LPIC-2 Advanced Networking Configuration Practice Test 4 — 15 Questions

Question 1

A company wants to set up a Linux bridge to connect a wireless interface (wlan0) to a wired interface (eth0) to allow devices on the wired network to access the internet through the wireless uplink. The Linux server runs Debian with hostapd to create an access point on wlan0. The administrator creates a bridge br0 using brctl and adds eth0 and wlan0 as ports. They assign IP 192.168.10.1/24 to br0 and start hostapd. Clients on the wired network can access the internet, but cannot ping clients on the wireless network, and vice versa. The administrator verifies that both interfaces are enslaved to br0 (brctl show shows both). They also confirm that IP forwarding is enabled and there are no iptables rules blocking anything. Which of the following is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The wireless interface wlan0 is not set to 4-address mode (WDS) to allow bridging.. A is correct because a standard wireless interface (station mode) uses 3-address frames (source, destination, BSSID) and drops frames with a fourth address, which is required for bridging. When a bridge forwards a frame from the wired side to the wireless side, it uses the MAC addresses of the original source and destination, but the wireless medium requires the fourth address (the transmitter address) to identify the bridge itself. Without enabling 4-address mode (WDS) on wlan0, the wireless driver will reject these bridged frames, preventing communication between wired and wireless clients.

Answer

The DHCP server is only listening on the bridge interface, not on the individual interfaces.

Answer

The hostapd configuration is missing the 'bridge' parameter to bind to the bridge.

Answer

The iptables firewall is blocking broadcast traffic between bridge ports.

Question 2

A network engineer is configuring a Linux server as a router between two internal networks. The server has two interfaces: eth0 on 10.0.1.0/24 and eth1 on 10.0.2.0/24. The engineer wants to ensure that the router advertises itself as the default gateway to hosts on both networks without running a full routing protocol. Which tool is best suited for this requirement?

Accepted Answer

ISC DHCP server with appropriate subnet declarations and router options. The ISC DHCP server can define subnets and include the router option, which tells DHCP clients which IP address to use as their default gateway. This approach requires no dynamic routing protocol and is ideal for a simple two-interface router. The other tools either serve different purposes or introduce unnecessary complexity for the stated goal.

Answer

radvd

Answer

Quagga with OSPF

Answer

arpwatch

Question 3

A Linux router has two interfaces: eth0 (192.168.1.1/24) and eth1 (10.0.0.1/24). Internal clients on 192.168.1.0/24 need to reach the 10.0.0.0/24 network. The administrator runs `sysctl net.ipv4.ip_forward` and sees `net.ipv4.ip_forward = 0`. Which command should the administrator run to enable routing immediately and persistently?

Accepted Answer

Add net.ipv4.ip_forward = 1 to /etc/sysctl.conf and run sysctl -p. For a Linux system to route packets between two networks, the kernel parameter net.ipv4.ip_forward must be set to 1. The administrator must both activate it in the running kernel and make it persistent across reboots. Editing /etc/sysctl.conf and applying sysctl -p accomplishes both goals, whereas the other commands either lack persistence or address a different function such as NAT.

Answer

echo 1 > /proc/sys/net/ipv4/ip_forward

Answer

Run iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

Answer

sysctl -w net.ipv4.ip_forward=1

Question 4

A production Linux router uses iptables with a default DROP policy on the FORWARD chain. Users report that outbound HTTP and HTTPS traffic works, but DNS queries to an external resolver time out when clients use UDP. TCP DNS queries to the same resolver succeed. Which rule should the administrator add to restore UDP DNS forwarding?

Accepted Answer

iptables -A FORWARD -p udp --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT && iptables -A FORWARD -p udp --sport 53 -m state --state ESTABLISHED -j ACCEPT. UDP DNS requires explicit acceptance in both directions when the FORWARD policy is DROP. Using conntrack state lets the router accept the initial client query as NEW and the resolver reply as ESTABLISHED, which is the standard stateful approach for forwarding UDP services. A single direction-only rule leaves one half of the exchange blocked.

Answer

iptables -A FORWARD -p udp --dport 53 -j LOG --log-prefix "DNS: "

Answer

iptables -A FORWARD -p udp --sport 53 -j ACCEPT

Answer

iptables -A FORWARD -p udp --dport 53 -j ACCEPT

Question 5

A junior administrator needs to temporarily assign the IPv4 address 10.0.5.20 with prefix length /24 to interface eth1 on a running production server, without disrupting the existing address already configured on that same interface and without making the change persistent. Which command accomplishes this?

Accepted Answer

ip addr add 10.0.5.20/24 dev eth1. Adding an address to a live interface requires a command that appends rather than replaces, and that changes only runtime state. The ip addr add syntax appends the address to eth1 without touching addresses already present and without writing to persistent configuration, satisfying both the temporary and non-disruptive conditions of the scenario.

Answer

ip route add 10.0.5.20/24 dev eth1

Answer

ip addr replace 10.0.5.20/24 dev eth1

Answer

ifconfig eth1 10.0.5.20 netmask 255.255.255.0

Question 6

A network engineer is configuring a Linux server as a router. The server has two interfaces: eth0 (192.168.1.1/24) and eth1 (10.0.0.1/24). Clients on 192.168.1.0/24 need to reach the 10.0.0.0/24 network. The engineer has enabled IP forwarding and configured appropriate firewall rules. However, clients cannot reach 10.0.0.0/24. Which command should the engineer run to allow forwarding of packets between the interfaces?

Accepted Answer

iptables -A FORWARD -i eth0 -o eth1 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT. To allow clients on 192.168.1.0/24 to reach 10.0.0.0/24, the FORWARD chain must accept packets from eth0 to eth1. Using conntrack with states NEW,ESTABLISHED,RELATED on that direction permits both the initial connection and its return traffic, because return packets are matched as ESTABLISHED or RELATED. This single rule is sufficient and efficient, avoiding the need for a separate reverse rule.

Answer

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

Answer

iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

Answer

iptables -A FORWARD -i eth1 -o eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Question 7

A Linux server is configured as a router with two interfaces: eth0 (203.0.113.5/24) and eth1 (192.168.100.1/24). The administrator wants to allow internal hosts on 192.168.100.0/24 to access the internet, but only for HTTP (port 80) and HTTPS (port 443) traffic, and to block all other outbound traffic from the internal network. Which two nftables rules, when added to the forward chain of the filter table, will achieve this? (Choose two.)

Accepted Answer

iif eth1 oif eth0 ip saddr 192.168.100.0/24 tcp dport { 80, 443 } accept. To allow only HTTP and HTTPS outbound from the internal network, an accept rule matching those destination ports is needed, followed by a drop rule for all other traffic from that subnet. The accept rule must specify the correct interfaces and source subnet, and the drop rule ensures that any traffic not matching the allowed ports is blocked. Together they implement a default-deny policy for the internal subnet's outbound traffic.

Answer

iif eth1 oif eth0 ip saddr 192.168.100.0/24 tcp dport { 80, 443 } drop

Answer

iif eth1 oif eth0 ip saddr 192.168.100.0/24 ct state new,established,related accept

Answer

iif eth0 oif eth1 ip daddr 192.168.100.0/24 tcp sport { 80, 443 } accept

Question 8

An administrator is troubleshooting a Linux host that cannot reach a remote subnet. The host has two default routes in the main routing table, one via 10.0.0.1 and one via 10.0.0.2. Which TWO commands will show the current routing table and the route selection for a specific destination? (Choose two.)

Accepted Answer

ip route get 203.0.113.10. ip route show reveals the configured routes, including duplicate defaults and their metrics, while ip route get performs the kernel's actual lookup for a destination. Together they confirm both what is configured and what the kernel selects, which is the precise combination needed when multiple default routes exist.

Answer

netstat -rn

Answer

route -n

Answer

traceroute 203.0.113.10

Question 9

A network administrator needs to assign a static IPv6 address to interface eth0 on a Linux server. The address should be 2001:db8::10 with a prefix length of 64. Which command accomplishes this?

Accepted Answer

ip -6 addr add 2001:db8::10/64 dev eth0. Assigning a static IPv6 address requires the ip -6 addr add command followed by the address with prefix length and the device name. This directly configures the interface with the desired address. The other options either use deprecated syntax, omit the address family flag, or mistakenly use the route subcommand, which serves a different purpose.

Answer

ip addr add 2001:db8::10/64 dev eth0

Answer

ifconfig eth0 add 2001:db8::10 netmask 64

Answer

ip -6 route add 2001:db8::10/64 dev eth0

Question 10

An administrator is configuring a Linux host as a DHCP relay so that clients on the 172.16.4.0/24 subnet can obtain leases from a DHCP server on a different subnet. The relay host has interfaces on both subnets and IP forwarding is enabled. Which TWO actions are required for the relay to function? (Choose two.)

Accepted Answer

Install and start a DHCP relay agent such as dhcrelay, specifying the DHCP server address and the client-facing interface.. Relaying DHCP across subnets requires a relay agent that listens on the client-facing interface and forwards requests to the configured server, plus a server-side scope for the client subnet so addresses and options can be issued. IP forwarding alone cannot carry the initial broadcast, and the server needs the matching subnet declaration to answer correctly.

Answer

Disable the DHCP server's ability to send broadcast replies so that all responses are unicast to the relay.

Answer

Configure the relay interface with a static route to 255.255.255.255 via the DHCP server.

Answer

Enable the dhcp-relay option in the kernel using sysctl net.ipv4.conf.all.bootp_relay=1.

Question 11

A Linux router uses nftables with a table inet filter and a base chain forward with policy drop. The administrator wants to allow established and related traffic while accepting new SSH connections to the router itself. Which nftables rule set correctly implements this?

Accepted Answer

nft add rule inet filter input ct state established,related accept; nft add rule inet filter input tcp dport 22 ct state new accept. Inbound SSH to the router is processed by the input chain, so the stateful rule accepting established and related traffic plus the rule for new TCP port 22 must be added there. The forward chain remains restrictive for transit traffic. This preserves the drop policy while enabling management access.

Answer

nft add rule inet filter input ct state new accept; nft add rule inet filter input tcp dport 22 accept

Answer

nft add rule inet filter forward ct state established,related accept; nft add rule inet filter forward tcp dport 22 ct state new accept

Answer

nft add rule inet filter output ct state established,related accept; nft add rule inet filter output tcp dport 22 ct state new accept

Question 12

An administrator is troubleshooting a Linux server that cannot reach a remote network through a gateway. The server has a single interface eth0 with IP 192.168.1.50/24 and gateway 192.168.1.1. Which TWO commands can be used to verify the current routing configuration? (Choose two.)

Accepted Answer

route -n. To verify routing configuration on Linux, the administrator can use ip route show from iproute2 or route -n from the older net-tools suite. Both display the kernel routing table, including the default gateway. The other commands either show interface information or trace paths, which do not directly reveal the configured routes needed to diagnose the connectivity issue.

Answer

netstat -rn

Answer

ifconfig -a

Answer

traceroute 192.168.1.1

Question 13

A system administrator notices that the default gateway is missing after a reboot. The network configuration uses ifup/ifdown scripts. Which file should be modified to ensure the default gateway is persistent?

Accepted Answer

/etc/network/interfaces. On Debian-based systems using ifup/ifdown scripts, persistent network configuration—including the default gateway—is defined in /etc/network/interfaces. The gateway is set with the 'gateway' directive under the appropriate interface stanza, ensuring it is applied automatically on boot. This file is the central configuration source for the ifupdown suite.

Answer

/etc/resolv.conf

Answer

/etc/network/routes

Answer

/etc/sysconfig/network

Question 14

A server with IP 10.0.0.1 needs to forward packets from network 192.168.1.0/24 to 10.0.0.0/24. The administrator runs: 'iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j MASQUERADE'. However, traffic from 192.168.1.0/24 cannot reach 10.0.0.0/24. What is the most likely missing configuration?

Accepted Answer

The FORWARD chain in the filter table must have a rule to allow traffic.. The MASQUERADE rule in the POSTROUTING chain handles source NAT, but it does not automatically allow forwarding of packets. By default, the FORWARD chain in the filter table has a policy of DROP or lacks an explicit ACCEPT rule. Without a rule like `iptables -A FORWARD -s 192.168.1.0/24 -d 10.0.0.0/24 -j ACCEPT`, the kernel's netfilter will drop the forwarded packets, preventing traffic from reaching the destination.

Answer

A DNAT rule is also needed to translate the destination address.

Answer

A route must be added on the 10.0.0.0/24 network pointing back to 10.0.0.1.

Answer

The IP address 10.0.0.1 is not configured on the external interface.

Question 15

After adding a new network interface, the system assigns it the name 'enp0s3' instead of 'eth0'. Which of the following best describes the reason for this change?

Accepted Answer

The system uses the new predictable network interface naming scheme.. The system uses the predictable network interface naming scheme (also known as Consistent Network Device Naming), introduced in systemd/udev. This scheme assigns names like 'enp0s3' based on the physical location of the device (e.g., 'en' for Ethernet, 'p0' for PCI bus 0, 's3' for slot 3), replacing the traditional 'eth0' naming that could change unpredictably across reboots or hardware additions.

Answer

The kernel assigns names randomly to avoid conflicts.

Answer

The network card is faulty, causing the kernel to rename it.

Answer

The interface is a virtual device, so it gets a non-standard name.