LPIC-2 Advanced Networking Configuration Practice Test 5 — 15 Questions

Question 1

Which THREE conditions must be met for a Linux system to act as a router between two networks?

Accepted Answer

IP forwarding must be enabled in the kernel (net.ipv4.ip_forward = 1).. Option A is correct because a Linux host only forwards packets between interfaces when the kernel parameter net.ipv4.ip_forward is set to 1 (via sysctl or /proc/sys/net/ipv4/ip_forward); otherwise packets destined for another network are dropped locally. Option C is correct because the router must know where to send traffic for each destination network, which requires routes in its routing table (either directly connected routes or static/dynamic routes) pointing out the appropriate interface. Option D is correct because each interface participating in routing must be assigned an IP address within the subnet it serves, so hosts on those networks can use it as their gateway and so the router can source/forward on that link. Option B is not required: a default gateway is only needed for reaching networks the router does not have explicit routes for, and a router between two directly connected networks can function without one. Option E is not required: while a restrictive FORWARD chain policy or rules can block forwarding, the absence of firewall rules (or a permissive policy) is not a condition for routing itself, and firewalld/iptables need not even be running.

Answer

The system must have a default gateway configured.

Answer

The firewall must allow forwarding (FORWARD chain policy ACCEPT).

Question 2

Which TWO statements about the /etc/hosts file are true?

Accepted Answer

It can contain a line like '127.0.0.1 localhost'.. Option A is correct because /etc/hosts maps IP addresses to hostnames, and the loopback entry '127.0.0.1 localhost' is a standard, valid line in that file. Option B is correct because the primary purpose of /etc/hosts is static hostname-to-IP-address resolution, typically consulted by the resolver (via nsswitch.conf) before or alongside DNS. Option C is wrong because DNS server addresses are configured in /etc/resolv.conf (or via systemd-resolved/NetworkManager), not /etc/hosts. Option D is wrong because, by default, the hosts file is consulted before DNS in the standard nsswitch.conf 'hosts: files dns' ordering. Option E is wrong because interface aliases are configured with tools like ip addr add or ifconfig, not by /etc/hosts.

Answer

It configures the DNS servers to use.

Answer

It is consulted after DNS by default.

Answer

It can define aliases for network interfaces.

Question 3

A Linux host has a routing table entry that sends all traffic destined for the 10.0.0.0/8 network out interface eth1. A packet is sent from 192.168.1.100 to 10.0.0.5. Which interface will the packet exit?

Accepted Answer

eth1. The routing decision is made by looking up the destination address in the routing table. Since the destination is 10.0.0.5, which matches the route for 10.0.0.0/8 via eth1, the packet is sent out eth1. The source address does not affect the routing decision; the kernel selects the exit interface based solely on the destination IP and the routing table.

Answer

eth0, then eth1 after ARP

Answer

eth0

Answer

lo

Question 4

An administrator needs to prioritize traffic for a VoIP application over other traffic on a Linux router. Which tool should be used to implement traffic shaping and prioritization?

Accepted Answer

tc (traffic control). B is correct because the `tc` (traffic control) command is the standard Linux utility for traffic shaping, prioritization, and bandwidth management. It operates at the kernel's QoS layer, allowing the administrator to define queuing disciplines (qdiscs) such as HTB or PRIO to prioritize VoIP packets based on classification rules, ensuring low latency for real-time traffic.

Answer

ip route with priority

Answer

tcpdump with filters

Answer

iptables with the mangle table

Question 5

A company has a Linux server with two network interfaces: eth0 connected to the internal 192.168.1.0/24 network, and eth1 connected to the internet via a public IP of 203.0.113.10. The server runs a web server on port 80 and needs to allow internal clients to access the internet while hiding their private IPs (MASQUERADE). Additionally, external users should be able to reach the web server using the public IP. The administrator has enabled IP forwarding and configured iptables with the following rules:

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

However, internal clients can access the internet, but external users cannot reach the web server. What should the administrator do to fix the issue?

Accepted Answer

Add a DNAT rule in the PREROUTING chain of the nat table to translate destination 203.0.113.10:80 to 192.168.1.100:80.. The current iptables rules perform SNAT/MASQUERADE for outbound traffic and allow forwarding of related/established inbound traffic, but they do not redirect incoming connections destined for the public IP (203.0.113.10:80) to the internal web server (e.g., 192.168.1.100:80). A DNAT rule in the PREROUTING chain of the nat table is required to translate the destination address and port, so that external packets are forwarded to the internal server and the response traffic is handled by the existing MASQUERADE rule.

Answer

Add a FORWARD rule to allow new connections from eth1 to eth0.

Answer

Add a rule in the INPUT chain to accept traffic on port 80.

Answer

Change the MASQUERADE rule to SNAT with the public IP.

Question 6

A company has multiple subnets and wants to implement policy-based routing to direct traffic from a specific development subnet (192.168.10.0/24) through a specialized firewall for content filtering, while all other traffic uses the default gateway. Which of the following steps is required to achieve this using iproute2 tools?

Accepted Answer

Create a new routing table (e.g., table 100), add a default route via the firewall in that table, and add an ip rule to use table 100 for traffic from 192.168.10.0/24.. Policy-based routing (PBR) with iproute2 requires creating a separate routing table, adding a default route via the firewall in that table, and then using an ip rule to match traffic from the source subnet (192.168.10.0/24) and direct it to that custom table. This allows traffic from the development subnet to follow a different path than the default gateway, while all other traffic continues to use the main routing table.

Answer

Use iptables to mark packets from the development subnet and then use ip rule to use the main table for marked packets.

Answer

Add an ip rule to route traffic from 192.168.10.0/24 to the firewall without creating a new table.

Answer

Add a static route to the main routing table for 192.168.10.0/24 pointing to the firewall.

Question 7

Given the exhibited routing table and rules, what will happen to a packet originating from IP 192.168.10.50 destined to 8.8.8.8?

Accepted Answer

The packet is forwarded via eth1 to 10.0.0.1.. The packet from 192.168.10.50 to 8.8.8.8 is processed using policy routing rules. A rule matches the source and directs the lookup to routing table 100, which contains a route 0.0.0.0/1 via eth1 with next-hop 10.0.0.1. Since 8.8.8.8 falls within the 0.0.0.0/1 prefix (0.0.0.0–127.255.255.255), the kernel selects this route and forwards the packet via eth1 to 10.0.0.1, making option C correct. Option B is incorrect because it omits the next-hop and implies the /1 route is in the main table, which it is not.

Answer

The packet is dropped because no matching route exists.

Answer

The packet is forwarded via eth1 because of the 0.0.0.0/1 route.

Answer

The packet is forwarded via eth0 to the default gateway in the main table.

Question 8

Arrange the steps to configure a Linux system as a DNS server using BIND.

Accepted Answer

Install BIND, define the zone in named.conf, create zone file, check configuration syntax, restart named service, test resolution. After installing BIND, define the zone, create zone file, check syntax, then restart and test.

Answer

Define zone, create zone file, check syntax, install BIND, restart and test

Answer

Install BIND, create zone file, define zone, check syntax, restart and test

Answer

Install BIND, define zone, check syntax, create zone file, restart and test

Question 9

Order the steps to configure a Linux system to send system logs to a remote syslog server.

Accepted Answer

Edit the syslog configuration file (e.g., /etc/rsyslog.conf), add the destination line for the remote server, restart the syslog service, generate a test log message, then verify it appears on the remote server.. The correct sequence for configuring remote syslog logging is to first edit the configuration file (e.g., /etc/rsyslog.conf) and add the remote server destination, then restart the syslog service to apply changes, next generate a test log message (e.g., using logger), and finally verify that the message appears on the remote server. This order ensures that the configuration is properly applied before testing and verification.

Answer

Add the destination line for the remote server, restart the syslog service, edit the syslog configuration file, generate a test log message, then verify on the remote server.

Answer

Generate a test log message, edit the syslog configuration file, add the destination line, restart the syslog service, then verify on the remote server.

Answer

Edit the syslog configuration file, restart the syslog service, add the destination line, generate a test log message, then verify on the remote server.

Question 10

Match each network service to its purpose.

Accepted Answer

DNS: Translates domain names to IP addresses. DNS translates domain names to IP addresses; DHCP assigns IP configurations; HTTP serves web pages; NFS shares files. Common confusions involve swapping these roles.

Answer

DNS: Provides network file sharing

Answer

HTTP: Translates domain names to IP addresses

Question 11

A company's network has a single switch connecting all devices. The IT manager wants to isolate the development team's traffic from the rest of the network without buying new hardware. Which configuration should the administrator implement on the switch ports connected to the development team's computers?

Accepted Answer

Set the ports to access mode and assign them to VLAN 10.. VLANs (Virtual Local Area Networks) logically segment a network at Layer 2, isolating traffic between groups without requiring additional hardware. Setting the switch ports to access mode and assigning them to VLAN 10 places the development team's computers into a separate broadcast domain, preventing their traffic from being visible to devices in other VLANs. This is the standard method for implementing port-based VLAN membership on a managed switch.

Answer

Enable port security with a maximum MAC address count.

Answer

Configure the switch ports as part of a bridge group.

Answer

Set the ports to trunk mode.

Question 12

A network administrator is configuring source-based routing. They have created a new routing table and added a default route. They then run: ip rule add to 10.0.0.0/24 lookup 100. Traffic from 10.0.0.0/24 still uses the main table. What is the problem?

Accepted Answer

The rule uses 'to' instead of 'from' to match the source subnet.. The `ip rule add to 10.0.0.0/24 lookup 100` command uses the `to` keyword, which matches the destination address, not the source address. For source-based routing, you must use the `from` keyword to match the source subnet. Since the rule matches destination 10.0.0.0/24 instead of source, traffic originating from 10.0.0.0/24 is not matched by this rule and continues to use the main routing table.

Answer

The rule is not persistent.

Answer

The rule priority is too high.

Answer

The routing table 100 does not have a default route.

Question 13

A system administrator wants to combine two Gigabit Ethernet interfaces of a Linux server into a single logical interface to increase throughput and provide redundancy. Which kernel module should be loaded to support this? (Assume the interfaces are identical and are connected to the same switch.)

Accepted Answer

bonding. The bonding kernel module (bonding) is the correct choice for combining two Gigabit Ethernet interfaces into a single logical interface to increase throughput and provide redundancy. Bonding is a standard Linux kernel module for link aggregation that supports various modes (e.g., active-backup, 802.3ad). On LPIC-2, bonding is the expected technology for interface bonding.

Answer

bridge

Answer

teaming

Answer

802.1q

Question 14

A Linux administrator is setting up an IPsec VPN between two sites using strongSwan. The VPN established successfully, but traffic between the sites is not being encrypted. What is the most probable cause?

Accepted Answer

The IPsec policies are not configured to match the traffic.. The most probable cause for traffic not being encrypted after a successful IPsec tunnel establishment is that the IPsec policies (e.g., strongSwan's `ipsec.conf` `conn` section with `leftsubnet`/`rightsubnet`) do not match the actual traffic flows. Even if the IKE/SA is up, strongSwan only applies encryption to packets that match the configured selectors; mismatched subnets or protocols result in cleartext traffic bypassing the tunnel.

Answer

The firewall is blocking UDP port 500.

Answer

The kernel does not support IPsec (net.ipv4.ip_forward=0).

Answer

The IPsec daemon is not started.

Question 15

A system administrator wants to allow incoming SSH connections from only the 192.168.1.0/24 network on a Linux server. Which iptables rule accomplishes this?

Accepted Answer

iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT. It appends a rule to the INPUT chain that matches TCP traffic destined for port 22 (SSH) from source IP range 192.168.1.0/24 and accepts it. This restricts incoming SSH connections to only the specified network, which is the intended behavior.

Answer

iptables -A INPUT -p tcp --dport 22 -d 192.168.1.0/24 -j ACCEPT

Answer

iptables -A INPUT -p udp --dport 22 -s 192.168.1.0/24 -j ACCEPT

Answer

iptables -A FORWARD -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT