LPIC-2 Advanced Networking Configuration Practice Test 6 — 15 Questions

Question 1

A Linux router is experiencing packet loss for connections that should be forwarded. The router's IP forwarding is enabled, and the routing table is correct. Which kernel parameter is most likely causing the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

net.ipv4.conf.all.rp_filter. The `net.ipv4.conf.all.rp_filter` parameter enables Reverse Path Filtering (RPF), which drops packets arriving on an interface if the kernel does not have a route back to the source IP via that same interface. On a router forwarding traffic between networks, strict RPF can cause packet loss when asymmetric routing is present, even though IP forwarding and the routing table are correct.

Answer

net.ipv4.conf.all.log_martians

Answer

net.ipv4.conf.all.accept_redirects

Answer

net.ipv4.ip_forward

Question 2

Which TWO of the following tools are used to capture and analyze network packets on a Linux system?

Accepted Answer

tcpdump. tcpdump is a command-line packet analyzer that captures raw network packets from the wire by placing the network interface into promiscuous mode and using libpcap to read packets. It allows filtering based on protocols, ports, and hosts using BPF (Berkeley Packet Filter) syntax, making it a fundamental tool for network troubleshooting and security analysis.

Answer

iptables

Answer

netstat

Answer

nmap

Question 3

Which THREE actions are typically required to configure a VLAN interface on a Linux system?

Accepted Answer

Create the VLAN interface using ip link.. The `ip link` command is used to create a VLAN interface by specifying the parent physical interface and the VLAN ID (e.g., `ip link add link eth0 name eth0.10 type vlan id 10`). This creates a virtual network interface that tags outgoing frames with the specified 802.1Q VLAN ID and strips tags from incoming frames.

Answer

Add the physical interface to a bridge.

Answer

Configure iptables rules for the VLAN.

Question 4

A network administrator notices that VLAN tagging is not working on a Linux bridge. The bridge interface br0 has member ports eth0 and eth1. The administrator runs 'bridge vlan show' and sees that only the default VLAN 1 is present. What is the most likely cause?

Accepted Answer

The bridge is not enabled for VLAN filtering. The 'bridge vlan show' command only displays VLAN filtering information when VLAN filtering is enabled on the bridge. By default, Linux bridges operate in a simple switching mode without VLAN awareness, meaning all frames are forwarded regardless of VLAN tags. The administrator must explicitly enable VLAN filtering using 'ip link set dev br0 type bridge vlan_filtering 1' to activate per-VLAN forwarding and filtering, which is why only the default untagged VLAN 1 appears.

Answer

The kernel module for VLAN is not loaded

Answer

The VLAN protocol is not set to 802.1Q

Answer

Ports eth0 and eth1 are not set to promiscuous mode

Question 5

Which of the following commands creates a new network namespace named 'test'?

Accepted Answer

ip netns add test. The correct command to create a new network namespace named 'test' is 'ip netns add test'. The 'ip netns' command is part of the iproute2 suite and is the standard tool for managing network namespaces in Linux. The 'add' subcommand creates a new namespace by binding it to a mount point under /var/run/netns/.

Answer

netns add test

Answer

network namespace add test

Answer

ip netns create test

Question 6

To implement 802.1X port-based authentication on a Linux network interface, which combination of software components is typically required when the Linux system acts as the supplicant?

Accepted Answer

wpa_supplicant and hostapd. To implement 802.1X port-based authentication as a Linux supplicant, only wpa_supplicant is required. hostapd is an authenticator (AP/switch side) and is not needed on the client. The other options include unnecessary components (hostapd, freeradius, sssd). Therefore none of the given combinations is correct.

Answer

hostapd and freeradius

Answer

wpa_supplicant and sssd

Answer

freeradius and wpa_supplicant

Question 7

Which TWO conditions must be met for a Linux bridge to forward Ethernet frames between its ports?

Accepted Answer

The bridge must be in the 'up' state. A Linux bridge must be in the 'up' administrative state (set via `ip link set br0 up`) to forward frames. Without the 'up' state, the bridge will not process or forward any Ethernet frames between its ports, regardless of other configurations.

Answer

Traffic must be allowed by iptables FORWARD chain

Answer

The bridge must have an IP address configured

Answer

Spanning tree must be disabled

Question 8

Which THREE of the following are valid bonding modes in Linux?

Accepted Answer

mode 2 (balance-xor). (mode 2, balance-xor) is a valid bonding mode that uses a hash policy (typically based on MAC addresses) to select a slave interface for outgoing traffic, providing both load balancing and fault tolerance. It is one of the seven standard bonding modes defined in the Linux kernel bonding driver (modes 0 through 6).

Answer

mode 8

Answer

mode 7

Question 9

A network administrator wants to improve network performance by bonding two gigabit Ethernet interfaces (eth0 and eth1) on a Linux server. The switch supports IEEE 802.3ad (LACP). Which bonding mode should be used to provide both load balancing and fault tolerance?

Accepted Answer

802.3ad (mode 4). (802.3ad mode 4) is correct because it uses the IEEE 802.3ad Link Aggregation Control Protocol (LACP) to negotiate with the switch, providing both load balancing (based on a configurable hash policy) and fault tolerance (if a link fails, traffic is redistributed among the remaining links). This mode is specifically designed for switches that support LACP, as stated in the question.

Answer

active-backup (mode 1)

Answer

balance-xor (mode 2)

Answer

balance-rr (mode 0)

Answer

balance-tlb (mode 5)

Question 10

Which of the following is the correct command to add an IPv6 address 2001:db8::1/64 to interface eth0?

Accepted Answer

ip -6 addr add 2001:db8::1/64 dev eth0. The `ip -6 addr add` command is the proper way to add an IPv6 address to an interface using the `ip` tool from the iproute2 suite. The `-6` option restricts the operation to IPv6, and the address must include the prefix length (`/64`) to define the subnet. The `dev eth0` parameter specifies the target interface.

Answer

ip addr add 2001:db8::1/64 dev eth0

Answer

ip -6 addr add 2001:db8::1 dev eth0

Answer

ip link set eth0 ipv6 2001:db8::1/64

Answer

ifconfig eth0 inet6 add 2001:db8::1/64

Question 11

Which TWO statements about VLAN tagging are correct?

Accepted Answer

Untagged frames on a trunk port are typically assigned to the native VLAN. On a trunk port, frames that do not carry a VLAN tag are considered to belong to the native VLAN. The switch forwards these untagged frames as part of the native VLAN, which is typically VLAN 1 by default but can be configured to any VLAN. This behavior is defined in IEEE 802.1Q and is essential for interoperability with devices that do not support VLAN tagging.

Answer

VLAN tagging can only be used with Ethernet

Answer

VLAN tags are always 12 bits

Answer

VLAN tags are added by the switch, not the host

Question 12

Which THREE commands can be used to display routing information?

Accepted Answer

route -n. The `route -n` command displays the kernel's IPv4 routing table with numeric addresses, avoiding DNS lookups. It is a standard tool for viewing routing information on Linux systems, making option B correct.

Answer

ping -R

Answer

traceroute

Question 13

A host on 192.168.2.100 tries to SSH to the firewall's IP address (192.168.1.1). The firewall's input chain policy is drop. Will the SSH connection be allowed?

Accepted Answer

No, because the input chain drops all packets that don't match rules.. The stem provides no specific firewall rule. With the input chain policy set to 'drop', all packets not matching any rule are dropped. Since no rule is stated to permit SSH, the connection from 192.168.2.100 to 192.168.1.1 will be blocked. Therefore, the correct answer is 'No' (Option A). Options B and C are incorrect because they either misidentify the traffic type or reference a non‑existent forward rule. Option D is incorrect because the stem does not mention any rule accepting SSH from the 192.168.2.0/24 subnet; such a rule is not provided.

Answer

No, because SSH to firewall is considered forwarded traffic.

Answer

Yes, because the forward chain accepts SSH.

Answer

Yes, because there is a rule accepting SSH from 192.168.2.0/24.

Question 14

A system administrator recently configured two NICs in a bonding interface (bond0) using mode 1 (active-backup). Although both links appear up, traffic never fails over when the primary link goes down. Which command should the administrator use to diagnose the bonding status and determine the root cause?

Accepted Answer

cat /proc/net/bonding/bond0. /proc/net/bonding/bond0 is the kernel-level interface that exposes the current bonding driver state, including active slave, link status, and failover counters. In mode 1 (active-backup), this file shows whether the primary interface is actually marked as 'up' by the bonding driver and whether the backup interface is ready to take over. The administrator can check for issues such as the primary link being stuck in a 'down' state due to misconfigured MII monitoring or missing 'miimon' parameter.

Answer

netstat -i

Answer

ifconfig bond0

Answer

ethtool bond0

Question 15

A Linux router running multiple routing tables is misconfigured. The administrator wants to add a policy routing rule that sends all traffic from subnet 10.10.0.0/16 to routing table 200. Which command should be used?

Accepted Answer

ip rule add from 10.10.0.0/16 table 200. The `ip rule` command is used to add policy routing rules in Linux, which direct packets to specific routing tables based on criteria like source address. The `from` parameter specifies the source subnet (10.10.0.0/16), and `table 200` directs matching traffic to routing table 200, enabling policy-based routing beyond the default table.

Answer

route add -net 10.10.0.0/16 table 200

Answer

iptables -A FORWARD -s 10.10.0.0/16 -j table 200

Answer

ip route add 10.10.0.0/16 dev eth0 table 200