LPIC-2 Advanced Networking Configuration Practice Test 3 — 15 Questions

Question 1

A Linux administrator is setting up an IPsec VPN between two sites using strongSwan. The VPN established successfully, but traffic between the sites is not being encrypted. What is the most probable cause?

Accepted Answer

The IPsec policies are not configured to match the traffic.. Option A is correct because the most probable cause for traffic not being encrypted after a successful IPsec tunnel establishment is that the IPsec policies (e.g., strongSwan's `ipsec.conf` `conn` section with `leftsubnet`/`rightsubnet`) do not match the actual traffic flows. Even if the IKE/SA is up, strongSwan only applies encryption to packets that match the configured selectors; mismatched subnets or protocols result in cleartext traffic bypassing the tunnel.

Answer

The firewall is blocking UDP port 500.

Answer

The kernel does not support IPsec (net.ipv4.ip_forward=0).

Answer

The IPsec daemon is not started.

Question 2

A system administrator wants to allow incoming SSH connections from only the 192.168.1.0/24 network on a Linux server. Which iptables rule accomplishes this?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT. Option D is correct because it appends a rule to the INPUT chain that matches TCP traffic destined for port 22 (SSH) from source IP range 192.168.1.0/24 and accepts it. This restricts incoming SSH connections to only the specified network, which is the intended behavior.

Answer

iptables -A INPUT -p tcp --dport 22 -d 192.168.1.0/24 -j ACCEPT

Answer

iptables -A INPUT -p udp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Answer

iptables -A FORWARD -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Question 3

A Linux server is configured as a DNS resolver with BIND. Users report that they cannot resolve external hostnames. The server can resolve internal names. Which of the following is the most likely cause?

Accepted Answer

The firewall is blocking UDP port 53 outgoing from the server.. The server can resolve internal names, indicating that the local BIND service is functioning correctly for authoritative zones. However, external resolution fails, which typically means the server cannot reach upstream DNS servers. Outgoing UDP port 53 is required for DNS queries to external resolvers; if the firewall blocks this traffic, the server cannot forward queries to the internet, while internal queries (often served from local zones) remain unaffected.

Answer

The server's /etc/resolv.conf points to itself.

Answer

The forwarders directive is missing from named.conf.

Answer

The named daemon is not running.

Question 4

A Linux router is experiencing packet loss for connections that should be forwarded. The router's IP forwarding is enabled, and the routing table is correct. Which kernel parameter is most likely causing the issue?

Accepted Answer

net.ipv4.conf.all.rp_filter. The `net.ipv4.conf.all.rp_filter` parameter enables Reverse Path Filtering (RPF), which drops packets arriving on an interface if the kernel does not have a route back to the source IP via that same interface. On a router forwarding traffic between networks, strict RPF can cause packet loss when asymmetric routing is present, even though IP forwarding and the routing table are correct.

Answer

net.ipv4.conf.all.log_martians

Answer

net.ipv4.conf.all.accept_redirects

Answer

net.ipv4.ip_forward

Question 5

Which TWO of the following tools are used to capture and analyze network packets on a Linux system?

Accepted Answer

tcpdump. tcpdump is a command-line packet analyzer that captures raw network packets from the wire by placing the network interface into promiscuous mode and using libpcap to read packets. It allows filtering based on protocols, ports, and hosts using BPF (Berkeley Packet Filter) syntax, making it a fundamental tool for network troubleshooting and security analysis.

Answer

iptables

Answer

netstat

Answer

nmap

Question 6

Which TWO conditions must be met for a Linux bridge to forward traffic between its ports?

Accepted Answer

The bridge has at least two ports added.. Option B is correct because a Linux bridge requires at least two ports to forward traffic; a bridge with only one port cannot forward frames between interfaces. Option C is correct because the bridge kernel module must be loaded (e.g., via `modprobe bridge`) to provide the bridging functionality; without it, bridge operations are impossible.

Answer

The bridge has an IP address.

Answer

The interfaces are in promiscuous mode.

Answer

Spanning Tree Protocol is disabled.

Question 7

Which THREE actions are typically required to configure a VLAN interface on a Linux system?

Accepted Answer

Create the VLAN interface using ip link.. Option A is correct because the `ip link` command is used to create a VLAN interface by specifying the parent physical interface and the VLAN ID (e.g., `ip link add link eth0 name eth0.10 type vlan id 10`). This creates a virtual network interface that tags outgoing frames with the specified 802.1Q VLAN ID and strips tags from incoming frames.

Answer

Add the physical interface to a bridge.

Answer

Configure iptables rules for the VLAN.

Question 8

The server is unable to communicate with hosts on the 192.168.2.0/24 network. Based on the exhibit, what is the most likely cause?

Accepted Answer

The interface has no default gateway configured.. The exhibit shows the interface has an IP address of 192.168.1.10/24 and a default gateway of 0.0.0.0, meaning no default gateway is configured. Without a default gateway, the host cannot route packets to the 192.168.2.0/24 network because that network is not directly connected (it is on a different subnet), and the host has no route to forward traffic beyond its local link. The `route -n` output would confirm the absence of a gateway entry, which is the most likely cause of the communication failure.

Answer

The interface has a duplicate IP address.

Answer

The hardware address is corrupted.

Answer

The subnet mask is incorrect.

Question 9

Hosts connected to eth1 cannot communicate with hosts on eth0. Based on the exhibit, what is the most likely reason?

Accepted Answer

Spanning Tree Protocol has placed eth1 in blocking state.. The exhibit shows a Linux bridge (br0) with eth0 and eth1 as bridge ports. If hosts on eth1 cannot communicate with hosts on eth0, the most likely cause is that Spanning Tree Protocol (STP) has placed eth1 in a blocking state to prevent a Layer 2 loop. STP blocks redundant paths by transitioning ports through listening, learning, and blocking states, and a blocked port does not forward traffic until the topology converges.

Answer

Physical layer issues on eth1.

Answer

Eth1 is not connected to the bridge.

Answer

The bridge interface has no IP address.

Question 10

Traffic from the 10.1.1.0/24 subnet is seen leaving through eth1 as intended, but reply traffic from the internet never comes back. What is the most likely cause?

Accepted Answer

The kernel parameter net.ipv4.conf.all.rp_filter is set to 1.. When `net.ipv4.conf.all.rp_filter` is set to 1, the kernel performs strict reverse path filtering. This means the kernel checks whether the source address of incoming packets can be reached via the interface they arrived on. If reply traffic from the internet arrives on an interface (e.g., eth0) that does not have a route back to the original source subnet (10.1.1.0/24) through that same interface, the kernel drops the packet. This is the most likely cause because the outbound traffic leaves via eth1, but the reply comes back on a different interface, triggering the rp_filter check and causing the reply to be silently discarded.

Answer

The ip rule priority is not set, causing it to be overridden.

Answer

The default route in table 200 points to 172.16.0.1 which does not have a route back to 10.1.1.0/24.

Answer

The router does not have a route back to 10.1.1.0/24 via eth0.

Question 11

A system administrator wants to combine two 1 Gbps Ethernet interfaces into a single logical bonded interface to increase throughput and provide redundancy. Which mode of bonding will provide both load balancing and fault tolerance without requiring switch configuration?

Accepted Answer

mode 6 (balance-alb). Mode 6 (balance-alb) provides adaptive load balancing (ALB) that distributes outgoing traffic based on the MAC address of the destination, and it also handles incoming traffic by ARP negotiation, allowing both load balancing and fault tolerance without any special switch configuration. Unlike other modes that require switch support (e.g., IEEE 802.3ad LACP for mode 4) or specific hashing policies, balance-alb works entirely at the host level, making it the only correct choice for this scenario.

Answer

mode 2 (balance-xor)

Answer

mode 1 (active-backup)

Answer

mode 0 (balance-rr)

Question 12

A network administrator notices that VLAN tagging is not working on a Linux bridge. The bridge interface br0 has member ports eth0 and eth1. The administrator runs 'bridge vlan show' and sees that only the default VLAN 1 is present. What is the most likely cause?

Accepted Answer

The bridge is not enabled for VLAN filtering. The 'bridge vlan show' command only displays VLAN filtering information when VLAN filtering is enabled on the bridge. By default, Linux bridges operate in a simple switching mode without VLAN awareness, meaning all frames are forwarded regardless of VLAN tags. The administrator must explicitly enable VLAN filtering using 'ip link set dev br0 type bridge vlan_filtering 1' to activate per-VLAN forwarding and filtering, which is why only the default untagged VLAN 1 appears.

Answer

The kernel module for VLAN is not loaded

Answer

The VLAN protocol is not set to 802.1Q

Answer

Ports eth0 and eth1 are not set to promiscuous mode

Question 13

A company has multiple internet connections and wants to route traffic from specific subnets to specific providers. They are using policy-based routing with ip rule and ip route. After adding the rules, the administrator finds that the traffic is not matching the intended routing table. Which command should be used to verify that the rules are being matched correctly?

Accepted Answer

ip route get mark . Option B is correct because 'ip route get' with the 'mark' option simulates a packet lookup using the specified routing mark, allowing the administrator to see which routing table would be matched by the policy rules. This directly verifies whether the ip rule conditions (e.g., fwmark, source subnet) are correctly directing traffic to the intended table.

Answer

ip route show cache

Answer

ip rule show

Answer

ip route show table all

Question 14

To create a simple bridge interface that connects two Ethernet interfaces, which of the following commands should be used?

Accepted Answer

ip link add br0 type bridge && ip link set br0 up. Option A is correct because the `ip link add br0 type bridge` command creates a new bridge interface using the modern iproute2 suite, and `ip link set br0 up` activates it. This is the current standard method for bridge creation on Linux, replacing the older brctl tool. The bridge then connects Ethernet interfaces by enslaving them with `ip link set eth0 master br0`.

Answer

brctl addbr br0 && brctl addif br0 eth0 eth1

Answer

ifconfig br0 create && ifconfig br0 up

Answer

Both A and B work correctly

Question 15

An administrator configures a DHCP relay agent using 'dhcrelay' in a network with multiple VLANs. The relay agent is on a Linux server with interfaces eth0 (VLAN 10) and eth1 (VLAN 20). The DHCP server is on VLAN 10. Which command correctly sets up the relay to forward requests from VLAN 20 to the DHCP server at 192.168.1.5?

Accepted Answer

dhcrelay -i eth1 192.168.1.5. Option B is correct because the `-i eth1` flag specifies the interface on which the relay agent should listen for DHCP client broadcasts (VLAN 20). The relay then unicasts those requests to the DHCP server at 192.168.1.5, which resides on VLAN 10. This ensures that only broadcasts from the client-side VLAN are forwarded, not those from the server-side network.

Answer

dhcrelay -i eth0 192.168.1.5

Answer

dhcrelay -i eth0 -i eth1 192.168.1.5

Answer

dhcrelay 192.168.1.5