LPIC-2 Advanced Networking Configuration — Timed 15 Questions

Question 1

An administrator wants to configure a virtual IP address on interface eth0 with IP 192.168.1.100/24. Which command correctly adds the virtual IP as an alias?

Accepted Answer

ip addr add 192.168.1.100/24 dev eth0:0. Option B is correct because the `ip addr add` command with `dev eth0:0` directly assigns the IP address to the virtual interface `eth0:0`, which is the standard method in the `iproute2` suite for creating an alias. The `ip` command does not use an `alias` keyword; instead, the device name itself (e.g., `eth0:0`) defines the alias. This approach is consistent with modern Linux networking, replacing the deprecated `ifconfig` method.

Answer

ip addr add 192.168.1.100/24 dev eth0 alias eth0:0

Answer

ip addr add 192.168.1.100/24 dev eth0 label eth0:0

Answer

ifconfig eth0:0 192.168.1.100 netmask 255.255.255.0

Question 2

A system administrator notices that the default gateway is missing after a reboot. The network configuration uses ifup/ifdown scripts. Which file should be modified to ensure the default gateway is persistent?

Accepted Answer

/etc/network/interfaces. On Debian-based systems using ifup/ifdown scripts, persistent network configuration—including the default gateway—is defined in /etc/network/interfaces. The gateway is set with the 'gateway' directive under the appropriate interface stanza, ensuring it is applied automatically on boot. This file is the central configuration source for the ifupdown suite.

Answer

/etc/resolv.conf

Answer

/etc/network/routes

Answer

/etc/sysconfig/network

Question 3

A server with IP 10.0.0.1 needs to forward packets from network 192.168.1.0/24 to 10.0.0.0/24. The administrator runs: 'iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 10.0.0.0/24 -j MASQUERADE'. However, traffic from 192.168.1.0/24 cannot reach 10.0.0.0/24. What is the most likely missing configuration?

Accepted Answer

The FORWARD chain in the filter table must have a rule to allow traffic.. The MASQUERADE rule in the POSTROUTING chain handles source NAT, but it does not automatically allow forwarding of packets. By default, the FORWARD chain in the filter table has a policy of DROP or lacks an explicit ACCEPT rule. Without a rule like `iptables -A FORWARD -s 192.168.1.0/24 -d 10.0.0.0/24 -j ACCEPT`, the kernel's netfilter will drop the forwarded packets, preventing traffic from reaching the destination.

Answer

A DNAT rule is also needed to translate the destination address.

Answer

A route must be added on the 10.0.0.0/24 network pointing back to 10.0.0.1.

Answer

The IP address 10.0.0.1 is not configured on the external interface.

Question 4

An administrator needs to configure a wireless interface wlan0 with WPA2-PSK authentication and a static IP address 192.168.2.50/24. Which tool should be used to configure the wireless settings?

Accepted Answer

wpa_supplicant with a configuration file containing the PSK. WPA2-PSK authentication requires the wpa_supplicant daemon, which handles the 4-way handshake and key derivation. A configuration file with the PSK (pre-shared key) is the standard method to define the network SSID and passphrase, allowing wpa_supplicant to manage the wireless association securely.

Answer

NetworkManager with nmcli

Answer

iwconfig with key s:password

Answer

ifconfig wlan0 up and route add default gw 192.168.2.1

Question 5

After adding a new network interface, the system assigns it the name 'enp0s3' instead of 'eth0'. Which of the following best describes the reason for this change?

Accepted Answer

The system uses the new predictable network interface naming scheme.. The system uses the predictable network interface naming scheme (also known as Consistent Network Device Naming), introduced in systemd/udev. This scheme assigns names like 'enp0s3' based on the physical location of the device (e.g., 'en' for Ethernet, 'p0' for PCI bus 0, 's3' for slot 3), replacing the traditional 'eth0' naming that could change unpredictably across reboots or hardware additions.

Answer

The kernel assigns names randomly to avoid conflicts.

Answer

The network card is faulty, causing the kernel to rename it.

Answer

The interface is a virtual device, so it gets a non-standard name.

Question 6

An administrator wants to check the ARP cache for a specific IP address 192.168.1.1. Which command will display the ARP entry for that address?

Accepted Answer

arp -n | grep 192.168.1.1. Option C is correct because `arp -n` displays the ARP cache in numeric format, and piping it through `grep 192.168.1.1` filters the output to show only the entry for that specific IP address. The `-n` flag prevents reverse DNS lookups, ensuring the output contains raw IP addresses, which is essential for reliable filtering.

Answer

ip neigh show 192.168.1.1

Answer

arp -a 192.168.1.1

Answer

route -n

Question 7

A company has a server with two network interfaces: eth0 (public IP) and eth1 (private IP). The administrator wants to allow SSH from the public network only. Which iptables rule set achieves this?

Accepted Answer

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -i eth1 -p tcp --dport 22 -j DROP. Option A is correct because it explicitly allows SSH (TCP port 22) traffic arriving on the public interface (eth0) and then drops SSH traffic on the private interface (eth1). This ensures SSH is only accessible from the public network while blocking it on the private network. The order of rules matters: the ACCEPT rule for eth0 must come before any default DROP policy or later rules that might affect it.

Answer

iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

Answer

iptables -A INPUT -p tcp --dport 22 -j DROP

Question 8

Which TWO commands can be used to display the routing table on a Linux system?

Accepted Answer

route -n. The `route -n` command displays the kernel IP routing table with numeric addresses, avoiding DNS lookups for faster output. It is a traditional tool that directly reads the /proc/net/route file to show destination, gateway, netmask, and interface information. This makes it a valid and commonly used command for viewing the routing table on Linux.

Answer

ss -r

Answer

ip link show

Answer

netstat -r

Question 9

Which THREE conditions must be met for a Linux system to act as a router between two networks?

Accepted Answer

IP forwarding must be enabled in the kernel (net.ipv4.ip_forward = 1).. Option A is correct because the Linux kernel must have IP forwarding enabled to forward packets between network interfaces. This is controlled by the sysctl parameter net.ipv4.ip_forward = 1, which allows the kernel to act as a router by forwarding IP packets from one interface to another based on the routing table.

Answer

The system must have a default gateway configured.

Answer

The firewall must allow forwarding (FORWARD chain policy ACCEPT).

Question 10

Which TWO statements about the /etc/hosts file are true?

Accepted Answer

It can contain a line like '127.0.0.1 localhost'.. Option A is correct because the /etc/hosts file maps hostnames to IP addresses, and the line '127.0.0.1 localhost' is the standard entry for the IPv4 loopback interface. This file is consulted by the system's resolver library before DNS queries are made, allowing local overrides for hostname resolution.

Answer

It configures the DNS servers to use.

Answer

It is consulted after DNS by default.

Answer

It can define aliases for network interfaces.

Question 11

Refer to the exhibit. A packet is sent from 192.168.1.100 to 10.0.0.5. Which interface will the packet exit?

Accepted Answer

eth1. The packet is sent from 192.168.1.100 (a private IP in the 192.168.0.0/16 range) to 10.0.0.5 (a private IP in the 10.0.0.0/8 range). Since these are on different subnets, the packet must be routed through a gateway. The routing table on the source host (or router) will have a route for 10.0.0.0/8 pointing to eth1, so the packet exits via eth1. No ARP is needed on eth0 because the packet never leaves eth0 for this destination.

Answer

eth0, then eth1 after ARP

Answer

eth0

Answer

lo

Question 12

Refer to the exhibit. If a user on the local machine tries to SSH to a remote host on eth1, what will happen?

Accepted Answer

The connection will succeed because the OUTPUT chain accepts all.. The correct answer is B because the OUTPUT chain has a default policy of ACCEPT, meaning all outgoing packets, including SSH traffic (TCP port 22), are allowed by default. Since the user is initiating an SSH connection from the local machine, the packet traverses the OUTPUT chain, and with no explicit DROP or REJECT rule, it is permitted. The INPUT chain's default DROP policy only affects incoming packets, not outgoing connections.

Answer

The connection will succeed only if the remote host is on eth0.

Answer

The connection will fail because there is no rule accepting outgoing SSH.

Answer

The connection will fail because the INPUT chain drops all.

Question 13

You are a network administrator for a medium-sized company. The company has a Linux server acting as a router/firewall with three network interfaces: eth0 (public, 203.0.113.2/24, gateway 203.0.113.1), eth1 (DMZ, 10.0.1.1/24), and eth2 (internal, 192.168.1.1/24). The DMZ hosts a web server with IP 10.0.1.100, and the internal network has client machines. The firewall rules are currently set to default DROP on INPUT and FORWARD, ACCEPT on OUTPUT. The administrator wants to allow internal clients (192.168.1.0/24) to access the web server (10.0.1.100) on port 80. Additionally, the administrator wants to allow external users (from the internet) to access the web server's public IP (203.0.113.2) on port 80, which should be DNATed to 10.0.1.100. The administrator has enabled IP forwarding and added the following rules:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 10.0.1.100:80
iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p tcp --sport 80 -j ACCEPT

Internal clients cannot access the web server. External users are able to access the web server successfully. What is the most likely reason internal clients cannot access the web server?

Accepted Answer

The DNAT rule does not apply to traffic coming from the internal network because it is not received on eth0.. The DNAT rule is placed in the PREROUTING chain of the nat table, which only processes packets arriving on the specified interface (eth0). Internal clients (192.168.1.0/24) sending traffic to the web server (10.0.1.100) do not enter via eth0; they are routed through eth2. Therefore, the DNAT rule never matches their packets, and the destination remains 10.0.1.100, which is directly reachable without NAT. However, the FORWARD rules only allow traffic from eth0 to eth1 and back, so internal client traffic from eth2 to eth1 is implicitly dropped by the default FORWARD policy, causing the failure.

Answer

The web server cannot route back to the internal clients because it is in the DMZ.

Answer

The FORWARD rule for return traffic does not match because the destination is the client.

Answer

IP forwarding is not enabled for the internal interface.

Question 14

A network administrator notices that a Linux router with two network interfaces is not forwarding packets between them, despite having IP forwarding enabled in the kernel. The administrator has verified that the firewall rules are not blocking the traffic. What is the most likely cause of the issue?

Accepted Answer

The default gateway on the router is not set correctly.. Option B is correct because even with IP forwarding enabled, a Linux router must have a route in its routing table for the destination network to know which interface to forward packets out of. Without a correct default gateway or a specific route, the router will drop packets for unknown destinations, as it cannot determine the next hop. The administrator verified that firewall rules are not blocking traffic, so the issue is a missing or incorrect route.

Answer

The ARP cache on the router is stale.

Answer

The iptables FORWARD chain policy is set to DROP.

Answer

The routing table does not contain a route for the destination network.

Question 15

Which TWO of the following are valid methods to configure a Linux system to use a specific DNS server for name resolution?

Accepted Answer

Use NetworkManager to set DNS servers for a connection.. Option D is correct because NetworkManager provides a centralized way to manage network connections, including DNS settings. When you configure DNS servers via NetworkManager (e.g., using `nmcli` or the GUI), it writes the appropriate `nameserver` lines to `/etc/resolv.conf` (or manages it via its own internal resolver), ensuring the system uses those DNS servers for name resolution. Option E is correct because directly editing `/etc/resolv.conf` and adding a `nameserver` line is the traditional, low-level method to specify DNS servers, which the resolver library reads directly.

Answer

Add an entry to /etc/hosts with the DNS server's IP.

Answer

Write the DNS server IP to /etc/resolv.conf using systemd-resolved.

Answer

Set the 'hosts' line in /etc/nsswitch.conf to include 'dns'.