LPIC-2 Advanced Networking Configuration Practice Test 7 — 15 Questions

Question 1

A Linux server requires several VLAN interfaces on eth0. The network switch expects 802.1Q tagged frames for VLAN 10. Which command correctly creates the VLAN interface?

Accepted Answer

ip link add link eth0 name eth0.10 type vlan id 10. The `ip link` command with the `type vlan id 10` parameter creates a VLAN subinterface on eth0 that tags outgoing frames with VLAN 10 using the 802.1Q standard. This is the modern, recommended method for VLAN interface creation on Linux, replacing legacy tools like `vconfig`.

Answer

modprobe 8021q; ifconfig eth0 up

Answer

vconfig add eth0 10

Answer

ifconfig eth0:10 192.168.10.1/24 up

Question 2

A company requires link aggregation between a Linux server and a switch to increase throughput and provide redundancy. The switch supports only standard 802.3ad (LACP). Which bonding mode should be configured on the Linux server?

Accepted Answer

mode=4 (802.3ad). Mode=4 (802.3ad) implements the IEEE 802.3ad standard for Link Aggregation Control Protocol (LACP). This mode requires the switch to support LACP, which the scenario states, and provides both increased throughput through load balancing and redundancy through automatic failover if a link fails.

Answer

mode=2 (balance-xor)

Answer

mode=1 (active-backup)

Answer

mode=3 (broadcast)

Answer

mode=0 (balance-rr)

Question 3

An administrator is troubleshooting network isolation in a Linux container environment. The container should have its own network stack, but it appears to be using the host's interfaces. Which command correctly runs a command inside a network namespace named 'ns1' to verify its network configuration?

Accepted Answer

ip netns exec ns1 ip addr show. The `ip netns exec` command is specifically designed to execute a command within a given network namespace. In this scenario, `ip netns exec ns1 ip addr show` runs the `ip addr show` command inside the network namespace named 'ns1', allowing the administrator to verify that the container has its own network stack and is not using the host's interfaces.

Answer

nsenter -t 1234 -n ip addr show

Answer

unshare -n ip addr show

Answer

ip netns add ns1

Question 4

A Linux router needs to forward DHCP broadcasts from clients on subnet 192.168.1.0/24 (eth0) to a DHCP server at 10.0.0.5. Which command starts a DHCP relay agent?

Accepted Answer

dhcrelay -i eth0 10.0.0.5. The correct command is `dhcrelay -i eth0 10.0.0.5`. This starts the DHCP relay agent (ISC DHCP relay) on interface eth0, listening for DHCP broadcast packets (UDP port 67) from clients on subnet 192.168.1.0/24 and forwarding them as unicast to the DHCP server at 10.0.0.5. The relay agent also relays the server's unicast replies back to the client, enabling DHCP service across subnets without a local DHCP server.

Answer

dhcpd -cf /etc/dhcp/dhcpd.conf

Answer

iptables -A INPUT -i eth0 -p udp --dport 67 -j REDIRECT

Answer

dnsmasq -i eth0

Question 5

An administrator is troubleshooting IPv6 connectivity on an interface with link-local address fe80::1. Which command correctly pings that address from the local host, ensuring the packet uses the correct interface?

Accepted Answer

ping6 -I eth0 fe80::1. The `ping6 -I eth0 fe80::1` command explicitly binds the ICMPv6 echo request to interface `eth0`, which is required when pinging a link-local address (fe80::/10). Link-local addresses are not globally unique; they are scoped to a specific network segment, so the kernel must know which interface to send the packet out of. Without the `-I` option, the system may fail to route the packet or send it out the wrong interface.

Answer

traceroute6 -i eth0 fe80::1

Answer

ping6 fe80::1

Answer

ping -6 eth0 fe80::1

Question 6

A Linux router running FRR (Free Range Routing) needs to participate in OSPF with adjacent Cisco routers. Which configuration file should be modified to enable OSPF?

Accepted Answer

/etc/frr/frr.conf. FRR (Free Range Routing) stores its unified routing protocol configuration in /etc/frr/frr.conf. This file is the primary configuration file for all FRR daemons, including OSPF, and is read by the frr service at startup. Modifying this file and then reloading FRR enables OSPF on the Linux router to peer with adjacent Cisco routers.

Answer

/etc/quagga/ospfd.conf

Answer

/etc/network/interfaces

Answer

/etc/ospfd.conf

Question 7

Which TWO commands display the current kernel routing table? (Choose two.)

Accepted Answer

ip route show. The `ip route show` command (from the iproute2 suite) displays the current kernel routing table in a structured, human-readable format. It is the modern replacement for legacy tools like `route` and `netstat`, and it directly reads routing information from the kernel's FIB (Forwarding Information Base).

Answer

route show

Answer

cat /proc/net/route

Answer

ifconfig -a

Question 8

Which THREE of the following are valid Linux bonding modes? (Choose three.)

Accepted Answer

balance-rr. balance-rr (B) is a valid Linux bonding mode (mode 0) that provides round-robin transmission across slave interfaces for load balancing and fault tolerance. 802.3ad (C) is a valid mode (mode 4) implementing IEEE 802.3ad Dynamic Link Aggregation with LACP, requiring switch support for aggregation. active-backup (D) is a valid mode (mode 1) where only one slave is active and another takes over if the active one fails, providing fault tolerance without switch configuration. link-aggregation (A) is not a valid bonding mode name; the correct aggregation mode is 802.3ad (or balance-xor/balance-tlb for other aggregation types). 802.1ad (E) is not a bonding mode; it is an IEEE standard for provider bridging (QinQ VLAN stacking), unrelated to Linux bonding.

Answer

link-aggregation

Answer

802.1ad

Question 9

Which TWO tools are commonly used for traffic shaping and QoS on Linux? (Choose two.)

Accepted Answer

wondershaper. Wondershaper is a user-friendly shell script that wraps the `tc` command to simplify traffic shaping by limiting bandwidth on a network interface. It uses the Linux kernel's QoS capabilities, specifically the HTB (Hierarchical Token Bucket) queuing discipline, to prioritize and throttle traffic. This makes it a common tool for basic traffic shaping tasks on Linux.

Answer

ethtool

Answer

iptables

Answer

route

Question 10

A Linux server with two NICs bonded in mode 1 (active-backup) was working correctly until a switch was replaced. Now, although both interfaces are up, the bond always shows only one active slave, and if that slave fails, traffic does not fail over. The bonding configuration uses miimon=100 and neither arp_interval nor arp_ip_target is set. You run 'cat /proc/net/bonding/bond0' and see that the MII status of both slaves is 'up' but the link failures count is 0 for the backup slave. What is the most likely cause, and which parameter should be adjusted?

Accepted Answer

Configure arp_interval and arp_ip_target to enable ARP monitoring.. Without ARP monitoring (arp_interval and arp_ip_target), the bond relies solely on MII status to detect link failures. MII monitoring only detects physical link loss at the NIC level, not upstream switch failures or misconfigurations. In this scenario, the switch replacement likely caused a layer-2 or layer-3 issue that does not bring the NIC link down, so MII reports 'up' but traffic cannot pass. Enabling ARP monitoring forces the bond to verify reachability of a target IP, triggering failover when ARP replies are lost.

Answer

Change bonding mode to mode 4 (802.3ad) with LACP.

Answer

Use ifenslave to manually reassign the backup slave.

Answer

Decrease miimon to 50 for faster detection.

Question 11

A sysadmin is configuring VLAN tagging on a Linux server that will act as a router-on-a-stick for multiple VLANs (10, 20, 30). The server has a single physical interface enp0s3 connected to a switch trunk port that allows VLANs 10, 20, and 30. The administrator uses systemd-networkd and creates VLAN interfaces enp0s3.10, enp0s3.20, enp0s3.30 with IP addresses 10.0.10.1/24, 10.0.20.1/24, and 10.0.30.1/24 respectively. They enable IP forwarding and, for security, set the iptables FORWARD chain default policy to DROP, but they add no specific rules. Clients in VLAN 10 can ping their gateway (10.0.10.1) but cannot ping clients in VLAN 20 (10.0.20.2). The switch confirms correct configuration. Which of the following is the most likely cause?

Accepted Answer

The server's iptables FORWARD chain is set to DROP by default.. The default policy of the iptables FORWARD chain is set to DROP, and no specific rules are added to allow traffic between VLANs. Since the server is acting as a router-on-a-stick, inter-VLAN traffic must be forwarded by the kernel, which requires explicit ACCEPT rules in the FORWARD chain. Without these rules, packets from VLAN 10 to VLAN 20 are dropped, even though the VLAN interfaces and switch configuration are correct.

Answer

The VLAN interface enp0s3.10 is missing the 'vlan' flag or is not properly bound.

Answer

The server's MAC address is not allowed on the switch for VLAN 10.

Answer

The switch port is configured as an access port instead of a trunk.

Question 12

An administrator wants to implement network bonding for redundancy on a Linux server running RHEL 8. The server has two physical interfaces em1 and em2. The administrator creates a bond interface bond0 with mode active-backup (mode 1) and adds the slaves em1 and em2. They assign IP address 192.168.50.10/24 to bond0 and bring up the bond. The bond appears to work initially, with one slave active. However, when they disconnect the cable from the active slave, the bond does not fail over to the other slave. The administrator checks /proc/net/bonding/bond0 and sees that the link status for both slaves shows 'up' even after the disconnection. They confirm the bonding module is loaded and the mode is correct. Which of the following is the most likely missing configuration?

Accepted Answer

The MII monitoring interval (miimon) is not configured.. In active-backup bonding mode (mode 1), the kernel bonding driver requires the MII (Media Independent Interface) monitoring interval (miimon) to be configured in order to detect link failures. Without miimon, the driver never polls the slave interfaces for link state changes, so even when a cable is disconnected, the driver continues to see the link as 'up' and does not trigger a failover. The administrator must set miimon=100 (or another value in milliseconds) in the bond configuration to enable periodic link monitoring.

Answer

The bond interface requires a specific kernel module that is missing.

Answer

The slave interfaces were not set to 'down' before enslaving.

Answer

The bond mode is set to mode 0 instead of mode 1.

Question 13

A Linux router uses nftables for packet filtering and NAT. The administrator adds a rule to the postrouting chain of the nat table to masquerade traffic from the internal LAN (192.168.1.0/24) going out through eth0. After applying the ruleset with nft -f ruleset.nft, internal clients still cannot reach external web servers. The administrator confirms that IP forwarding is enabled. Which additional step is required for the masquerading to function?

Accepted Answer

Ensure the forward chain in the filter table accepts the traffic from 192.168.1.0/24 to the external interface.. The nat table's postrouting chain performs address translation but does not authorize packet forwarding. nftables evaluates the forward chain in the filter table for routed traffic, and if that chain's policy is drop or lacks an accept rule, the packets are discarded before translation matters. Adding an accept rule for the internal subnet in the forward chain resolves the issue.

Answer

Add a rule to the input chain of the filter table to accept traffic from 192.168.1.0/24.

Answer

Disable reverse path filtering by setting net.ipv4.conf.all.rp_filter to 0.

Answer

Change the masquerade rule to use the 'snat to' statement with the router's external IP address.

Question 14

A Linux server uses a bonded interface bond0 in 802.3ad (LACP) mode with two slaves, eth0 and eth1. The switch ports are correctly configured for LACP. After a reboot, the administrator finds that bond0 is up, but only eth0 carries traffic; eth1 remains in a 'backup' state. Which command should the administrator run first to verify the bonding mode and active aggregator selection?

Accepted Answer

cat /proc/net/bonding/bond0. The bonding proc file is the authoritative source for mode, active aggregator, and per-slave state on Linux. Reading it first confirms whether the bond is truly in 802.3ad mode and whether eth1 is unselected because of LACP negotiation failure, missing switch configuration, or carrier issues before moving to NIC-level counters.

Answer

brctl show bond0

Answer

ip -s link show bond0

Answer

ethtool -S eth1

Question 15

A Linux router uses nftables for packet filtering. The administrator wants to log all new TCP connections to port 22 from the 10.0.0.0/24 network but only once per connection, and then accept them. Which nftables rule accomplishes this?

Accepted Answer

nft add rule ip filter INPUT ip saddr 10.0.0.0/24 tcp dport 22 ct state new log prefix "SSH: " accept. The rule must match new connections, then log, then accept. In nftables, matches such as 'ct state new' come before statements like 'log' and 'accept'. The correct rule uses 'ct state new' to limit logging to the first packet of each connection, then logs with a prefix, then accepts. Placing 'accept' before 'log' or using 'established' fails the requirement.

Answer

nft add rule ip filter INPUT ip saddr 10.0.0.0/24 tcp dport 22 log prefix "SSH: " ct state new accept

Answer

nft add rule ip filter INPUT ip saddr 10.0.0.0/24 tcp dport 22 accept log prefix "SSH: "

Answer

nft add rule ip filter INPUT ip saddr 10.0.0.0/24 tcp dport 22 ct state established log prefix "SSH: " accept