LPIC-2 Advanced Networking Configuration Practice Test 4 — 15 Questions

Question 1

An administrator is troubleshooting IPv6 connectivity on a Linux host. The host has an IPv6 address configured on eth0, but cannot ping6 the default gateway. The output of 'ip -6 route show' shows a default route via fe80::1 dev eth0. Which tool should be used to verify that the neighbor discovery process is working?

Accepted Answer

ip neigh show. The 'ip neigh show' command displays the neighbor cache (equivalent to ARP table for IPv6), which is populated by the Neighbor Discovery Protocol (NDP). Since the default gateway is a link-local address (fe80::1), the host must have resolved the gateway's MAC address via NDP before it can send packets. If the neighbor entry is missing or incomplete (e.g., STALE or FAILED), it indicates that the neighbor discovery process is not working, which would explain the ping failure.

Answer

tcpdump -i eth0 icmp6

Answer

traceroute6

Answer

ndp -n

Question 2

Which of the following commands creates a new network namespace named 'test'?

Accepted Answer

ip netns add test. The correct command to create a new network namespace named 'test' is 'ip netns add test'. The 'ip netns' command is part of the iproute2 suite and is the standard tool for managing network namespaces in Linux. The 'add' subcommand creates a new namespace by binding it to a mount point under /var/run/netns/.

Answer

netns add test

Answer

network namespace add test

Answer

ip netns create test

Question 3

A security analyst wants to capture only TCP packets with the SYN flag set to identify connection attempts. Which tcpdump filter expression accomplishes this?

Accepted Answer

Both B and C are correct.. Option D is correct because both B and C correctly filter TCP packets with the SYN flag set. In tcpdump, the TCP header's 14th byte (offset 13) contains the flags, with the SYN flag represented by bit 1 (value 2). Both `tcp[13] & 2 != 0` and `tcp[13] & 0x02 != 0` check if the SYN bit is set, making them equivalent. Option A is syntactically incorrect because `tcp-syn` is not a valid tcpdump primitive; the correct form uses the numeric offset and bitmask.

Answer

tcp[tcpflags] & tcp-syn != 0

Answer

tcp[13] & 2 != 0

Answer

tcp[13] & 0x02 != 0

Question 4

To implement 802.1X port-based authentication on a Linux network interface, which combination of software components is typically required when the Linux system acts as the supplicant?

Accepted Answer

wpa_supplicant and hostapd. When a Linux system acts as an 802.1X supplicant, it must authenticate to a network switch (authenticator) using EAP over LAN (EAPoL). wpa_supplicant is the standard Linux supplicant that handles EAP methods and key negotiation, while hostapd is not needed on the supplicant side—it is an authenticator/access point daemon. The correct combination for a supplicant is wpa_supplicant alone; hostapd is irrelevant here, making option A incorrect despite being marked as correct in the answer key.

Answer

hostapd and freeradius

Answer

wpa_supplicant and sssd

Answer

freeradius and wpa_supplicant

Question 5

Which TWO conditions must be met for a Linux bridge to forward Ethernet frames between its ports?

Accepted Answer

The bridge must be in the 'up' state. Option B is correct because a Linux bridge must be in the 'up' administrative state (set via `ip link set br0 up`) to forward frames. Without the 'up' state, the bridge will not process or forward any Ethernet frames between its ports, regardless of other configurations.

Answer

Traffic must be allowed by iptables FORWARD chain

Answer

The bridge must have an IP address configured

Answer

Spanning tree must be disabled

Question 6

Which THREE of the following are valid bonding modes in Linux?

Accepted Answer

mode 2 (balance-xor). Option A (mode 2, balance-xor) is a valid bonding mode that uses a hash policy (typically based on MAC addresses) to select a slave interface for outgoing traffic, providing both load balancing and fault tolerance. It is one of the seven standard bonding modes defined in the Linux kernel bonding driver (modes 0 through 6).

Answer

mode 8

Answer

mode 7

Question 7

An administrator is configuring netfilter rules to implement a stateful firewall. Which TWO of the following commands are necessary to allow the firewall to correctly forward TCP traffic from internal to external networks (assuming proper default policies)?

Accepted Answer

iptables -A FORWARD -m state --state ESTABLISHED -j ACCEPT. Option B is correct because a stateful firewall must allow packets belonging to already established connections to pass through the FORWARD chain. The `-m state --state ESTABLISHED` match ensures that any packet that is part of an existing TCP connection (i.e., has seen the three-way handshake) is accepted, which is essential for forwarding return traffic from external networks back to internal hosts.

Answer

iptables -A FORWARD -m state --state NEW -j ACCEPT

Answer

iptables -A FORWARD -j ACCEPT

Answer

iptables -A FORWARD -m state --state NEW -p tcp --dport 80 -j ACCEPT

Question 8

A packet destined to 192.168.1.100 is sent from this router. Which interface will be used to forward it?

Accepted Answer

eth0. The router uses the routing table to determine the next hop for a packet destined to 192.168.1.100. Assuming a directly connected subnet (e.g., 192.168.1.0/24) is associated with eth0, the kernel will match the longest prefix and forward the packet out of eth0. This is standard IP forwarding behavior governed by the routing table (e.g., 'ip route show').

Answer

lo

Answer

eth1

Answer

The packet will be dropped

Question 9

Based on the capture, which of the following statements is correct about the communication between 10.0.0.1 and 10.0.0.3?

Accepted Answer

All of the above. Option B is correct because the TCP three-way handshake (SYN, SYN-ACK, ACK) is visible in the capture, the client 10.0.0.1 uses a high ephemeral port (e.g., 49152), and the server 10.0.0.3 responds on port 80, indicating an HTTP server is running. All three statements (A, C, D) are true, making 'All of the above' the correct choice.

Answer

The three-way handshake is complete for a TCP connection

Answer

The client is using a random high port

Answer

The server 10.0.0.3 is running an HTTP server

Question 10

After rebooting, the bridge br0 does not forward traffic between eth0 and eth1. Which configuration is most likely missing?

Accepted Answer

bridge_fd 0. The bridge br0 is not forwarding traffic because the default bridge forward delay (bridge_fd) is too long, causing the bridge to remain in a blocking state while waiting for STP convergence. Setting bridge_fd 0 disables the forward delay, allowing the bridge to start forwarding immediately after boot. This is essential when STP is not needed or when the bridge must be operational without delay.

Answer

bridge_stp on

Answer

bridge_maxwait 10

Answer

up ip link set br0 up

Question 11

A network administrator wants to improve network performance by bonding two gigabit Ethernet interfaces (eth0 and eth1) on a Linux server. The switch supports IEEE 802.3ad (LACP). Which bonding mode should be used to provide both load balancing and fault tolerance?

Accepted Answer

802.3ad (mode 4). Option D (802.3ad mode 4) is correct because it uses the IEEE 802.3ad Link Aggregation Control Protocol (LACP) to negotiate with the switch, providing both load balancing (based on a configurable hash policy) and fault tolerance (if a link fails, traffic is redistributed among the remaining links). This mode is specifically designed for switches that support LACP, as stated in the question.

Answer

active-backup (mode 1)

Answer

balance-xor (mode 2)

Answer

balance-rr (mode 0)

Answer

balance-tlb (mode 5)

Question 12

A Linux router is experiencing asymmetric routing issues. The network has two internet connections (ISP1 and ISP2) with default routes. The administrator wants to ensure that traffic originating from a specific source IP uses ISP1 for both incoming and outgoing packets. Which ip rule configuration achieves this?

Accepted Answer

ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1 table isp1; sysctl -w net.ipv4.conf.all.rp_filter=0. Option B is correct because it creates a policy routing rule that matches traffic from source IP 10.0.0.10 and directs it to a custom routing table named 'isp1', which contains a default route via ISP1's gateway (1.1.1.1). Additionally, disabling reverse path filtering (rp_filter=0) is essential to allow asymmetric routing — without it, the kernel would drop return packets arriving via a different interface than the one used for outgoing traffic, which is exactly the scenario in asymmetric routing.

Answer

ip rule add from 10.0.0.10 to 0/0 table isp1; ip route add default via 1.1.1.1 table isp1; ip rule add to 10.0.0.10 table isp1

Answer

ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1 table isp1

Answer

ip rule add from 10.0.0.10 table isp1; ip route add default via 1.1.1.1

Question 13

Which command will display the current VLAN membership of interface eth1?

Accepted Answer

bridge vlan show dev eth1. Option D is correct because the `bridge vlan show dev eth1` command displays the current VLAN membership of a specific interface when the interface is part of a Linux bridge. This command queries the kernel's bridge VLAN filtering database, showing which VLAN IDs are tagged or untagged on the given port, which is the standard way to view VLAN membership in modern Linux networking.

Answer

vconfig list eth1

Answer

ip addr show eth1

Answer

cat /proc/net/vlan/eth1

Answer

ip link show eth1

Question 14

An administrator wants to allow SSH access from the internal network (192.168.1.0/24) only, using nftables. Which rule should be added to the filter table input chain?

Accepted Answer

iif lo accept; tcp dport 22 ip saddr 192.168.1.0/24 accept. Option C is correct because it first accepts loopback traffic (iif lo accept) to avoid breaking local services, then uses a combined match: tcp dport 22 ip saddr 192.168.1.0/24 accept. This ensures only SSH packets from the 192.168.1.0/24 subnet are accepted, while all other SSH attempts are implicitly dropped by the default policy (typically drop) of the input chain. The rule syntax follows nftables' concise, single-line format without semicolons or comments.

Answer

tcp dport 22 accept #from 192.168.1.0/24

Answer

tcp dport 22 accept; ip saddr 192.168.1.0/22 accept

Answer

tcp dport 22 ip saddr != 192.168.1.0/24 drop

Question 15

A server reports packet loss on a bonded interface (mode 4). The switch configuration is verified correct. Running ethtool shows all slaves are connected at 1 Gbps full duplex. Which command should be used to check if the LACP negotiation is successful?

Accepted Answer

cat /proc/net/bonding/bond0. Option D is correct because `/proc/net/bonding/bond0` displays the current bonding status, including LACP negotiation details such as the LACP state (e.g., 'negotiated' or 'expired'), partner system MAC, and port key. This is the standard Linux interface to verify that LACP (802.3ad) has successfully established a link aggregation group with the switch.

Answer

tcpdump -i bond0 ether proto 0x8809

Answer

ethtool -S bond0

Answer

ip link show bond0

Answer

bridge link show