Add a static route to the main routing table for 192.168.10.0/24 pointing to the firewall.

Question 5

Which TWO network diagnostic steps should be performed to isolate a problem where a Linux server (IP 10.0.0.10/24) cannot reach a remote server (IP 192.168.1.50/24) while other hosts on the same subnet can reach it? Assume routing is properly configured.

Accepted Answer

Check iptables rules for any OUTPUT chain that might be dropping packets.. If the affected server can reach the remote server via other hosts on the same subnet, the issue is likely local to the affected server itself. Checking iptables rules on the OUTPUT chain can reveal whether a firewall rule is specifically dropping outbound packets destined for 192.168.1.50, which would not affect other hosts on the same subnet. This is a common cause of asymmetric connectivity problems where routing is otherwise properly configured.

Answer

Check the routing table on the remote server.

Answer

Ping the remote server from another host on the same subnet to verify connectivity.

Answer

Traceroute to the remote server from the affected server.

Question 6

Given the exhibited routing table and rules, what will happen to a packet originating from IP 192.168.10.50 destined to 8.8.8.8?

Accepted Answer

The packet is forwarded via eth1 to 10.0.0.1.. The packet from 192.168.10.50 to 8.8.8.8 is processed using policy routing rules. A rule matches the source and directs the lookup to routing table 100, which contains a route 0.0.0.0/1 via eth1 with next-hop 10.0.0.1. Since 8.8.8.8 falls within the 0.0.0.0/1 prefix (0.0.0.0–127.255.255.255), the kernel selects this route and forwards the packet via eth1 to 10.0.0.1, making option C correct. Option B is incorrect because it omits the next-hop and implies the /1 route is in the main table, which it is not.

Answer

The packet is dropped because no matching route exists.

Answer

The packet is forwarded via eth1 because of the 0.0.0.0/1 route.

Answer

The packet is forwarded via eth0 to the default gateway in the main table.

Question 7

Arrange the steps to configure a Linux system as a DNS server using BIND.

Accepted Answer

Install BIND, define the zone in named.conf, create zone file, check configuration syntax, restart named service, test resolution. After installing BIND, define the zone, create zone file, check syntax, then restart and test.

Answer

Define zone, create zone file, check syntax, install BIND, restart and test

Answer

Install BIND, create zone file, define zone, check syntax, restart and test

Answer

Install BIND, define zone, check syntax, create zone file, restart and test

Question 8

Order the steps to configure a Linux system to send system logs to a remote syslog server.

Accepted Answer

Edit the syslog configuration file (e.g., /etc/rsyslog.conf), add the destination line for the remote server, restart the syslog service, generate a test log message, then verify it appears on the remote server.. The correct sequence for configuring remote syslog logging is to first edit the configuration file (e.g., /etc/rsyslog.conf) and add the remote server destination, then restart the syslog service to apply changes, next generate a test log message (e.g., using logger), and finally verify that the message appears on the remote server. This order ensures that the configuration is properly applied before testing and verification.

Answer

Add the destination line for the remote server, restart the syslog service, edit the syslog configuration file, generate a test log message, then verify on the remote server.

Answer

Generate a test log message, edit the syslog configuration file, add the destination line, restart the syslog service, then verify on the remote server.

Answer

Edit the syslog configuration file, restart the syslog service, add the destination line, generate a test log message, then verify on the remote server.

Question 9

Match each network service to its purpose.

Accepted Answer

DNS: Translates domain names to IP addresses. DNS translates domain names to IP addresses; DHCP assigns IP configurations; HTTP serves web pages; NFS shares files. Common confusions involve swapping these roles.

Answer

DNS: Provides network file sharing

Answer

HTTP: Translates domain names to IP addresses

Question 10

Match each system log to its typical content.

Accepted Answer

/var/log/messages: General system messages including kernel and application logs. Correct matches: /var/log/messages -> general system messages, /var/log/secure -> authentication logs, /var/log/maillog -> mail server logs, /var/log/cron -> cron job logs, /var/log/boot.log -> boot logs. Common confusions include swapping definitions of /var/log/messages and /var/log/secure.

Answer

/var/log/messages: Authentication and security related logs

Answer

/var/log/secure: General system messages including kernel and application logs

Question 11

A company's network has a single switch connecting all devices. The IT manager wants to isolate the development team's traffic from the rest of the network without buying new hardware. Which configuration should the administrator implement on the switch ports connected to the development team's computers?

Accepted Answer

Set the ports to access mode and assign them to VLAN 10.. VLANs (Virtual Local Area Networks) logically segment a network at Layer 2, isolating traffic between groups without requiring additional hardware. Setting the switch ports to access mode and assigning them to VLAN 10 places the development team's computers into a separate broadcast domain, preventing their traffic from being visible to devices in other VLANs. This is the standard method for implementing port-based VLAN membership on a managed switch.

Answer

Enable port security with a maximum MAC address count.

Answer

Configure the switch ports as part of a bridge group.

Answer

Set the ports to trunk mode.

Question 12

A Linux server with two Ethernet interfaces (eth0 and eth1) has been set up as a transparent bridge using brctl. The bridge is up and shows both interfaces as members. However, hosts connected to eth0 cannot communicate with hosts on eth1. What is the most likely cause?

Accepted Answer

Spanning Tree Protocol (STP) is enabled and is blocking one of the ports.. When Spanning Tree Protocol (STP) is enabled on a Linux bridge using brctl, it will automatically transition ports into the blocking state to prevent loops. If the bridge has only two ports and no redundant paths, STP may still keep one port in the blocking state (e.g., during the listening/learning phase or due to a misconfiguration), which prevents frames from being forwarded between eth0 and eth1. This is the most likely cause because STP is enabled by default in brctl and can block ports even in a simple two-port bridge.

Answer

The bridge filtering rules in ebtables are dropping frames.

Answer

The bridge has no IP address assigned.

Answer

The interfaces are not in promiscuous mode.

Question 13

A network administrator is configuring source-based routing. They have created a new routing table and added a default route. They then run: ip rule add to 10.0.0.0/24 lookup 100. Traffic from 10.0.0.0/24 still uses the main table. What is the problem?

Accepted Answer

The rule uses 'to' instead of 'from' to match the source subnet.. The `ip rule add to 10.0.0.0/24 lookup 100` command uses the `to` keyword, which matches the destination address, not the source address. For source-based routing, you must use the `from` keyword to match the source subnet. Since the rule matches destination 10.0.0.0/24 instead of source, traffic originating from 10.0.0.0/24 is not matched by this rule and continues to use the main routing table.

Answer

The rule is not persistent.

Answer

The rule priority is too high.

Answer

The routing table 100 does not have a default route.

Question 14

A system administrator wants to combine two Gigabit Ethernet interfaces of a Linux server into a single logical interface to increase throughput and provide redundancy. Which kernel module should be loaded to support this? (Assume the interfaces are identical and are connected to the same switch.)

Accepted Answer

bonding. The bonding kernel module (bonding) is the correct choice for combining two Gigabit Ethernet interfaces into a single logical interface to increase throughput and provide redundancy. Bonding is a standard Linux kernel module for link aggregation that supports various modes (e.g., active-backup, 802.3ad). On LPIC-2, bonding is the expected technology for interface bonding.

Answer

bridge

Answer

teaming

Answer

802.1q

Question 15

A DHCP server running on a Linux machine is not leasing IP addresses to clients on a particular VLAN. The server's configuration file includes a subnet declaration for that VLAN, but clients receive only link-local addresses. What is the most likely issue?

Accepted Answer

The DHCP server's interface is not in the same broadcast domain.. The DHCP server's interface must be in the same broadcast domain (i.e., the same VLAN) as the clients to receive their DHCPDISCOVER broadcasts directly. If the server is on a different subnet or VLAN without a DHCP relay agent, the broadcast frames never reach the server, so clients receive no DHCPOFFER and fall back to link-local addresses (APIPA).

Answer

The DHCP server is not running.

Answer

The DHCP relay agent is not forwarding requests to the server.

Answer

The subnet mask in the DHCP configuration is incorrect.