LPIC-2 Advanced Networking Configuration Practice Test 6 — 15 Questions

Question 1

An administrator is troubleshooting network isolation in a Linux container environment. The container should have its own network stack, but it appears to be using the host's interfaces. Which command correctly runs a command inside a network namespace named 'ns1' to verify its network configuration?

Accepted Answer

ip netns exec ns1 ip addr show. Option B is correct because the `ip netns exec` command is specifically designed to execute a command within a given network namespace. In this scenario, `ip netns exec ns1 ip addr show` runs the `ip addr show` command inside the network namespace named 'ns1', allowing the administrator to verify that the container has its own network stack and is not using the host's interfaces.

Answer

nsenter -t 1234 -n ip addr show

Answer

unshare -n ip addr show

Answer

ip netns add ns1

Question 2

A Linux router needs to forward DHCP broadcasts from clients on subnet 192.168.1.0/24 (eth0) to a DHCP server at 10.0.0.5. Which command starts a DHCP relay agent?

Accepted Answer

dhcrelay -i eth0 10.0.0.5. The correct command is `dhcrelay -i eth0 10.0.0.5`. This starts the DHCP relay agent (ISC DHCP relay) on interface eth0, listening for DHCP broadcast packets (UDP port 67) from clients on subnet 192.168.1.0/24 and forwarding them as unicast to the DHCP server at 10.0.0.5. The relay agent also relays the server's unicast replies back to the client, enabling DHCP service across subnets without a local DHCP server.

Answer

dhcpd -cf /etc/dhcp/dhcpd.conf

Answer

iptables -A INPUT -i eth0 -p udp --dport 67 -j REDIRECT

Answer

dnsmasq -i eth0

Question 3

An administrator is troubleshooting IPv6 connectivity on an interface with link-local address fe80::1. Which command correctly pings that address from the local host, ensuring the packet uses the correct interface?

Accepted Answer

ping6 -I eth0 fe80::1. Option D is correct because the `ping6 -I eth0 fe80::1` command explicitly binds the ICMPv6 echo request to interface `eth0`, which is required when pinging a link-local address (fe80::/10). Link-local addresses are not globally unique; they are scoped to a specific network segment, so the kernel must know which interface to send the packet out of. Without the `-I` option, the system may fail to route the packet or send it out the wrong interface.

Answer

traceroute6 -i eth0 fe80::1

Answer

ping6 fe80::1

Answer

ping -6 eth0 fe80::1

Question 4

A Linux router running FRR (Free Range Routing) needs to participate in OSPF with adjacent Cisco routers. Which configuration file should be modified to enable OSPF?

Accepted Answer

/etc/frr/frr.conf. FRR (Free Range Routing) stores its unified routing protocol configuration in /etc/frr/frr.conf. This file is the primary configuration file for all FRR daemons, including OSPF, and is read by the frr service at startup. Modifying this file and then reloading FRR enables OSPF on the Linux router to peer with adjacent Cisco routers.

Answer

/etc/quagga/ospfd.conf

Answer

/etc/network/interfaces

Answer

/etc/ospfd.conf

Question 5

Which TWO commands display the current kernel routing table? (Choose two.)

Accepted Answer

ip route show. The `ip route show` command (from the iproute2 suite) displays the current kernel routing table in a structured, human-readable format. It is the modern replacement for legacy tools like `route` and `netstat`, and it directly reads routing information from the kernel's FIB (Forwarding Information Base).

Answer

route show

Answer

cat /proc/net/route

Answer

ifconfig -a

Question 6

Which THREE of the following are valid Linux bonding modes? (Choose three.)

Accepted Answer

balance-rr. Balance-rr (round-robin) is a valid Linux bonding mode that transmits packets in sequential order from the first available slave to the last, providing load balancing and fault tolerance. It is one of the seven standard bonding modes defined in the Linux kernel bonding driver.

Answer

link-aggregation

Answer

802.1ad

Question 7

Which TWO tools are commonly used for traffic shaping and QoS on Linux? (Choose two.)

Accepted Answer

wondershaper. Wondershaper is a user-friendly shell script that wraps the `tc` command to simplify traffic shaping by limiting bandwidth on a network interface. It uses the Linux kernel's QoS capabilities, specifically the HTB (Hierarchical Token Bucket) queuing discipline, to prioritize and throttle traffic. This makes it a common tool for basic traffic shaping tasks on Linux.

Answer

ethtool

Answer

iptables

Answer

route

Question 8

Your company has a Linux server acting as a router with three VLAN interfaces: eth0.10 (192.168.10.1/24), eth0.20 (192.168.20.1/24), and eth0.30 (192.168.30.1/24). The server has a default route via eth0 (native VLAN) to the internet gateway at 10.0.0.1. Internal hosts can communicate between VLANs, but cannot reach the internet. You have verified that the default route is present and that the gateway is reachable from the router itself. The iptables FORWARD chain policy is ACCEPT, and no filtering rules are defined. However, you notice that ip_forward is enabled. What is the most likely missing configuration?

Accepted Answer

Add iptables MASQUERADE rule on the outgoing interface (eth0).. The router itself can reach the internet, but internal hosts cannot because traffic from the internal VLANs (192.168.10.0/24, 192.168.20.0/24, 192.168.30.0/24) that is forwarded to the internet via eth0 (10.0.0.0/?) has a source IP from the private RFC 1918 address space. The internet gateway (10.0.0.1) will not route packets back to these private addresses, and even if it did, the return packets would not be delivered to the originating internal host without source NAT. Adding an iptables MASQUERADE rule on the outgoing interface (eth0) performs source NAT (SNAT), rewriting the source IP of forwarded packets to the router's own IP on eth0, so that the internet gateway sees return traffic destined to the router, which then de-masquerades and forwards it back to the correct internal host.

Answer

Enable net.ipv4.ip_forward in sysctl.conf.

Answer

Add a static route on the internal hosts to the internet gateway.

Answer

Disable firewalld to ensure no packet filtering.

Question 9

A Linux server with two NICs bonded in mode 1 (active-backup) was working correctly until a switch was replaced. Now, although both interfaces are up, the bond always shows only one active slave, and if that slave fails, traffic does not fail over. The bonding configuration uses miimon=100 and neither arp_interval nor arp_ip_target is set. You run 'cat /proc/net/bonding/bond0' and see that the MII status of both slaves is 'up' but the link failures count is 0 for the backup slave. What is the most likely cause, and which parameter should be adjusted?

Accepted Answer

Configure arp_interval and arp_ip_target to enable ARP monitoring.. Option D is correct because without ARP monitoring (arp_interval and arp_ip_target), the bond relies solely on MII status to detect link failures. MII monitoring only detects physical link loss at the NIC level, not upstream switch failures or misconfigurations. In this scenario, the switch replacement likely caused a layer-2 or layer-3 issue that does not bring the NIC link down, so MII reports 'up' but traffic cannot pass. Enabling ARP monitoring forces the bond to verify reachability of a target IP, triggering failover when ARP replies are lost.

Answer

Change bonding mode to mode 4 (802.3ad) with LACP.

Answer

Use ifenslave to manually reassign the backup slave.

Answer

Decrease miimon to 50 for faster detection.

Question 10

A system administrator notices that the network bond interface bond0 is not operational. The bond is configured using mode 1 (active-backup). The physical interfaces eth0 and eth1 are both up but bond0 shows 'DOWN'. Which of the following is the most likely cause?

Accepted Answer

The physical interfaces must be set to the 'down' state before being added as slaves.. In Linux bonding, when adding physical interfaces as slaves to a bond in mode 1 (active-backup), the slave interfaces must be in the 'down' state before being enslaved. If they are already 'up', the bond may fail to recognize them correctly, leaving bond0 in a 'DOWN' state even though the physical links are up. This is because the bonding driver expects to take control of the interface's link state and will not properly manage a slave that is already administratively up.

Answer

The bond mode is set to an unsupported value.

Answer

The bonding module has not been loaded into the kernel.

Answer

The bond0 interface has not been assigned an IP address.

Question 11

An administrator needs to add a static route to the destination network 192.168.100.0/24 via gateway 10.0.0.1. Which TWO of the following commands accomplish this? (Choose two.)

Accepted Answer

ip route add 192.168.100.0/24 via 10.0.0.1. Option A is correct because the `ip route add` command is the modern Linux utility for adding static routes, specifying the destination network and gateway via the `via` keyword. Option E is correct because the legacy `route add -net` command also adds a static route, using the `gw` parameter to define the gateway, and both commands achieve the same result of adding a route to 192.168.100.0/24 via 10.0.0.1.

Answer

nmcli connection modify eth0 +ipv4.routes "192.168.100.0/24 10.0.0.1"

Answer

ifconfig eth0:1 192.168.100.1 netmask 255.255.255.0

Answer

iptables -A FORWARD -s 192.168.100.0/24 -j ACCEPT

Question 12

A medium-sized company uses a Linux server as its internet gateway. The server runs Ubuntu 20.04 and has two network interfaces: eth0 (IP 192.168.1.1/24) connected to the internal LAN, and eth1 (DHCP client, obtains IP 203.0.113.10/24, gateway 203.0.113.1) connected to the ISP modem. The server uses iptables for NAT with the rule 'iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE'. IP forwarding is enabled (net.ipv4.ip_forward=1). Firewalld is running with the default zone set to 'public'. For the past week, internal clients on 192.168.1.0/24 have reported intermittent connectivity to external websites. The administrator notices that during the failures, packets sent to external websites leave the internal network (tcpdump on eth1 shows SYN), but the response SYN-ACK never reaches the client. The administrator checks that the iptables FORWARD chain has a default policy of ACCEPT and no restrictive rules. Which of the following is the most likely cause?

Accepted Answer

The firewall is dropping incoming packets on eth1 due to default zone settings.. Firewalld, when running with the default zone set to 'public', applies a default 'reject' or 'drop' policy for incoming traffic on interfaces assigned to that zone. Since eth1 (the external interface) is likely assigned to the public zone, incoming SYN-ACK packets (which are part of established connections) are dropped by firewalld before they can be processed by iptables. This explains why tcpdump on eth1 shows outgoing SYN packets but no incoming SYN-ACK, even though iptables FORWARD chain is permissive.

Answer

The server's routing table is missing a route back to the internal network.

Answer

The MASQUERADE rule is missing the source network specification.

Answer

The default gateway on the internal clients is not set to the Linux server's internal IP.

Question 13

A sysadmin is configuring VLAN tagging on a Linux server that will act as a router-on-a-stick for multiple VLANs (10, 20, 30). The server has a single physical interface enp0s3 connected to a switch trunk port that allows VLANs 10, 20, and 30. The administrator uses systemd-networkd and creates VLAN interfaces enp0s3.10, enp0s3.20, enp0s3.30 with IP addresses 10.0.10.1/24, 10.0.20.1/24, and 10.0.30.1/24 respectively. They enable IP forwarding and, for security, set the iptables FORWARD chain default policy to DROP, but they add no specific rules. Clients in VLAN 10 can ping their gateway (10.0.10.1) but cannot ping clients in VLAN 20 (10.0.20.2). The switch confirms correct configuration. Which of the following is the most likely cause?

Accepted Answer

The server's iptables FORWARD chain is set to DROP by default.. The default policy of the iptables FORWARD chain is set to DROP, and no specific rules are added to allow traffic between VLANs. Since the server is acting as a router-on-a-stick, inter-VLAN traffic must be forwarded by the kernel, which requires explicit ACCEPT rules in the FORWARD chain. Without these rules, packets from VLAN 10 to VLAN 20 are dropped, even though the VLAN interfaces and switch configuration are correct.

Answer

The VLAN interface enp0s3.10 is missing the 'vlan' flag or is not properly bound.

Answer

The server's MAC address is not allowed on the switch for VLAN 10.

Answer

The switch port is configured as an access port instead of a trunk.

Question 14

An administrator wants to implement network bonding for redundancy on a Linux server running RHEL 8. The server has two physical interfaces em1 and em2. The administrator creates a bond interface bond0 with mode active-backup (mode 1) and adds the slaves em1 and em2. They assign IP address 192.168.50.10/24 to bond0 and bring up the bond. The bond appears to work initially, with one slave active. However, when they disconnect the cable from the active slave, the bond does not fail over to the other slave. The administrator checks /proc/net/bonding/bond0 and sees that the link status for both slaves shows 'up' even after the disconnection. They confirm the bonding module is loaded and the mode is correct. Which of the following is the most likely missing configuration?

Accepted Answer

The MII monitoring interval (miimon) is not configured.. The correct answer is A because in active-backup bonding mode (mode 1), the kernel bonding driver requires the MII (Media Independent Interface) monitoring interval (miimon) to be configured in order to detect link failures. Without miimon, the driver never polls the slave interfaces for link state changes, so even when a cable is disconnected, the driver continues to see the link as 'up' and does not trigger a failover. The administrator must set miimon=100 (or another value in milliseconds) in the bond configuration to enable periodic link monitoring.

Answer

The bond interface requires a specific kernel module that is missing.

Answer

The slave interfaces were not set to 'down' before enslaving.

Answer

The bond mode is set to mode 0 instead of mode 1.

Question 15

A small office network uses a Linux server running dnsmasq to provide DHCP and DNS services. The server runs Ubuntu with dnsmasq version 2.80. The configuration file /etc/dnsmasq.conf includes: 'interface=eth0', 'dhcp-range=192.168.1.100,192.168.1.200,12h', and no other DNS-related options. Clients receive IP addresses from the DHCP server and can access the internet. However, clients cannot ping other clients by hostname (e.g., 'ping workstation1' fails with NXDOMAIN). The dnsmasq logs show that DHCP requests are handled and the client hostnames are recorded. The administrator verifies that /etc/hosts contains only the localhost entry. Which of the following is the most likely cause?

Accepted Answer

The dnsmasq 'local' directive is not configured to treat local hostnames as authoritative.. The correct answer is A because without the 'local' directive (or equivalent '--local' / 'localise-queries'), dnsmasq does not treat hostnames from DHCP leases as authoritative for DNS resolution. By default, dnsmasq only answers queries for names it knows from /etc/hosts or from upstream DNS, but it does not automatically resolve DHCP client hostnames unless explicitly told to do so via 'local' or 'domain' settings. Since the logs show hostnames are recorded but NXDOMAIN is returned, the missing 'local' directive is the most likely cause.

Answer

The dnsmasq 'expand-hosts' option is not enabled.

Answer

The dnsmasq 'domain-needed' option is set, blocking local domain resolution.

Answer

The dnsmasq 'no-hosts' option is configured, ignoring /etc/hosts.