LPIC-2 Advanced Networking Configuration Practice Test 3 — 15 Questions

Question 1

Which command will display the current VLAN membership of interface eth1?

Accepted Answer

bridge vlan show dev eth1. The `bridge vlan show dev eth1` command displays the current VLAN membership of a specific interface when the interface is part of a Linux bridge. This command queries the kernel's bridge VLAN filtering database, showing which VLAN IDs are tagged or untagged on the given port, which is the standard way to view VLAN membership in modern Linux networking.

Answer

vconfig list eth1

Answer

ip addr show eth1

Answer

cat /proc/net/vlan/eth1

Answer

ip link show eth1

Question 2

An administrator wants to allow SSH access from the internal network (192.168.1.0/24) only, using nftables. Which rule should be added to the filter table input chain?

Accepted Answer

iif lo accept; tcp dport 22 ip saddr 192.168.1.0/24 accept. It consists of two separate nftables rules separated by a semicolon. The first rule accepts all loopback traffic, which is necessary to prevent breaking local services. The second rule matches TCP destination port 22 and source IP address 192.168.1.0/24, accepting SSH traffic only from the specified subnet. Any SSH traffic from other sources is implicitly dropped by the default policy of the input chain (typically drop). This syntax is valid in nftables, where semicolons are used to separate multiple rules in a single line.

Answer

tcp dport 22 accept #from 192.168.1.0/24

Answer

tcp dport 22 accept; ip saddr 192.168.1.0/22 accept

Answer

tcp dport 22 ip saddr != 192.168.1.0/24 drop

Question 3

A server reports packet loss on a bonded interface (mode 4). The switch configuration is verified correct. Running ethtool shows all slaves are connected at 1 Gbps full duplex. Which command should be used to check if the LACP negotiation is successful?

Accepted Answer

cat /proc/net/bonding/bond0. `/proc/net/bonding/bond0` displays the current bonding status, including LACP negotiation details such as the LACP state (e.g., 'negotiated' or 'expired'), partner system MAC, and port key. This is the standard Linux interface to verify that LACP (802.3ad) has successfully established a link aggregation group with the switch.

Answer

tcpdump -i bond0 ether proto 0x8809

Answer

ethtool -S bond0

Answer

ip link show bond0

Answer

bridge link show

Question 4

A company's Linux router uses iptables. The administrator needs to log all dropped packets (by default policy) before they are dropped. Where should the LOG rule be placed?

Accepted Answer

In the FORWARD chain with -j LOG --log-prefix 'DROPPED' and then -j DROP. The LOG rule must be placed in the FORWARD chain before the DROP action to log packets that are dropped by the default policy. In iptables, the LOG target does not terminate the rule; it logs the packet and then continues to the next rule. By placing `-j LOG --log-prefix 'DROPPED'` followed by `-j DROP`, the packet is logged before being explicitly dropped, ensuring that packets matching the default policy (which drops at the end of the chain) are captured in the log. The FORWARD chain is the correct chain for a router handling traffic that is not destined for the router itself.

Answer

In the FORWARD chain with target LOG

Answer

In the INPUT chain before the drop rule

Answer

In a custom chain called LOGDROP and jump to it

Question 5

An administrator configures a bridge br0 with two ports (eth0 and eth1). The network uses STP. After configuration, packets from a host on eth0 to a host on eth1 are not forwarded. The bridge shows blocking state for one of the ports. What is the most likely cause?

Accepted Answer

The bridge has loop detection and blocked one port. The bridge br0 has two ports (eth0 and eth1) and STP is enabled. STP detects a loop in the network — in this case, the bridge itself with two ports on the same broadcast domain creates a loop. To prevent broadcast storms and MAC table instability, STP places one of the ports into the blocking state, which stops forwarding frames between the two ports. This is why packets from a host on eth0 to a host on eth1 are not forwarded.

Answer

Incorrect MTU

Answer

STP is disabled

Answer

MAC address learning is disabled

Answer

The bridge is in promiscuous mode

Question 6

A system administrator needs to configure a VPN tunnel using WireGuard. The private key of the local peer is stored in /etc/wireguard/private.key. Which command should be used to set the private key via wg-quick?

Accepted Answer

PrivateKey = $(cat /etc/wireguard/private.key). The `PrivateKey` directive in a WireGuard configuration file expects the actual private key value, not a file path. Using `$(cat /etc/wireguard/private.key)` performs command substitution to read the key file and insert its contents directly into the configuration, which is the proper method for `wg-quick`.

Answer

PostUp = wg set %i private-key /etc/wireguard/private.key

Answer

PrivateKey = /etc/wireguard/private.key

Answer

Key = private-key /etc/wireguard/private.key

Question 7

Which TWO steps are required to enable IP forwarding on a Linux system permanently?

Accepted Answer

Add net.ipv4.ip_forward=1 to /etc/sysctl.conf. Adding `net.ipv4.ip_forward=1` to `/etc/sysctl.conf` makes the change persistent across reboots. Option C is correct because running `sysctl --system` loads settings from all sysctl configuration files (including `/etc/sysctl.conf`) without requiring a reboot, applying the change immediately and permanently. Together, these two steps ensure IP forwarding is enabled both now and after system restart.

Answer

echo 1 > /proc/sys/net/ipv4/ip_forward

Answer

sysctl -w net.ipv4.ip_forward=1

Answer

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Question 8

The following output is displayed when running network configuration commands on a Linux system: ``` $ ip link show ... 2: eth0: mtu 1500 qdisc fq_codel master br0 state UP ... 3: eth0.10@eth0: mtu 1500 qdisc noqueue state UP ... 4: br0: mtu 1500 qdisc noqueue state UP ... $ brctl show bridge name bridge id STP enabled interfaces br0 8000.000000000000 no eth0 ``` Based on this output, what is the configuration of the network interfaces?

Accepted Answer

eth0 is a VLAN trunk port with native VLAN 1; eth0.10 is a VLAN interface for VLAN 10; br0 is a bridge containing eth0.. In the typical Linux network configuration shown in these outputs, the physical interface eth0 is added to the bridge br0 (as seen with brctl show or ip link set master), making it a bridge port. The native VLAN on eth0 is VLAN 1, meaning untagged traffic on eth0 belongs to VLAN 1 and is bridged through br0. The VLAN subinterface eth0.10 is configured for VLAN 10 (e.g., using ip link add link eth0 name eth0.10 type vlan id 10), which handles tagged traffic for VLAN 10. This setup is consistent with a trunk port carrying multiple VLANs, where the native VLAN is untagged and other VLANs use subinterfaces.

Answer

eth0 is directly connected to a bridge; eth0.10 is a separate physical interface; br0 uses VLAN tagging.

Answer

eth0 is a VLAN ID 10 access port; eth0.10 is a separate link.

Answer

eth0 is a member of VLAN 1 only; eth0.10 is a bridge port.

Question 9

Which command would add the default gateway 192.168.1.1 to this interface?

Accepted Answer

ip route add default via 192.168.1.1 dev eth0. The `ip route add default via 192.168.1.1 dev eth0` command explicitly specifies both the gateway address and the outgoing interface, which is necessary when multiple interfaces exist or when the kernel needs to resolve the next-hop without ambiguity. The `default` keyword is a shorthand for `0.0.0.0/0` in IPv4, and the `dev eth0` clause ensures the route is bound to the correct interface.

Answer

ip route add 0.0.0.0/0 via 192.168.1.1 dev eth0

Answer

route add default gw 192.168.1.1

Answer

ip route add default via 192.168.1.1

Question 10

An administrator needs to create a Linux bridge (br0) and add an Ethernet interface (eth1) to it for KVM virtual machine networking. Which set of commands accomplishes this task?

Accepted Answer

brctl addbr br0; brctl addif br0 eth1. `brctl addbr br0` creates a new bridge interface named br0, and `brctl addif br0 eth1` adds the physical Ethernet interface eth1 as a port of that bridge. This is the standard sequence using the legacy bridge utilities to set up a bridge for KVM virtual machine networking, where eth1 becomes a member of br0, allowing VMs to share the physical network.

Answer

ifconfig br0 up; ifconfig eth1 up; brctl addbr br0; brctl addif br0 eth1

Answer

ip link add br0 type bridge; ip link set eth1 master br0

Answer

brctl addbr br0; bridge fdb add dev eth1 master br0

Question 11

Your company has a Linux server acting as a router with three VLAN interfaces: eth0.10 (192.168.10.1/24), eth0.20 (192.168.20.1/24), and eth0.30 (192.168.30.1/24). The server has a default route via eth0 (native VLAN) to the internet gateway at 10.0.0.1. Internal hosts can communicate between VLANs, but cannot reach the internet. You have verified that the default route is present and that the gateway is reachable from the router itself. The iptables FORWARD chain policy is ACCEPT, and no filtering rules are defined. However, you notice that ip_forward is enabled. What is the most likely missing configuration?

Accepted Answer

Add iptables MASQUERADE rule on the outgoing interface (eth0).. The router itself can reach the internet, but internal hosts cannot because traffic from the internal VLANs (192.168.10.0/24, 192.168.20.0/24, 192.168.30.0/24) that is forwarded to the internet via eth0 (10.0.0.0/?) has a source IP from the private RFC 1918 address space. The internet gateway (10.0.0.1) will not route packets back to these private addresses, and even if it did, the return packets would not be delivered to the originating internal host without source NAT. Adding an iptables MASQUERADE rule on the outgoing interface (eth0) performs source NAT (SNAT), rewriting the source IP of forwarded packets to the router's own IP on eth0, so that the internet gateway sees return traffic destined to the router, which then de-masquerades and forwards it back to the correct internal host.

Answer

Enable net.ipv4.ip_forward in sysctl.conf.

Answer

Add a static route on the internal hosts to the internet gateway.

Answer

Disable firewalld to ensure no packet filtering.

Question 12

A system administrator notices that the network bond interface bond0 is not operational. The bond is configured using mode 1 (active-backup). The physical interfaces eth0 and eth1 are both up but bond0 shows 'DOWN'. Which of the following is the most likely cause?

Accepted Answer

The physical interfaces must be set to the 'down' state before being added as slaves.. In Linux bonding, when adding physical interfaces as slaves to a bond in mode 1 (active-backup), the slave interfaces must be in the 'down' state before being enslaved. If they are already 'up', the bond may fail to recognize them correctly, leaving bond0 in a 'DOWN' state even though the physical links are up. This is because the bonding driver expects to take control of the interface's link state and will not properly manage a slave that is already administratively up.

Answer

The bond mode is set to an unsupported value.

Answer

The bonding module has not been loaded into the kernel.

Answer

The bond0 interface has not been assigned an IP address.

Question 13

An administrator needs to add a static route to the destination network 192.168.100.0/24 via gateway 10.0.0.1. Which TWO of the following commands accomplish this? (Choose two.)

Accepted Answer

ip route add 192.168.100.0/24 via 10.0.0.1. Option A is correct because `ip route add 192.168.100.0/24 via 10.0.0.1` is the modern iproute2 syntax that installs a static route to the 192.168.100.0/24 destination prefix using 10.0.0.1 as the next-hop gateway. Option E is correct because `route add -net 192.168.100.0/24 gw 10.0.0.1` is the equivalent legacy net-tools command that adds the same static network route via the specified gateway. Option B is wrong because `nmcli connection modify eth0 +ipv4.routes "192.168.100.0/24 10.0.0.1"` is not valid nmcli syntax for adding a route (the correct form uses `ipv4.routes "192.168.100.0/24 10.0.0.1"` without the leading `+`, or `+ipv4.routes` with a proper value), and it modifies a connection profile rather than directly adding a route. Option C is wrong because `ifconfig eth0:1 192.168.100.1 netmask 255.255.255.0` assigns a secondary IP address/alias to an interface, not a route. Option D is wrong because `iptables -A FORWARD -s 192.168.100.0/24 -j ACCEPT` is a firewall rule permitting forwarded traffic from that subnet, not a routing table entry.

Answer

nmcli connection modify eth0 +ipv4.routes "192.168.100.0/24 10.0.0.1"

Answer

ifconfig eth0:1 192.168.100.1 netmask 255.255.255.0

Answer

iptables -A FORWARD -s 192.168.100.0/24 -j ACCEPT

Question 14

A medium-sized company uses a Linux server as its internet gateway. The server runs Ubuntu 20.04 and has two network interfaces: eth0 (IP 192.168.1.1/24) connected to the internal LAN, and eth1 (DHCP client, obtains IP 203.0.113.10/24, gateway 203.0.113.1) connected to the ISP modem. The server uses iptables for NAT with the rule 'iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE'. IP forwarding is enabled (net.ipv4.ip_forward=1). Firewalld is running with the default zone set to 'public'. For the past week, internal clients on 192.168.1.0/24 have reported intermittent connectivity to external websites. The administrator notices that during the failures, packets sent to external websites leave the internal network (tcpdump on eth1 shows SYN), but the response SYN-ACK never reaches the client. The administrator checks that the iptables FORWARD chain has a default policy of ACCEPT and no restrictive rules. Which of the following is the most likely cause?

Accepted Answer

The firewall is dropping incoming packets on eth1 due to default zone settings.. Firewalld, when running with the default zone set to 'public', applies a default 'reject' or 'drop' policy for incoming traffic on interfaces assigned to that zone. Since eth1 (the external interface) is likely assigned to the public zone, incoming SYN-ACK packets (which are part of established connections) are dropped by firewalld before they can be processed by iptables. This explains why tcpdump on eth1 shows outgoing SYN packets but no incoming SYN-ACK, even though iptables FORWARD chain is permissive.

Answer

The server's routing table is missing a route back to the internal network.

Answer

The MASQUERADE rule is missing the source network specification.

Answer

The default gateway on the internal clients is not set to the Linux server's internal IP.

Question 15

A small office network uses a Linux server running dnsmasq to provide DHCP and DNS services. The server runs Ubuntu with dnsmasq version 2.80. The configuration file /etc/dnsmasq.conf includes: 'interface=eth0', 'dhcp-range=192.168.1.100,192.168.1.200,12h', and no other DNS-related options. Clients receive IP addresses from the DHCP server and can access the internet. However, clients cannot ping other clients by hostname (e.g., 'ping workstation1' fails with NXDOMAIN). The dnsmasq logs show that DHCP requests are handled and the client hostnames are recorded. The administrator verifies that /etc/hosts contains only the localhost entry. Which of the following is the most likely cause?

Accepted Answer

The dnsmasq 'local' directive is not configured to treat local hostnames as authoritative.. Without the 'local' directive (or equivalent '--local' / 'localise-queries'), dnsmasq does not treat hostnames from DHCP leases as authoritative for DNS resolution. By default, dnsmasq only answers queries for names it knows from /etc/hosts or from upstream DNS, but it does not automatically resolve DHCP client hostnames unless explicitly told to do so via 'local' or 'domain' settings. Since the logs show hostnames are recorded but NXDOMAIN is returned, the missing 'local' directive is the most likely cause.

Answer

The dnsmasq 'expand-hosts' option is not enabled.

Answer

The dnsmasq 'domain-needed' option is set, blocking local domain resolution.

Answer

The dnsmasq 'no-hosts' option is configured, ignoring /etc/hosts.