Knowledge + Practice

CCNA Essential System Services and Networking Questions

74 questions · Essential System Services and Networking · All types, answers revealed

Practice these questions Domain overview All questions

1

MCQmedium

A DHCP server assigns IP addresses to clients, but some clients are not receiving the correct gateway. Which configuration file should be checked on the DHCP server?

A./etc/dhcpd.conf

B./etc/dhcp/dhclient.conf

C./etc/dhcp/dhcpd.conf

D./etc/resolv.conf

AnswerC

Standard configuration file for DHCP server.

Why this answer

The DHCP server configuration file on Linux systems is typically located at /etc/dhcp/dhcpd.conf (or /etc/dhcpd.conf on some older distributions). This file contains the subnet declarations, option definitions (such as option routers for the default gateway), and other parameters that the DHCP server uses to assign IP addresses and configuration details to clients. If clients are not receiving the correct gateway, the 'option routers' directive within this file should be checked and corrected.

Exam trap

The trap here is that candidates often confuse the DHCP server configuration file path with the older /etc/dhcpd.conf (option A) or mistakenly think the client configuration file (option B) controls server-side gateway assignment, when in fact the server's gateway is set via 'option routers' in /etc/dhcp/dhcpd.conf.

How to eliminate wrong answers

Option A is wrong because /etc/dhcpd.conf is an older, deprecated path; modern distributions use /etc/dhcp/dhcpd.conf, and the question expects the current standard location. Option B is wrong because /etc/dhcp/dhclient.conf is the client-side configuration file for the DHCP client (dhclient), not the server; it controls how the client requests and applies DHCP options, not how the server assigns them. Option D is wrong because /etc/resolv.conf is the DNS resolver configuration file, which specifies nameservers and search domains for the local system; it has no role in DHCP server gateway assignment.

Practice this question →

2

MCQmedium

An administrator wants systemd-journald logs to persist across reboots. What must be created?

A.The directory /run/log/journal

B.The file /etc/journald.conf

C.The directory /var/log/journal

D.The directory /var/spool/journal

AnswerC

If this directory exists and has correct ownership, journald stores logs persistently.

Why this answer

By default, systemd-journald stores logs in a volatile tmpfs at /run/log/journal, which is cleared on reboot. To make logs persistent, the directory /var/log/journal must be created. When systemd-journald detects this directory exists, it automatically switches to persistent storage, writing logs to /var/log/journal and preserving them across reboots.

Exam trap

The trap here is that candidates often assume editing the configuration file /etc/journald.conf is sufficient, but without the actual directory /var/log/journal existing, systemd-journald will not switch to persistent storage unless Storage=persistent is explicitly set and the directory is created.

How to eliminate wrong answers

Option A is wrong because /run/log/journal is the default volatile location for systemd-journald logs; it is automatically created on tmpfs and does not persist across reboots. Option B is wrong because /etc/journald.conf is the configuration file for systemd-journald, but creating it alone does not enable persistence; the key setting is Storage=persistent in that file, but the directory /var/log/journal must also exist (or be created) for persistence to take effect. Option D is wrong because /var/spool/journal is not a standard path used by systemd-journald; the correct persistent directory is /var/log/journal as defined by the journald documentation and the systemd source code.

Practice this question →

3

MCQmedium

An Ubuntu 20.04 server needs a static IP address. The administrator has created a netplan YAML file at /etc/netplan/01-netcfg.yaml. What is the next step to apply the configuration?

A.netplan apply

B.ifconfig eth0 down; ifconfig eth0 up

C.service network-manager restart

D.systemctl restart networking

AnswerA

netplan apply parses YAML and configures network interfaces accordingly.

Why this answer

On Ubuntu 20.04, netplan is the default network configuration tool, and the correct command to apply changes from a YAML file in /etc/netplan/ is 'netplan apply'. This command parses the YAML, generates the appropriate backend configuration (systemd-networkd or NetworkManager), and applies it without requiring a reboot. It is the standard, supported method for activating static IP settings on modern Ubuntu systems.

Exam trap

The trap here is that candidates may confuse the legacy 'systemctl restart networking' or 'ifconfig' commands with the modern netplan workflow, assuming any service restart will apply the YAML configuration, but only 'netplan apply' correctly processes the netplan files and triggers the appropriate backend.

How to eliminate wrong answers

Option B is wrong because 'ifconfig eth0 down; ifconfig eth0 up' is a legacy method that does not read netplan YAML files; it only toggles the interface state and may not persist or apply the new static IP configuration. Option C is wrong because 'service network-manager restart' restarts the NetworkManager service, but on Ubuntu 20.04 with netplan, the default backend is systemd-networkd (unless explicitly configured otherwise), and this command may not correctly apply netplan settings or could interfere with the intended backend. Option D is wrong because 'systemctl restart networking' targets the old 'networking' service (used by ifupdown), which is not the active network stack on Ubuntu 20.04; netplan uses systemd-networkd or NetworkManager, so this command is irrelevant and will not apply the netplan configuration.

Practice this question →

4

MCQhard

A company manages a cluster of 50 web servers running Ubuntu 20.04. The servers are configured to synchronize time with an internal NTP server at 10.0.0.100 using the default ntpd. The NTP server itself syncs with external stratum 2 servers. Recently, the security team implemented a restrictive iptables firewall on all servers, allowing only essential services. Several servers in the 10.0.1.0/24 network now report time drift and ntpq -p shows all peers with '?' status. A network engineer runs tcpdump on one affected server and sees no NTP replies from 10.0.0.100. The NTP server's firewall is configured to allow inbound NTP from 10.0.0.0/24 only. The engineer also notes that the server's /etc/ntp.conf contains the line 'restrict 10.0.0.100' (which is incorrect) and that ntpq -crv shows 'sync target not reachable'. Which single action will most directly resolve the synchronization issue for the affected servers?

A.Add an iptables rule on the affected server to accept outbound UDP packets to 10.0.0.100 port 123.

B.Remove the line 'restrict 10.0.0.100' from /etc/ntp.conf.

C.Modify the NTP server's firewall to allow inbound NTP from 10.0.1.0/24.

D.Add a static route on the affected server for 10.0.0.100 via a different gateway.

AnswerC

Correct. The NTP server's firewall only permits inbound NTP from 10.0.0.0/24. Since the affected servers are in 10.0.1.0/24, adding a rule to allow their subnet directly resolves the issue.

Why this answer

The affected servers are in the 10.0.1.0/24 network, but the NTP server's firewall only allows inbound NTP from 10.0.0.0/24. Even if the client's firewall permits outbound UDP to port 123, the server will drop the requests because they originate from an unauthorized subnet. Therefore, modifying the NTP server's firewall to accept NTP traffic from 10.0.1.0/24 directly resolves the synchronization issue.

Option A (client firewall fix) is necessary but not sufficient because the server will still block the requests. Option B fixes the incorrect restrict line but does not address the firewall. Option D is irrelevant as routing is not the problem.

Exam trap

Candidates often focus on the client's firewall or the incorrect restrict line, but the most direct cause is the NTP server's firewall misconfiguration. Even if the client allows outbound traffic, the server drops requests from the wrong subnet.

How to eliminate wrong answers

Option A is wrong because the problem is not the client's outbound firewall; the client can send NTP requests, but the NTP server's firewall blocks replies to 10.0.1.0/24, so adding an outbound rule on the client does nothing. Option B is wrong because the 'restrict 10.0.0.100' line in /etc/ntp.conf is syntactically incorrect (it should be 'restrict 10.0.0.100 mask 255.255.255.255' or similar) but even if corrected, it controls access to the local NTP service, not the ability to receive replies from the server; the core issue is the server-side firewall. Option D is wrong because the affected server can already reach 10.0.0.100 (it sends requests), and adding a static route does not address the firewall blocking replies; the routing is fine.

Practice this question →

5

Multi-Selectmedium

On a modern Linux system using systemd-networkd for interface management and systemd-resolved for DNS, which THREE files are typically involved in network configuration and DNS resolution?

Select 3 answers

A./etc/systemd/network/10-static.network

B./etc/network/interfaces

C./etc/resolv.conf

D./etc/hosts

E./etc/sysconfig/network-scripts/ifcfg-eth0

AnswersA, C, D

systemd-networkd uses .network files in this directory.

Why this answer

On a modern Linux system using systemd-networkd, network interface configuration is defined in .network files within /etc/systemd/network/, such as 10-static.network (Option A). systemd-resolved manages DNS resolution and typically writes to /etc/resolv.conf (Option C) as a symlink to its own stub resolver. /etc/hosts (Option D) is a static host-to-IP mapping file that is consulted by the system's resolver before DNS queries, making it a standard part of DNS resolution. Together, these three files are directly involved in network configuration and DNS resolution under systemd.

Exam trap

The trap here is that candidates often assume /etc/network/interfaces or ifcfg-eth0 are still relevant on modern systemd-based distributions, but systemd-networkd uses its own .network files, and the question explicitly specifies systemd-networkd and systemd-resolved.

Practice this question →

6

MCQeasy

Refer to the exhibit. The administrator wants to ensure that SSH service starts automatically after a system reboot. Based on the output, what is the current status of this setting?

A.The service is enabled and will start at boot.

B.The service is disabled and will not start at boot.

C.The service is static and cannot be enabled.

D.The service is not running.

AnswerA

'enabled' indicates it will start at boot.

Why this answer

The `systemctl is-enabled sshd` command returns 'enabled', which means the SSH service is configured to start automatically at boot. This is confirmed by the output in the exhibit, showing that the service is enabled and will start during system initialization.

Exam trap

The trap here is that candidates may confuse the 'enabled' status with the 'active' (running) status, or misinterpret 'static' as a valid state for this service, when the output clearly shows 'enabled'.

How to eliminate wrong answers

Option B is wrong because the output explicitly shows 'enabled', not 'disabled', so the service will start at boot. Option C is wrong because 'static' is a possible systemd unit state that means the unit cannot be manually enabled or disabled but can be started by other units; however, the output shows 'enabled', not 'static'. Option D is wrong because the question asks about the status of automatic start at boot, not whether the service is currently running; the `is-enabled` command does not indicate the current runtime state.

Practice this question →

7

Multi-Selecteasy

Which TWO commands can be used to display the current routing table on a Linux system?

Select 2 answers

A.ss -r

B.route -n

C.iptables -L

D.ifconfig -r

E.ip route show

AnswersB, E

Correct: route -n displays the routing table in numeric format.

Why this answer

The `route -n` command displays the kernel IP routing table, showing destination networks, gateways, and interfaces. The `-n` flag ensures numeric output (no hostname resolution), which is useful for troubleshooting. The `ip route show` command is part of the modern `iproute2` suite and also displays the routing table, providing more detailed and flexible output than the legacy `route` command.

Exam trap

The trap here is that candidates may confuse `ss -r` with `ss -t` or `ss -u` (which show TCP/UDP sockets) or think `iptables -L` shows routing rules, but `iptables` only manages packet filtering and NAT rules, not the routing table.

Practice this question →

8

MCQeasy

A developer asks the system administrator to configure a local web server for testing using Apache. The server should serve files from /var/www/test. Which directive must be set in the Apache configuration to set this document root?

A.Alias /test /var/www/test

B.ServerRoot /var/www/test

C.DocumentRoot /var/www/test

D.DirectoryIndex /var/www/test

AnswerC

DocumentRoot defines the root directory for HTTP requests.

Why this answer

The DocumentRoot directive in Apache defines the top-level directory from which it serves files for a given virtual host or the main server. Setting DocumentRoot /var/www/test tells Apache to map incoming HTTP requests to files under that directory, making it the correct choice for serving files from /var/www/test.

Exam trap

The trap here is that candidates confuse DocumentRoot with ServerRoot or Alias, often thinking ServerRoot defines where web files are served from, when in fact it points to Apache's own installation directory.

How to eliminate wrong answers

Option A is wrong because Alias maps a URL path to a filesystem directory but does not set the primary document root; it is used for additional URL-to-directory mappings. Option B is wrong because ServerRoot specifies the directory where Apache's configuration, logs, and modules reside, not the directory for serving web content. Option D is wrong because DirectoryIndex defines the default file (e.g., index.html) to serve when a directory is requested, not the document root path.

Practice this question →

9

MCQhard

A company runs a web server using Apache with multiple virtual hosts. The administrator needs to restrict access to a specific virtual host based on the client IP address. Which configuration directive should be placed inside the <VirtualHost> block to deny IP 192.168.1.100?

A.Require host 192.168.1.100

B.Require not ip 192.168.1.100

C.Deny from 192.168.1.100

D.Require valid-user

AnswerB

New syntax: Require not ip denies the specific IP.

Why this answer

In Apache 2.4 and later, access control is managed using the `Require` directive with the `not` modifier to deny specific IP addresses. Placing `Require not ip 192.168.1.100` inside the `<VirtualHost>` block will deny access to that IP while allowing all others, as the default behavior is to require all IPs unless a `Require` directive explicitly grants access.

Exam trap

The trap here is that candidates familiar with Apache 2.2 may choose `Deny from` (Option C), not realizing that LPIC-1 exams focus on Apache 2.4 syntax where `Require` directives are the standard, and legacy directives are deprecated.

How to eliminate wrong answers

Option A is wrong because `Require host` is used to allow or deny based on hostnames (e.g., domain names), not IP addresses; it would attempt a reverse DNS lookup on the client IP, which is not the correct method for IP-based restrictions. Option C is wrong because `Deny from` is a legacy Apache 2.2 directive that is deprecated in Apache 2.4 and may not work unless the `mod_access_compat` module is loaded; it is not the modern recommended approach. Option D is wrong because `Require valid-user` is used for authentication-based access control (requiring a valid user/password), not for IP-based restrictions.

Practice this question →

10

MCQmedium

Refer to the exhibit. The system has two network interfaces: eth0 and eth1. Which interface will be used to reach a host at IP address 10.10.10.10?

A.eth1 via gateway 10.0.0.1.

B.eth0 via gateway 192.168.1.1.

C.eth0 via the default gateway.

D.eth0 directly.

AnswerA

10.10.10.10 falls within 10.0.0.0/8.

Why this answer

The routing table determines that the destination IP 10.10.10.10 is not within any directly connected subnet (eth0: 192.168.1.0/24, eth1: 10.0.0.0/24). The most specific matching route is the static route to 10.0.0.0/8 via gateway 10.0.0.1 on eth1, which covers the 10.10.10.10 address. Therefore, eth1 is used to reach the host.

Exam trap

The trap here is that candidates often assume the default gateway is always used for non-local traffic, forgetting that a more specific static route (like 10.0.0.0/8) takes precedence over the default route.

How to eliminate wrong answers

Option B is wrong because the route via gateway 192.168.1.1 on eth0 is for the 192.168.1.0/24 subnet, which does not include 10.10.10.10. Option C is wrong because the default gateway (0.0.0.0/0) is only used when no more specific route matches; here, the 10.0.0.0/8 route is more specific and takes precedence. Option D is wrong because 10.10.10.10 is not on the directly connected subnet of eth0 (192.168.1.0/24), so it cannot be reached directly without a gateway.

Practice this question →

11

MCQmedium

Based on the exhibit, what is the most likely cause of the SSH service failure?

A.The sshd service is disabled.

B.The firewall is blocking port 22.

C.Another service is already listening on port 22.

D.The SSH configuration file has a syntax error.

AnswerC

Address already in use error.

Why this answer

The exhibit shows that the sshd service failed to start because the address (0.0.0.0:22) is already in use. This indicates that another process is already bound to port 22, preventing sshd from binding to it. Therefore, the most likely cause is that another service is already listening on port 22.

Exam trap

The trap here is that candidates often assume SSH failures are always due to firewall rules or disabled services, but the specific error message 'address already in use' directly points to a port conflict, not a firewall or configuration syntax issue.

How to eliminate wrong answers

Option A is wrong because if the sshd service were disabled, the system would not attempt to start it at all, and the error message would not indicate a port conflict. Option B is wrong because a firewall blocking port 22 would not cause sshd to fail to start; the service would still bind to the port, but connections would be dropped by the firewall. Option D is wrong because a syntax error in the SSH configuration file would produce a different error message (e.g., 'sshd: fatal: bad configuration options'), not an 'address already in use' error.

Practice this question →

12

Multi-Selecthard

Which THREE of the following are true regarding the use of systemd-networkd for network configuration? (Choose three.)

Select 3 answers

A.It can assign static IP addresses using .network files.

B.It can be used to configure network bridges.

C.It supports DHCP for dynamic IP assignment.

D.Configuration files are stored in /etc/network/.

E.It supports bonding of multiple interfaces.

AnswersA, B, C

Static IP via .network files.

Why this answer

Systemd-networkd uses .network files (e.g., /etc/systemd/network/10-static.network) to assign static IP addresses via the [Address] section. This allows precise control over IPv4/IPv6 addresses, subnet masks, and gateways without relying on DHCP.

Exam trap

The trap here is that candidates confuse the configuration directory /etc/systemd/network/ with the legacy /etc/network/ used by ifupdown, or assume systemd-networkd supports bonding natively when it actually requires additional kernel modules or external tools.

Practice this question →

13

MCQmedium

Refer to the exhibit. An administrator runs ss -tuln and gets the output above. Which of the following statements about this server is true?

A.The server only runs SSH and DNS.

B.The server runs SSH and NTP only.

C.The server only runs SSH and HTTP.

D.The server runs SSH, HTTP, HTTPS, NTP, and mDNS.

AnswerD

Ports 22, 80, 443, 123, and 5353 correspond to these services.

Why this answer

The `ss -tuln` command displays listening TCP and UDP sockets with numeric addresses and ports. The output shows ports 22 (SSH), 80 (HTTP), 443 (HTTPS), 123 (NTP), and 5353 (mDNS). Therefore, the server is listening for SSH, HTTP, HTTPS, NTP, and mDNS services.

Option D correctly lists all these services.

Exam trap

The trap here is that candidates may overlook the UDP listening sockets (especially port 5353 for mDNS) or misidentify port 123 (NTP) as something else, leading them to select an incomplete list of services.

How to eliminate wrong answers

Option A is wrong because it omits HTTP, HTTPS, NTP, and mDNS, and incorrectly states the server only runs SSH and DNS. Option B is wrong because it omits DNS, HTTP, HTTPS, and mDNS, and incorrectly states the server only runs SSH and NTP. Option C is wrong because it omits DNS, HTTPS, NTP, and mDNS, and incorrectly states the server only runs SSH and HTTP.

Practice this question →

14

MCQmedium

After a reboot, a server fails to obtain an IP address on its sole ethernet interface. The administrator checks /etc/netplan/01-netcfg.yaml and finds the configuration looks correct. However, the interface shows no IP. The system uses systemd-networkd. Which command should be run next to apply the configuration and bring up the interface?

A.netplan apply

B.ifup eth0

C.systemctl restart networking

D.systemctl restart systemd-networkd

AnswerA

netplan apply ensures the YAML config is parsed and applied to systemd-networkd.

Why this answer

The correct command is 'netplan apply' because the system uses netplan to manage network configuration, which generates backend configuration files for systemd-networkd. After editing the YAML file, 'netplan apply' parses the configuration, applies it to the running system, and triggers systemd-networkd to reconfigure the interface without requiring a full restart of the service.

Exam trap

The trap here is that candidates assume 'systemctl restart systemd-networkd' is sufficient, but without running 'netplan apply' first, the backend configuration files are not regenerated from the YAML, so the interface remains unconfigured.

How to eliminate wrong answers

Option B is wrong because 'ifup eth0' is a legacy tool from the ifupdown suite (used with /etc/network/interfaces) and does not interact with netplan or systemd-networkd; it would fail or be ignored on a system using netplan. Option C is wrong because 'systemctl restart networking' targets the legacy 'networking' service (ifupdown), which is not used when systemd-networkd is the backend; it may not be installed or enabled, and restarting it would not apply netplan YAML changes. Option D is wrong because 'systemctl restart systemd-networkd' would restart the service but would not cause netplan to regenerate the backend configuration files; the interface would still use the old or no configuration unless 'netplan apply' is run first to write the new .network files.

Practice this question →

15

Multi-Selecthard

An administrator needs to monitor real-time network bandwidth usage on a Linux server. Which two tools are specifically designed for this purpose? (Choose two.)

Select 2 answers

A.netstat

B.nload

C.traceroute

D.ping

E.iftop

AnswersB, E

Displays incoming and outgoing traffic graphs.

Why this answer

B (nload) is correct because it is a command-line tool that displays real-time network traffic and bandwidth usage on a per-interface basis, showing incoming and outgoing data rates with a dynamic graph. E (iftop) is correct because it listens to network traffic on a specified interface and displays a real-time table of bandwidth usage per connection, similar to top for processes. Both tools are specifically designed for monitoring live bandwidth consumption, unlike general networking utilities.

Exam trap

The trap here is that candidates often confuse netstat's interface statistics (e.g., -i option) with real-time monitoring, but netstat only provides cumulative byte/packet counts since boot, not live bandwidth rates, making it unsuitable for real-time bandwidth monitoring.

Practice this question →

16

MCQeasy

On a Debian-based system using ifupdown, which file should be edited to configure a static IP address for an interface?

A./etc/systemd/network/50-static.network

B./etc/network/interfaces

C./etc/netplan/01-netcfg.yaml

D./etc/sysconfig/network-scripts/ifcfg-eth0

AnswerB

This is the main configuration file for ifupdown on Debian.

Why this answer

On Debian-based systems using the traditional ifupdown suite, the file `/etc/network/interfaces` is the central configuration file for defining network interfaces, including static IP addresses. This file is parsed by the `ifup` and `ifdown` commands to bring interfaces up or down with the specified settings, such as `address`, `netmask`, and `gateway`.

Exam trap

The trap here is that candidates often confuse the default network configuration file for Debian-based systems with those used by other distributions (Red Hat) or newer abstraction layers (Netplan, systemd-networkd), leading them to pick a file that is technically valid but not used by the ifupdown tool specified in the question.

How to eliminate wrong answers

Option A is wrong because `/etc/systemd/network/50-static.network` is used by `systemd-networkd`, not by the ifupdown suite; Debian systems using ifupdown do not rely on systemd-networkd for interface configuration. Option C is wrong because `/etc/netplan/01-netcfg.yaml` is the configuration file for Netplan, which is used on Ubuntu (and some other distributions) as a frontend for systemd-networkd or NetworkManager, not for the traditional ifupdown system. Option D is wrong because `/etc/sysconfig/network-scripts/ifcfg-eth0` is the configuration file format used by Red Hat-based distributions (e.g., CentOS, Fedora) with the legacy network service, not by Debian-based systems.

Practice this question →

17

MCQeasy

A system administrator notices that the system time is incorrect by several minutes. Which command should be used first to check the status of NTP synchronization?

A.timedatectl

B.ntpdate

C.date

D.hwclock

AnswerA

timedatectl displays NTP synchronization status and allows detailed checks.

Why this answer

The `timedatectl` command is the correct first step because it shows the current system time, time zone, and NTP synchronization status in a single output. It directly reports whether NTP is active and whether the clock is synchronized, making it the standard diagnostic tool on modern systemd-based Linux distributions.

Exam trap

The trap here is that candidates often confuse `ntpdate` as a diagnostic tool because it can query an NTP server, but it is not designed to show the ongoing synchronization status of the system's NTP service.

How to eliminate wrong answers

Option B is wrong because `ntpdate` is a legacy command used for one-time manual time setting, not for checking synchronization status; it also requires stopping the NTP service first. Option C is wrong because `date` only displays or sets the system time without any NTP status information. Option D is wrong because `hwclock` manages the hardware clock (RTC) and does not show NTP synchronization status.

Practice this question →

18

MCQeasy

An administrator notices that SSH connections to a remote Linux server are timing out. After confirming network connectivity, which command should the administrator run on the server to check whether the SSH daemon is actively listening?

A.ls /etc/ssh/

B.systemctl status sshd

C.nc -zv localhost 22

D.netstat -tuln

AnswerB

This command shows the current status of the sshd service, including whether it is running.

Why this answer

The `systemctl status sshd` command checks the status of the SSH daemon service managed by systemd, directly reporting whether it is active (running) or inactive (stopped). This is the most straightforward way to verify that the SSH daemon is actively listening, as it queries the service manager rather than relying on network-level probing.

Exam trap

The trap here is that candidates often choose `netstat -tuln` (option D) because it shows listening ports, but they overlook that it does not confirm the specific daemon (sshd) is responsible, and the command may be deprecated or unavailable on systems using `ss` instead.

How to eliminate wrong answers

Option A is wrong because `ls /etc/ssh/` lists configuration files (e.g., sshd_config) but does not indicate whether the SSH daemon process is running or listening. Option C is wrong because `nc -zv localhost 22` tests connectivity to port 22 on the loopback interface, which could succeed even if the SSH daemon is not bound to all interfaces or if a firewall is misconfigured; it also requires netcat to be installed. Option D is wrong because `netstat -tuln` shows listening sockets but does not specifically identify the SSH daemon—it could show a different process listening on port 22, and the command may not be installed by default on modern systems (replaced by `ss`).

Practice this question →

19

Multi-Selectmedium

Which TWO of the following are valid methods to configure network interfaces on a Linux system? (Choose two.)

Select 2 answers

A.Editing /etc/network/interfaces file.

B.Using the 'ifconfig' command.

C.Using the 'ip' command.

D.Using the 'route' command.

E.Editing /etc/sysconfig/network-scripts/ network configuration files.

AnswersA, C

Used by Debian-based systems.

Why this answer

The `/etc/network/interfaces` file is the primary configuration file for network interfaces on Debian-based Linux distributions (e.g., Ubuntu). It allows static or dynamic (DHCP) configuration of interfaces using directives like `iface`, `address`, and `netmask`, and is read by the `ifup` and `ifdown` commands at boot or on demand.

Exam trap

The trap here is that candidates often confuse temporary runtime commands (like `ifconfig` and `route`) with persistent configuration methods, or they assume a distribution-specific path like `/etc/sysconfig/network-scripts/` is universally valid across all Linux systems.

Practice this question →

20

Multi-Selecthard

Which THREE steps are required to configure a static IP address on a modern Linux system using systemd-networkd?

Select 3 answers

A.Edit /etc/hosts to map IP to hostname

B.Create a .network file in /etc/systemd/network/

C.Edit /etc/resolv.conf to set DNS servers

D.Run 'ip addr add <IP> dev eth0'

E.Run 'systemctl restart systemd-networkd'

AnswersB, C, E

Required for static configuration.

Why this answer

Systemd-networkd uses .network files in /etc/systemd/network/ to define static IP configurations. These files contain sections like [Match] and [Network] to specify the interface and address details, replacing traditional ifcfg scripts or manual ip commands.

Exam trap

The trap here is that candidates confuse temporary commands like 'ip addr add' with persistent configuration, or assume editing /etc/hosts is part of IP assignment, when systemd-networkd requires dedicated .network files and a service restart to apply static IPs permanently.

Practice this question →

21

Multi-Selecteasy

Which three files are essential for network configuration and name resolution on a typical Linux system? (Choose three.)

Select 3 answers

A./etc/network/interfaces

B./etc/hosts

C./etc/sysctl.conf

D./etc/nsswitch.conf

E./etc/resolv.conf

AnswersB, D, E

Maps hostnames to IP addresses locally.

Why this answer

The `/etc/hosts` file provides static hostname-to-IP address mapping, allowing name resolution before DNS is queried. It is essential for local network configuration and fallback resolution, as defined by RFC 952 and the glibc Name Service Switch (NSS) framework.

Exam trap

The trap here is that candidates often confuse distribution-specific network configuration files (like `/etc/network/interfaces`) with essential system-wide name resolution files, leading them to select options that are not universally required across all Linux distributions.

Practice this question →

22

Multi-Selecthard

Which TWO commands can be used to display the current firewall rules in a system using nftables? (Choose two.)

Select 2 answers

A.systemctl status nftables

B.iptables -L -n

C.nft list ruleset

D.nft list table inet filter

E.firewall-cmd --list-all

AnswersC, D

Lists entire nftables ruleset.

Why this answer

`nft list ruleset` is the primary command in nftables to display the entire ruleset, including all tables, chains, and rules, regardless of the address family. Option D is also correct because `nft list table inet filter` specifically displays the rules within the 'filter' table of the 'inet' family, which is a valid way to show a subset of the firewall rules. Both commands rely on the nftables framework, which is the modern replacement for iptables on Linux.

Exam trap

The trap here is that candidates may confuse the legacy iptables command (`iptables -L -n`) with nftables, or assume that `systemctl status nftables` shows rules, when in fact it only shows the service's runtime state.

Practice this question →

23

MCQmedium

A web server running Apache on Linux is experiencing slow response times. The administrator runs 'netstat -tuln' and sees many connections in TIME_WAIT state. Which of the following is the best course of action to improve performance?

A.Increase the KeepAliveTimeout directive.

B.Disable the KeepAlive directive.

C.Enable TCP keepalive and adjust kernel parameters for faster reuse.

D.Increase the MaxKeepAliveRequests directive.

AnswerC

Adjusting tcp_tw_reuse and tcp_tw_recycle can reduce TIME_WAIT.

Why this answer

TIME_WAIT connections indicate that the server is waiting for lingering packets before fully closing TCP sockets. Enabling TCP keepalive and adjusting kernel parameters like net.ipv4.tcp_tw_reuse (or net.ipv4.tcp_tw_recycle in older kernels) allows the kernel to reuse sockets in TIME_WAIT state for new connections, reducing resource exhaustion and improving performance under high connection rates.

Exam trap

The trap here is that candidates confuse Apache's KeepAlive directives (HTTP-level persistent connections) with TCP-level keepalive and TIME_WAIT management, leading them to incorrectly choose options that adjust HTTP keep-alive settings instead of addressing the TCP socket state.

How to eliminate wrong answers

Option A is wrong because increasing KeepAliveTimeout (which controls how long Apache waits for the next request on a persistent connection) does not affect the TIME_WAIT state of TCP sockets; it only extends idle keep-alive duration, potentially worsening resource usage. Option B is wrong because disabling KeepAlive forces a new TCP connection for every HTTP request, which increases the number of TIME_WAIT sockets and degrades performance further. Option D is wrong because MaxKeepAliveRequests limits the number of requests per persistent connection, but does not address the underlying TCP TIME_WAIT issue; it may even increase connection churn if set too low.

Practice this question →

24

MCQmedium

Refer to the exhibit. The administrator is unable to SSH into the server (TCP port 22) from a remote host. The iptables rules are as shown. What is the most likely cause?

A.The default policy is ACCEPT, so SSH should be accepted.

B.The second rule drops all incoming traffic, including SSH.

C.The SSH service is not running.

D.The first rule only allows loopback, not SSH.

AnswerB

The DROP rule matches all traffic not yet matched.

Why this answer

The second rule in the iptables ruleset explicitly drops all incoming traffic with `iptables -A INPUT -j DROP`. Since SSH traffic on TCP port 22 is incoming from a remote host, it matches this rule before any later rule could accept it. The default policy being ACCEPT does not override explicit DROP rules; iptables processes rules sequentially, and the DROP rule terminates the packet's traversal, preventing SSH access.

Exam trap

The trap here is that candidates assume a default policy of ACCEPT overrides explicit DROP rules, but iptables processes rules sequentially and a matching DROP rule terminates processing, making the default policy irrelevant for packets that match it.

How to eliminate wrong answers

Option A is wrong because the default policy of ACCEPT only applies if no explicit rule matches the packet; here, the second rule explicitly drops all incoming traffic, so the default policy is never reached. Option C is wrong because the question focuses on iptables rules blocking SSH, not the SSH service status; even if SSH is running, the DROP rule prevents the connection. Option D is wrong because the first rule allows loopback traffic (interface lo), which is irrelevant to SSH from a remote host; SSH traffic arrives on a physical network interface, not loopback, so it is not affected by that rule.

Practice this question →

25

Multi-Selecteasy

Which TWO tools can be used to query DNS records? (Choose two.)

Select 2 answers

A.nslookup

B.ss

C.dig

D.ping

E.traceroute

AnswersA, C

Name server lookup, queries DNS.

Why this answer

A is correct because nslookup is a classic DNS query tool that sends DNS queries to name servers to resolve domain names to IP addresses or vice versa. It directly queries DNS records (A, AAAA, MX, CNAME, etc.) using the DNS protocol (UDP/TCP port 53).

Exam trap

The trap here is that candidates may confuse network diagnostic tools (ping, traceroute, ss) with DNS-specific utilities, assuming any tool that tests connectivity can also query DNS records.

Practice this question →

26

Multi-Selectmedium

Which two commands can be used to send a test email from the command line to verify SMTP functionality? (Choose two.)

Select 2 answers

A.telnet localhost 25

B.mutt -s test user@example.com

C.mail -s test user@example.com

D.echo 'test' | sendmail user@example.com

E.sendmail -bv user@example.com

AnswersC, D

The mail command reads input and sends an email.

Why this answer

The `mail` command (option C) sends an email via the local MTA, directly testing SMTP delivery. The `sendmail` command (option D) with a piped message also invokes the MTA to deliver the email, verifying SMTP functionality. Both commands rely on the system's configured MTA to handle SMTP communication.

Exam trap

The trap here is that candidates confuse `sendmail -bv` (which only verifies addresses) with `sendmail` used to actually send a message, or they think `telnet` alone constitutes sending an email without manual SMTP commands.

Practice this question →

27

MCQhard

A Linux system's hostname resolution does not consult /etc/hosts before querying DNS. Which file controls the order of name resolution services?

A./etc/nsswitch.conf

B./etc/host.conf

C./etc/resolv.conf

D./etc/dnsmasq.conf

AnswerA

This file controls the order of sources for name resolution, such as files (hosts) and DNS.

Why this answer

The /etc/nsswitch.conf file controls the order of name resolution services by defining the 'hosts' database entry, which specifies the sources (e.g., files, dns) and their lookup order. If the entry is 'hosts: dns files', the system queries DNS before /etc/hosts, bypassing the local file. This file is part of the GNU C Library's Name Service Switch (NSS) framework, which governs all system databases like passwd, group, and hosts.

Exam trap

The trap here is that candidates confuse /etc/nsswitch.conf with /etc/resolv.conf or /etc/host.conf, assuming DNS order is controlled by resolver configuration files rather than the NSS database order.

How to eliminate wrong answers

Option B is wrong because /etc/host.conf is a legacy configuration file used by the old glibc resolver (pre-NSS) to control resolver behavior, such as order (bind, hosts), but it is deprecated and not the primary mechanism on modern Linux systems. Option C is wrong because /etc/resolv.conf only specifies DNS resolver parameters (nameservers, search domains, options) and does not control the order of name resolution services or whether /etc/hosts is consulted. Option D is wrong because /etc/dnsmasq.conf is the configuration file for the dnsmasq DNS forwarder and DHCP server, which is a separate service and does not control the system-wide name resolution order used by the resolver library.

Practice this question →

28

MCQhard

A company's server administrator needs to replace an existing DNS server (192.168.1.10) with a new one (192.168.1.20). Which file must be updated on all DHCP clients to ensure they use the new DNS server?

A./etc/dhcp/dhcpd.conf

B./etc/resolv.conf

C./etc/nsswitch.conf

D./etc/hosts

AnswerA

DHCP server config; update DNS options and restart DHCP.

Why this answer

The DHCP server configuration file /etc/dhcp/dhcpd.conf contains the 'option domain-name-servers' directive that specifies which DNS servers are handed out to DHCP clients. When a client renews its lease, it receives the new DNS server IP (192.168.1.20) from the DHCP server, updating the client's /etc/resolv.conf automatically. This is the proper way to centrally manage DNS server assignments across all DHCP clients.

Exam trap

The trap here is that candidates confuse the client-side file /etc/resolv.conf with the server-side configuration that actually controls what DNS servers are distributed, leading them to think editing resolv.conf directly is the correct approach.

How to eliminate wrong answers

Option B is wrong because /etc/resolv.conf is the client-side file that lists DNS servers for local resolution, but it is typically overwritten by the DHCP client (e.g., dhclient) with values received from the DHCP server; manually editing it on each client is not a scalable solution for replacing a DNS server. Option C is wrong because /etc/nsswitch.conf controls the order of name resolution sources (e.g., files, dns, mdns) but does not specify DNS server IP addresses. Option D is wrong because /etc/hosts provides static IP-to-hostname mappings and has no role in assigning DNS server addresses to clients.

Practice this question →

29

MCQhard

An administrator reviews the above DHCP server logs. Based on the output, which statement is correct about the DHCP transaction?

A.The client sent a DHCPINFORM to renew its existing lease.

B.The DHCP server is configured to assign IP addresses from a pool that includes 192.168.1.100.

C.The client successfully obtained the IP address 192.168.1.100.

D.The DHCP server rejected the client's request because the DHCPREQUEST was not broadcast.

AnswerC

DHCPACK confirms the lease assignment.

Why this answer

The DHCP server logs show a successful four-way handshake: DHCPDISCOVER, DHCPOFFER, DHCPREQUEST, and DHCPACK. The final DHCPACK from the server confirms that the client has been granted the IP address 192.168.1.100, making option C correct.

Exam trap

The trap here is that candidates may confuse the DHCPREQUEST broadcast requirement with a rejection, or incorrectly assume that a DHCPINFORM is used for lease renewal, when in fact DHCPINFORM is only for stateless configuration requests.

How to eliminate wrong answers

Option A is wrong because a DHCPINFORM is used by a client that already has an IP address to request additional configuration parameters (like DNS servers), not to renew a lease; lease renewal uses DHCPREQUEST (unicast). Option B is wrong because the logs only show that 192.168.1.100 was offered and acknowledged; they do not indicate whether this address comes from a pool that includes 192.168.1.100 — the server could be configured with a static reservation or a different pool. Option D is wrong because the DHCPREQUEST in a typical renewal or selection phase is sent as a broadcast (with the 'broadcast' flag set) to ensure all DHCP servers on the subnet receive it; the server did not reject the request, as evidenced by the DHCPACK.

Practice this question →

30

MCQeasy

Refer to the exhibit. A system administrator runs 'ip route show default' and gets this output. What does it indicate?

A.The DNS server is 192.168.1.1.

B.The default route points to gateway 192.168.1.1 on interface eth0.

C.The system has no internet access.

D.The IP address of the system is 192.168.1.1.

AnswerB

That is exactly what the output means.

Why this answer

The command 'ip route show default' displays the default route entry in the kernel routing table. The output shows that the default route (destination 0.0.0.0/0) is via gateway 192.168.1.1 and uses interface eth0, meaning all traffic not matching a more specific route is sent to that gateway on that interface.

Exam trap

The trap here is confusing the default gateway with other network parameters like DNS server or the system's own IP address, leading candidates to incorrectly associate the gateway IP with those unrelated services.

How to eliminate wrong answers

Option A is wrong because the default route specifies a gateway for network traffic, not a DNS server; DNS server configuration is handled in /etc/resolv.conf or via systemd-resolved, not in the routing table. Option C is wrong because having a default route to 192.168.1.1 indicates the system has a path to reach external networks, provided the gateway is operational and the system has proper connectivity. Option D is wrong because the IP address of the system is not shown in the default route output; the system's IP address is typically found using 'ip addr show' or 'ifconfig', and 192.168.1.1 is the gateway address, not the system's own address.

Practice this question →

31

MCQhard

A mail server using Postfix is rejecting emails from a partner domain. The administrator checks the maillog and sees 'relay access denied'. Which Postfix configuration parameter is most likely misconfigured?

A.mydestination

B.inet_interfaces

C.relayhost

D.mynetworks

AnswerD

mynetworks specifies IP ranges allowed to relay.

Why this answer

(mynetworks) is correct because it defines which client IP addresses are allowed to relay mail through the server. The 'relay access denied' error indicates that the partner domain's mail server is not in the trusted network list. Option A (mydestination) specifies local destination domains, not relay permissions.

Option B (inet_interfaces) controls listening interfaces. Option C (relayhost) sets the next-hop relay for outbound mail. Therefore, mynetworks is the likely misconfiguration.

Practice this question →

32

Multi-Selectmedium

Which THREE steps are required to configure a network interface with a static IP address using the ip command (assuming interface eth0)? (Choose three.)

Select 3 answers

A.ifconfig eth0 192.168.1.10 netmask 255.255.255.0

B.ip route add default via 192.168.1.1

C.ip addr add 192.168.1.10/24 dev eth0

D.ip link set eth0 up

E.echo 'nameserver 8.8.8.8' > /etc/resolv.conf

AnswersB, C, D

Adds default gateway.

Why this answer

The `ip route add default via 192.168.1.1` command sets the default gateway for the system, which is essential for routing traffic to networks beyond the local subnet. Without a default route, the static IP configuration would only allow communication within the local network (192.168.1.0/24), making this step mandatory for full network connectivity.

Exam trap

The trap here is that candidates often confuse the `ip` command with legacy tools like `ifconfig` (option A) or include DNS configuration (option E) as part of the `ip` command workflow, when in fact DNS is handled by separate system services and not by the `ip` command.

Practice this question →

33

MCQhard

A server runs systemd-resolved and uses a VPN. DNS queries fail intermittently. The administrator checks /etc/resolv.conf and finds it is a symlink to /run/systemd/resolve/stub-resolv.conf. Which command should be used to view the effective DNS servers and debug the issue?

A.cat /etc/resolv.conf

B.resolvectl status

C.systemctl restart systemd-resolved

D.dig @localhost

AnswerB

resolvectl status shows per-link DNS servers and overall resolver configuration.

Why this answer

B is correct because `resolvectl status` is the native command for querying systemd-resolved's internal state, showing the per-link DNS servers, search domains, and current resolver configuration. Since `/etc/resolv.conf` is a symlink to the stub resolver, `cat /etc/resolv.conf` only shows the stub listener address (127.0.0.53), not the actual upstream DNS servers used by systemd-resolved. `resolvectl status` reveals the effective DNS servers for each network interface, including VPN interfaces, which is essential for debugging intermittent failures.

Exam trap

The trap here is that candidates assume `cat /etc/resolv.conf` shows the real DNS servers, but because it is a symlink to the stub resolver's configuration, it only shows 127.0.0.53, masking the actual upstream servers that systemd-resolved uses.

How to eliminate wrong answers

Option A is wrong because `cat /etc/resolv.conf` only displays the stub resolver's loopback address (127.0.0.53), not the actual upstream DNS servers that systemd-resolved queries; this gives no insight into which DNS servers are failing. Option C is wrong because `systemctl restart systemd-resolved` is a brute-force action that disrupts all active DNS resolution and does not provide diagnostic information about current DNS servers or intermittent failures. Option D is wrong because `dig @localhost` sends queries to the stub resolver on 127.0.0.53, which may succeed even when upstream queries fail, and it does not reveal which upstream servers are configured or their status.

Practice this question →

34

MCQmedium

A system administrator notices that the system clock is consistently 5 minutes ahead of the actual time. The NTP service is enabled and running. Which command should the administrator run to force an immediate time synchronization?

A.ntpq -p

B.ntpdate pool.ntp.org

C.systemctl restart ntpd

D.timedatectl set-time ...

AnswerB

ntpdate performs immediate synchronization.

Why this answer

`ntpdate` is a legacy command that forces an immediate, one-time synchronization of the system clock with an NTP server (e.g., pool.ntp.org). Even though NTP is running, it may take several polling intervals (typically 64–1024 seconds) to correct a large offset; `ntpdate` bypasses this gradual adjustment and sets the clock instantly.

Exam trap

The trap here is that candidates assume restarting the NTP service (Option C) will immediately correct the time, but in reality, ntpd only adjusts gradually over several poll intervals unless the offset exceeds a panic threshold (default 1000 seconds) or the `-g` flag is used.

How to eliminate wrong answers

Option A is wrong because `ntpq -p` only queries and displays the current NTP peer status (e.g., reachability, delay, offset) — it does not perform any synchronization. Option C is wrong because `systemctl restart ntpd` restarts the NTP daemon but does not force an immediate sync; the daemon will still follow its normal polling cycle and gradual slew algorithm. Option D is wrong because `timedatectl set-time ...` manually sets the time without consulting an NTP server, which would conflict with the running NTP service and likely be overridden at the next NTP update.

Practice this question →

35

MCQhard

After running 'ip route show default', a system administrator sees no output. Users on that system can only communicate with hosts on the local subnet. What is the most likely cause?

A.DNS is misconfigured

B.A firewall is blocking all traffic

C.The network interface is down

D.The default gateway is missing

AnswerD

Without a default route, traffic cannot reach external networks.

Why this answer

The `ip route show default` command displays the default gateway entry in the routing table. An empty output indicates that no default route is configured. Without a default gateway, the system cannot route packets to destinations outside its local subnet, which explains why users can only communicate with hosts on the local subnet.

Exam trap

The trap here is that candidates may confuse DNS resolution with routing, assuming that name resolution failure is the root cause, when in fact the absence of a default gateway directly prevents any off-subnet IP communication regardless of DNS status.

How to eliminate wrong answers

Option A is wrong because DNS misconfiguration would affect name resolution, not basic IP connectivity; the system could still reach external IP addresses if a default gateway existed. Option B is wrong because a firewall blocking all traffic would prevent all communication, including local subnet traffic, which is not the case here. Option C is wrong because if the network interface were down, the system would have no network connectivity at all, not just limited to the local subnet.

Practice this question →

36

MCQeasy

A technician is troubleshooting network connectivity. The server's IP is 192.168.1.10/24, and the gateway is 192.168.1.1. The server can ping the gateway but cannot ping 8.8.8.8. Which command is most appropriate to check if the default route is configured?

A.route -n

B.ifconfig eth0

C.ping 192.168.1.1

D.arp -n

AnswerA

Shows routing table.

Why this answer

The `route -n` command displays the kernel IP routing table without resolving hostnames, showing the default route (destination 0.0.0.0) and its gateway. Since the server can ping the gateway but not 8.8.8.8, the issue is likely a missing or incorrect default route, which `route -n` directly reveals.

Exam trap

The trap here is that candidates assume a successful ping to the gateway implies a default route exists, but the gateway being reachable does not mean the server has a route to forward traffic beyond the local subnet.

How to eliminate wrong answers

Option B is wrong because `ifconfig eth0` only shows the IP address, netmask, and MAC of the interface, not the routing table or default gateway. Option C is wrong because `ping 192.168.1.1` was already performed successfully (as stated in the scenario) and only verifies local gateway reachability, not the existence of a default route. Option D is wrong because `arp -n` displays the ARP cache (IP-to-MAC mappings) for local network hosts, which is irrelevant to checking the default route configuration.

Practice this question →

37

MCQhard

A system administrator notices that the NTP service on a Linux server is not synchronizing time with external NTP servers. The administrator runs 'ntpq -p' and sees that all servers listed have a 'reach' value of 0. Which of the following is the most likely cause?

A.The system timezone is incorrectly set.

B.The NTP service is configured to use the local clock.

C.A firewall is blocking UDP port 123.

D.The NTP server is using a different NTP version.

AnswerC

Reach 0 indicates no response, common when firewall blocks NTP.

Why this answer

The `reach` value of 0 in `ntpq -p` output indicates that the NTP client has received no responses from any of the configured servers. Since NTP uses UDP port 123 for communication, a firewall blocking this port would prevent the client from sending or receiving NTP packets, resulting in zero reachability. This is the most common cause when all servers show a reach of 0.

Exam trap

The trap here is that candidates may confuse a reach value of 0 with a stratum value of 16 or a synchronization failure due to timezone misconfiguration, but the reach value specifically indicates network-level communication failure, not configuration or version issues.

How to eliminate wrong answers

Option A is wrong because the system timezone setting affects the display of local time, not the synchronization process with NTP servers; NTP works with UTC internally. Option B is wrong because if the NTP service were configured to use the local clock, the `ntpq -p` output would typically show a server entry like `LOCAL(0)` with a reach value greater than 0, not all servers at 0. Option D is wrong because NTP is backward compatible; different NTP versions (v3, v4) can interoperate, and version mismatch would not cause a reach value of 0 for all servers.

Practice this question →

38

MCQhard

Refer to the exhibit. The administrator expects logs to be sent to a remote syslog server at 192.168.1.100 on UDP port 514. However, no logs are being received at the remote server. Which is the most likely issue?

A.The remote syslog server's firewall is blocking incoming UDP port 514.

B.The local7 rule overrides the remote rule.

C.The wildcard *.* does not include kernel messages.

D.The syntax should use @@ for UDP.

AnswerA

Most common issue: remote server not reachable or no listener.

Why this answer

The most likely issue is that the remote syslog server's firewall is blocking incoming UDP port 514. Syslog uses UDP port 514 by default, and if the remote server's firewall is not configured to allow this traffic, the logs will never reach it. This is a common misconfiguration when setting up centralized logging.

Exam trap

The trap here is that candidates may focus on the syslog configuration syntax (e.g., @ vs @@) or the wildcard behavior, but the most common real-world issue is firewall blocking, which is a fundamental networking concept that LPIC-1 tests.

How to eliminate wrong answers

Option B is wrong because the local7 rule does not override the remote rule; syslog.conf rules are processed sequentially, and the remote rule is separate and independent. Option C is wrong because the wildcard *.* includes all facilities and priorities, including kernel messages, so kernel messages are covered. Option D is wrong because the syntax for UDP is a single @ (for TCP it is @@); using @@ would attempt TCP, which is not the protocol specified in the question.

Practice this question →

39

MCQmedium

On a Linux server using systemd and Postfix for email service, an administrator needs to diagnose a delivery failure for a local user. Which command should be used to view the most recent mail-related system journal entries?

A.tail -f /var/log/maillog

B.systemctl status postfix

C.less /var/log/syslog

D.journalctl -u postfix

AnswerD

This command retrieves all journal messages for the postfix unit, ideal for troubleshooting.

Why this answer

`journalctl -u postfix` queries the systemd journal for all log entries associated with the `postfix` unit. Since the server uses systemd, Postfix logs are captured by journald rather than written to traditional files like `/var/log/maillog`. This command shows the most recent mail-related entries, including delivery failures, in reverse chronological order.

Exam trap

The trap here is that candidates accustomed to traditional syslog-based logging (e.g., `/var/log/maillog`) may overlook that systemd-based distributions use journald as the primary log collector, making `journalctl -u postfix` the correct command instead of reading static log files.

How to eliminate wrong answers

Option A is wrong because `tail -f /var/log/maillog` assumes Postfix logs are written to a traditional syslog file, but on a systemd-based server, Postfix logs are managed by journald and may not be present in `/var/log/maillog` unless explicitly configured. Option B is wrong because `systemctl status postfix` shows the current service state, recent process logs, and unit status, but it does not display the full journal of mail delivery events; it only shows a limited snippet of the service's stdout/stderr. Option C is wrong because `less /var/log/syslog` targets a general system log file that may contain mail entries but is not specific to Postfix, and on many modern distributions, syslog is replaced by journald or the file may not exist.

Practice this question →

40

MCQmedium

Refer to the exhibit. A system administrator notices that remote SSH connections are being blocked from all IP addresses except 10.0.0.5. Which configuration change would allow SSH from any IP?

A.Add a new rule to accept SSH from any source to the beginning of the chain.

B.Change the INPUT chain policy to ACCEPT.

C.Delete the first rule.

D.Move the second rule to be the first rule.

AnswerA

Correct: Adding an ACCEPT rule for SSH from any source before the DROP rule will allow all SSH traffic, as the packet will be accepted before reaching the DROP rule.

Why this answer

The exhibit shows an iptables INPUT chain with a first rule that accepts SSH from 10.0.0.5 and a second rule that drops all other SSH traffic. Because iptables processes rules in order, the first rule accepts SSH from 10.0.0.5, but all other SSH packets are matched by the second rule and dropped. Adding a new rule to accept SSH from any source at the beginning of the chain ensures that SSH packets from any IP are accepted before reaching the drop rule, allowing connections from any IP.

Exam trap

The trap is that candidates may think that because the second rule drops SSH, any new accept rule added later in the chain would override it. However, iptables processes rules in order, so a new accept rule must be placed before the drop rule to allow SSH from any IP.

How to eliminate wrong answers

Option B is wrong because changing the INPUT chain policy to ACCEPT would allow all traffic, not just SSH, which is overly permissive and not a targeted fix for SSH access. Option C is wrong because deleting the first rule would remove the drop rule entirely, but the question asks for a change to allow SSH from any IP while preserving the existing rules; deleting the first rule might also remove intended restrictions. Option D is wrong because moving the second rule (which accepts SSH only from 10.0.0.5) to the first position would still restrict SSH to only 10.0.0.5, not allow SSH from any IP.

Practice this question →

41

Matchingmedium

Match each Linux command to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Search text using patterns

Change file permissions

Report snapshot of current processes

Archive files

Stream editor for filtering and transforming text

Why these pairings

The correct matches are: cp for copying files, grep for searching text, and chmod for changing permissions. Common confusions include mixing these commands due to similar syntax or overlapping contexts.

Practice this question →

42

MCQeasy

A small business runs a web application on a Linux server that uses Apache to serve dynamic content via PHP-FPM. The server currently uses the default Apache configuration, but the administrator wants to improve security by limiting access to the server's administrative interface (located at /admin) to only the local network (192.168.1.0/24). The administrative interface is accessed via a separate VirtualHost on port 443. The administrator has created a new VirtualHost configuration file for the admin site. However, after reloading Apache, users from outside the local network can still access the /admin page. The administrator has verified that the VirtualHost is being parsed and that mod_authz_core is enabled. Which of the following actions would most likely resolve the issue?

A.Add the following inside the <VirtualHost> block for the admin site: <Directory /var/www/admin> Require ip 192.168.1.0/24 </Directory>

B.Add the following to the server's iptables: iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j DROP

C.Add the following inside the <VirtualHost> block: <Location /admin> Require valid-user AuthType Basic AuthUserFile /etc/httpd/.htpasswd </Location>

D.Set the DocumentRoot of the default VirtualHost to /var/www/admin.

AnswerA

This restricts directory access to the local subnet.

Why this answer

The administrator needs to restrict access to the /admin path at the directory level using Apache's mod_authz_core. By placing a <Directory> block inside the VirtualHost that specifies the filesystem path to the admin files and using 'Require ip 192.168.1.0/24', Apache will enforce IP-based access control for that directory. Since the VirtualHost is already being parsed and mod_authz_core is enabled, this is the direct and proper way to limit access to the local network.

Exam trap

The trap here is that candidates often confuse network-layer filtering (iptables) with application-layer access control (Apache directives), or mistakenly think that authentication (Require valid-user) can replace IP-based restrictions, when in fact they serve different security purposes.

How to eliminate wrong answers

Option B is wrong because iptables rules would block all HTTPS traffic on port 443 from outside the local network, including the main web application, not just the /admin path; this is too broad and would break the primary service. Option C is wrong because it implements HTTP Basic authentication requiring a valid user and password, which does not restrict by IP address; users from outside the local network could still access /admin if they provide valid credentials. Option D is wrong because changing the DocumentRoot of the default VirtualHost to /var/www/admin would serve the admin interface as the default site, making it accessible to all, and does not apply any access restriction.

Practice this question →

43

MCQmedium

A system administrator is configuring a Linux server to act as a router. The server has two network interfaces: eth0 (192.168.1.1/24) and eth1 (10.0.0.1/24). Which of the following commands enables IP forwarding on this server?

A.route add default gw 10.0.0.1

B.sysctl -w net.ipv4.ip_forward=1

C.echo 1 > /proc/sys/net/ipv4/ip_forward

D.sysctl -w net.ipv4.ip_forward=1

AnswerB, D

Correct. The sysctl command net.ipv4.ip_forward=1 enables IP forwarding.

Why this answer

Both options B and D contain the exact same command 'sysctl -w net.ipv4.ip_forward=1' which enables IP forwarding. Therefore, both B and D are correct. Option A is incorrect because it sets a default gateway instead of enabling forwarding.

Option C is also a valid method (echoing 1 to /proc/sys/net/ipv4/ip_forward), but it is not listed as correct because the question likely expects the sysctl method.

Exam trap

The trap here is that both options B and D are identical commands. Candidates may think one is a distractor, but since they are exactly the same, both are correct. Also, candidates may confuse setting a default gateway (option A) with enabling IP forwarding, or think that writing to /proc (option C) is equivalent, but the key insight is that the sysctl command is the standard way.

How to eliminate wrong answers

Option A is wrong because `route add default gw 10.0.0.1` sets a default gateway for outbound traffic, not IP forwarding; it does not enable the kernel to forward packets between interfaces. Option B is wrong because `sysctl -w net.ipv4.ip_forward=1` is syntactically identical to Option D but is listed as a separate option; however, in the context of this question, Option B is actually the same command and would also be correct, but the question designates Option D as the correct answer, so Option B is considered a duplicate and not the intended choice. Option C is wrong because `echo 1 > /proc/sys/net/ipv4/ip_forward` is a valid method to enable IP forwarding, but it requires root privileges and the path is case-sensitive; the correct path is `/proc/sys/net/ipv4/ip_forward` (lowercase), and while it works, it is less preferred than `sysctl` because it does not persist across reboots and is not the standard LPIC-1 recommended command.

Practice this question →

44

MCQhard

An administrator is troubleshooting a DNS issue. The command 'dig @8.8.8.8 example.com' returns a response, but 'host example.com' returns 'Host not found'. Which of the following is the most likely cause?

A.The network interface is down.

B.The /etc/hosts file is corrupt.

C.The DNS server at 8.8.8.8 is not responding.

D.The /etc/resolv.conf file is misconfigured.

AnswerD

'host' uses local resolver, which may have wrong DNS servers.

Why this answer

The command 'dig @8.8.8.8 example.com' succeeds, proving that the DNS server at 8.8.8.8 is reachable and functional, and that network connectivity is fine. However, 'host example.com' fails because it uses the system's default resolver, which reads /etc/resolv.conf to determine which DNS server to query. If /etc/resolv.conf is misconfigured (e.g., missing or incorrect nameserver entries), the resolver cannot reach a valid DNS server, resulting in 'Host not found'.

Exam trap

The trap here is that candidates see a successful 'dig' and assume DNS is fully working, not realizing that 'dig' with an explicit server bypasses the local resolver configuration, while 'host' relies on /etc/resolv.conf.

How to eliminate wrong answers

Option A is wrong because if the network interface were down, 'dig @8.8.8.8' would also fail (no route to host). Option B is wrong because the /etc/hosts file is used for local hostname resolution before DNS; a corrupt file could cause incorrect mappings but would not cause a 'Host not found' error when the DNS query itself fails—the resolver would still attempt DNS. Option C is wrong because the 'dig @8.8.8.8' command succeeded, directly proving that 8.8.8.8 is responding.

Practice this question →

45

MCQhard

A Linux server running multiple virtual hosts on Apache suddenly becomes unresponsive to web requests. The administrator finds that the server still responds to ping. Which diagnostic command would best identify whether Apache is accepting connections?

A.ip route show

B.curl -I http://localhost

C.ping -c 4 localhost

D.ss -tlnp | grep :80

AnswerD

Shows if Apache is listening on port 80.

Why this answer

`ss -tlnp | grep :80` lists all TCP sockets that are listening (`-l`), numeric (`-n`), and shows the process using the socket (`-p`). Filtering for port 80 directly reveals whether Apache's httpd process is actively listening for incoming connections, which is the most direct way to confirm that Apache is accepting connections at the transport layer.

Exam trap

The trap here is that candidates often choose `curl -I http://localhost` thinking it tests Apache directly, but it actually tests the full HTTP request/response cycle, which can fail for reasons unrelated to Apache's listening state (e.g., firewall, SELinux, or virtual host misconfiguration), whereas `ss` directly inspects the TCP listener without relying on higher-layer protocols.

How to eliminate wrong answers

Option A is wrong because `ip route show` displays the kernel routing table, which is unrelated to whether a specific service like Apache is listening on a port. Option B is wrong because `curl -I http://localhost` attempts an HTTP request to the local web server; if Apache is not accepting connections, curl will fail or hang, but it does not diagnose the listening state itself and may be blocked by a firewall or local policy. Option C is wrong because `ping -c 4 localhost` tests ICMP echo to the loopback interface, which only confirms that the network stack is alive, not that Apache's TCP listener is operational.

Practice this question →

46

MCQhard

Refer to the exhibit. A system administrator finds this line in /etc/rsyslog.conf. What is the effect of this configuration?

A.Only messages with facility *.info are forwarded.

B.All syslog messages are forwarded via TCP to the server.

C.All syslog messages are forwarded via UDP to the server at 192.168.1.100 on port 514.

D.Only authentication-related messages are forwarded.

AnswerC

General rule with @ for UDP, *.* for all.

Why this answer

The line `*.* @192.168.1.100:514` in rsyslog.conf uses the `@` symbol to indicate UDP forwarding. The `*.*` selector means all facilities and all priorities, so every syslog message is forwarded via UDP to the server at 192.168.1.100 on port 514. This is a standard rsyslog syntax for remote logging.

Exam trap

The trap here is that candidates confuse the single `@` (UDP) with double `@@` (TCP), or misinterpret `*.*` as a specific facility filter rather than the universal wildcard for all syslog messages.

How to eliminate wrong answers

Option A is wrong because `*.*` does not restrict to facility `*.info`; it includes all facilities and all priorities, not just info-level messages. Option B is wrong because the single `@` specifies UDP, not TCP; TCP forwarding would use two `@@` symbols (e.g., `*.* @@192.168.1.100:514`). Option D is wrong because `*.*` covers all facilities, not just authentication-related (auth, authpriv); there is no facility filter applied.

Practice this question →

47

MCQeasy

Which of the following commands will display the default gateway of a Linux system?

A.arp -a

B.netstat -i

C.ip route show

D.ifconfig

AnswerC

Displays routing table including default gateway.

Why this answer

The `ip route show` command displays the kernel routing table, which includes the default gateway as a default route (typically `default via <gateway-IP>`). This is the standard modern tool for viewing routing information on Linux systems.

Exam trap

The trap here is that candidates often confuse `netstat -r` (which does show the routing table) with `netstat -i` (which only shows interface statistics), leading them to incorrectly select option B.

How to eliminate wrong answers

Option A is wrong because `arp -a` displays the ARP cache (IP-to-MAC address mappings), not routing information or the default gateway. Option B is wrong because `netstat -i` shows network interface statistics (packets, errors, etc.), not the routing table or default gateway. Option D is wrong because `ifconfig` displays network interface configuration (IP address, netmask, etc.) but does not show routing information or the default gateway.

Practice this question →

48

MCQmedium

An organization's DNS server (BIND) is authoritatively serving the example.com zone. The administrator needs to add a mail exchange record for mail.example.com with priority 10. Which resource record should be added to the zone file?

A.example.com. IN MX 10 mail.example.com.

B.mail.example.com. IN A 192.168.1.10

C.mail.example.com. IN CNAME example.com.

D.example.com. IN TXT "v=spf1 mx -all"

AnswerA

MX record defines mail exchange with priority.

Why this answer

An MX record specifies the mail exchange server for a domain, and the syntax 'example.com. IN MX 10 mail.example.com.' defines a priority of 10 for the mail server mail.example.com. This record tells other mail servers to deliver email for @example.com to mail.example.com, with lower priority values preferred.

Exam trap

The trap here is that candidates often confuse the purpose of MX records with A or CNAME records, or mistakenly think an SPF TXT record is the correct way to designate a mail server, when in fact MX records are the standard mechanism for mail routing.

How to eliminate wrong answers

Option B is wrong because it adds an A record for mail.example.com, which maps a hostname to an IP address, but the question specifically asks for a mail exchange record (MX), not an address record. Option C is wrong because it creates a CNAME alias from mail.example.com to example.com, which would cause mail delivery issues (RFC 1034 prohibits CNAME records at the same node as other record types like MX). Option D is wrong because it adds a TXT record with an SPF policy, which is used for sender policy framework to prevent email spoofing, not for routing mail to a specific server.

Practice this question →

49

Multi-Selecteasy

Which TWO commands are commonly used to start, stop, or restart system services on a Linux system that uses systemd as its init system?

Select 2 answers

A.service

B.journalctl

C.chkconfig

D.systemctl

E.init.d

AnswersA, D

service is a legacy wrapper that works with systemd on most distros.

Why this answer

The `service` command is a legacy tool that works with System V init scripts, but on systems using systemd, it is often mapped to `systemctl` via compatibility wrappers. This allows `service` to start, stop, or restart services on systemd-based distributions, making it a commonly used command for these tasks.

Exam trap

The trap here is that candidates may confuse `chkconfig` or `init.d` as valid systemd commands, forgetting that systemd replaced these with `systemctl` and that `service` is only a compatibility wrapper, not a native systemd tool.

Practice this question →

50

MCQhard

A company runs a critical web application on a Linux server (Ubuntu 20.04) with Apache and MySQL. The server has two network interfaces: eth0 (public IP) and eth1 (private IP). Recently, the application has been experiencing intermittent connectivity issues. Users report that the web page sometimes loads slowly or times out. The administrator checks the network configuration and finds the following: eth0 is configured with a static IP 203.0.113.10/24, gateway 203.0.113.1; eth1 is configured with a static IP 10.0.0.10/24, no gateway. The administrator runs 'ip route show' and sees: default via 203.0.113.1 dev eth0, 10.0.0.0/24 dev eth1 proto kernel scope link src 10.0.0.10 metric 100. The administrator also notices that the system's /etc/resolv.conf contains nameserver 8.8.8.8 and nameserver 8.8.4.4. The MySQL server is configured to listen on 127.0.0.1. What is the most likely cause of the intermittent connectivity issues?

A.The private network interface (eth1) is misconfigured, causing traffic to be routed incorrectly.

B.The DNS servers are not reachable, causing delays in name resolution.

C.The public network interface (eth0) is experiencing high latency or packet loss due to ISP issues.

D.The MySQL server is listening on localhost, but should listen on the private IP for better performance.

AnswerC

Intermittent connectivity issues are often caused by problems with the external link.

Why this answer

The intermittent connectivity issues described (slow page loads and timeouts) are classic symptoms of high latency or packet loss on the public network path. The routing table shows a default gateway via eth0 (203.0.113.1), which is the only path to the internet, and the DNS servers (8.8.8.8, 8.8.4.4) are external, so any degradation on eth0 would directly impact web application responsiveness. The administrator's observation that eth0 is configured with a static IP and gateway, combined with no alternative route, points to ISP-level issues as the most likely cause.

Exam trap

The trap here is that candidates may incorrectly attribute the issue to DNS misconfiguration or interface misrouting, overlooking that the default route via eth0 makes the public interface the single point of failure for internet-bound traffic, and that intermittent symptoms point to network path degradation rather than configuration errors.

How to eliminate wrong answers

Option A is wrong because eth1 is correctly configured with a static IP 10.0.0.10/24 and no gateway, which is appropriate for a private network; the routing table shows a direct route to 10.0.0.0/24 via eth1, and since the default route is via eth0, traffic is not misrouted. Option B is wrong because DNS servers 8.8.8.8 and 8.8.4.4 are public Google DNS servers that are typically reachable; if they were unreachable, the application would fail consistently rather than intermittently, and the issue would manifest as name resolution failures, not slow page loads or timeouts. Option D is wrong because MySQL listening on 127.0.0.1 is standard for local-only access, and the web application (Apache) is on the same server, so connecting via the loopback interface is optimal for performance; listening on the private IP would add unnecessary network overhead and not cause intermittent connectivity.

Practice this question →

51

MCQhard

A sysadmin is troubleshooting a connectivity issue between two servers in different subnets. The output of 'traceroute 192.168.2.10' shows packets reaching a router but not the destination. The router's firewall uses iptables. Which rule would prevent the traceroute from completing?

A.-A INPUT -i lo -j LOG

B.-A INPUT -p udp -j ACCEPT

C.-A INPUT -p tcp --dport 80 -j REJECT

D.-A INPUT -p icmp --icmp-type port-unreachable -j DROP

AnswerD

Blocks ICMP Port Unreachable, which stops traceroute responses.

Why this answer

Traceroute relies on ICMP Time Exceeded messages from intermediate routers and an ICMP Port Unreachable message from the destination to signal completion. Dropping ICMP type 3 (Destination Unreachable) packets, specifically port-unreachable (code 3), prevents the final response from reaching the source, causing traceroute to hang after reaching the last hop.

Exam trap

The trap here is that candidates often focus on blocking the UDP probes themselves (e.g., via -p udp -j DROP) rather than understanding that traceroute completion depends on the ICMP response from the destination, not just the probe packets.

How to eliminate wrong answers

Option A is wrong because logging (-j LOG) does not drop or reject packets; it only records them, so traceroute traffic would still pass. Option B is wrong because accepting UDP packets (-p udp -j ACCEPT) would actually help traceroute, which uses high UDP ports by default, not block it. Option C is wrong because rejecting TCP traffic on port 80 (-p tcp --dport 80 -j REJECT) is unrelated to traceroute, which uses UDP probes (or ICMP on some systems) and does not target port 80.

Practice this question →

52

Multi-Selectmedium

Which TWO configuration files are commonly associated with NTP client configuration?

Select 2 answers

A./etc/systemd/timesyncd.conf

B./etc/chrony.conf

C./etc/timezone

D./etc/ntp.conf

E./etc/ntpd.conf

AnswersB, D

Used by chronyd.

Why this answer

B is correct because `/etc/chrony.conf` is the configuration file for the `chronyd` NTP client daemon, which is the default NTP implementation on modern RHEL/CentOS 8+ and many other distributions. D is correct because `/etc/ntp.conf` is the traditional configuration file for the `ntpd` NTP daemon, used by the `ntp` package on older systems and still common on Debian/Ubuntu. Both files define NTP server pools, drift files, and other synchronization settings.

Exam trap

The trap here is that candidates confuse the configuration file for `systemd-timesyncd` (option A) with a full NTP client, or mistakenly think `/etc/ntpd.conf` (option E) is valid, when the actual standard file is `/etc/ntp.conf` without the 'd'.

Practice this question →

53

Multi-Selectmedium

Which TWO commands can be used to display network interface statistics on a Linux system?

Select 3 answers

A.route -n

B.ss -s

C.ip -s link

D.netstat -i

E.ifconfig

AnswersC, D, E

ip -s link shows link-layer statistics, but does not provide the traditional network interface statistics that netstat -i and ifconfig display. Therefore, it is not considered one of the two correct commands.

Why this answer

(netstat -i) displays a table of network interface statistics, including packets transmitted and received, errors, and drops. (ifconfig) shows the status of active interfaces, including TX/RX packet and error statistics. (ip -s link) also shows per-interface statistics via the -s flag, making all three valid commands for viewing network interface statistics. The exam expects knowledge of these traditional and modern tools.

Exam trap

The trap here is that candidates may confuse commands that show network configuration or routing (route -n, ss -s) with those that specifically display per-interface packet and error statistics, leading them to overlook the precise meaning of 'interface statistics'.

Practice this question →

54

MCQhard

A host on the 192.168.1.0/24 network cannot reach the internet. Based on the exhibit, which is the most likely cause?

A.There is no route to 192.168.1.0/24.

B.The default route is missing.

C.The gateway for internet traffic is incorrect; the host uses 10.0.1.254 for internal network, but the default gateway 10.0.1.1 may not be reachable from 192.168.1.0/24.

D.The routing table is empty.

AnswerC

Causes internet unreachability.

Why this answer

The host on 192.168.1.0/24 uses 10.0.1.254 as its default gateway, but the internet-bound traffic must be routed through 10.0.1.1, which is on a different subnet. Without a route or NAT between these subnets, the host cannot reach the internet, as the gateway 10.0.1.254 is likely an internal router that does not forward to 10.0.1.1.

Exam trap

The trap here is that candidates assume any default gateway will work for internet access, but they overlook the subnet mismatch between the host's network (192.168.1.0/24) and the gateway's IP (10.0.1.254), which prevents proper routing to the external gateway (10.0.1.1).

How to eliminate wrong answers

Option A is wrong because the host is on the 192.168.1.0/24 network, so a route to that network exists locally via the host's own interface; the issue is with external routing. Option B is wrong because a default route is present (pointing to 10.0.1.254), but it is misconfigured for internet traffic. Option D is wrong because the routing table is not empty; it contains at least the local network route and the default route, as shown in the exhibit.

Practice this question →

55

MCQeasy

A small office has a network printer with IP 192.168.1.100. The printer is shared via CUPS. A user reports that they cannot print a document from their workstation. The printer appears in the list of available printers, but when they try to print, the job hangs in the queue with status 'processing'. The administrator suspects the printer may be offline or the CUPS service is not running. Which command should the administrator run first to gather diagnostic information about the printer and its queue?

A.ping 192.168.1.100

B.lpstat -t

C.lpadmin -p printer -E

D.systemctl restart cups

AnswerB

lpstat -t shows printer status, queue, and error information for diagnosis.

Why this answer

The `lpstat -t` command shows the complete status of the CUPS print system, including all printers, their queues, and whether they are accepting jobs. Since the job is stuck with 'processing' status, this command will reveal if the printer is idle, disabled, or unreachable, and whether the queue is enabled or paused. It is the first diagnostic step before testing network connectivity or restarting services.

Exam trap

The trap here is that candidates assume a network connectivity test (ping) is the logical first step, but the question specifically asks for diagnostic information about the printer and its queue, which requires CUPS-specific status reporting, not just ICMP reachability.

How to eliminate wrong answers

Option A is wrong because `ping` only tests basic network layer connectivity to 192.168.1.100, but does not provide any information about the CUPS printer queue status, job state, or whether the printer is accepting jobs. Option C is wrong because `lpadmin -p printer -E` enables the printer and sets it as the default, but it does not display diagnostic information; it modifies configuration and could disrupt an existing setup. Option D is wrong because `systemctl restart cups` restarts the CUPS service, which is a troubleshooting action that should only be taken after gathering diagnostic data; it may clear the queue and lose job information without identifying the root cause.

Practice this question →

56

MCQhard

A server in a corporate network uses systemd-resolved for DNS. Internal hostnames (e.g., server.example.lan) fail to resolve, but external names (e.g., google.com) work. The /etc/resolv.conf is a symlink to /run/systemd/resolve/stub-resolv.conf. The administrator checks the systemd-resolved configuration and finds that the internal DNS server is listed globally, but the network interface has no specific DNS set. Which command should be used to assign the internal DNS server to the interface and fix resolution?

A.Add the internal hostnames to /etc/hosts.

B.Run 'resolvectl dns eth0 10.0.0.1' to set the DNS server for the interface.

C.Restart systemd-resolved service.

D.Edit /etc/resolv.conf and add the internal DNS server.

AnswerB

This sets the per-link DNS, allowing systemd-resolved to use the internal server for that interface.

Why this answer

`resolvectl dns eth0 10.0.0.1` assigns the internal DNS server specifically to the network interface (eth0), overriding the global setting for that interface. In systemd-resolved, per-interface DNS settings take precedence over global DNS servers, so this command ensures that internal hostnames are resolved by the internal DNS server while external names continue to work via the global configuration.

Exam trap

The trap here is that candidates assume editing /etc/resolv.conf or restarting the service will fix the issue, but they fail to recognize that systemd-resolved requires explicit per-interface DNS assignment via `resolvectl` to override the global setting for a specific network interface.

How to eliminate wrong answers

Option A is wrong because adding hostnames to /etc/hosts is a static workaround that does not fix the underlying DNS resolution issue for dynamic internal hostnames; it is not a scalable solution and does not leverage the DNS server. Option C is wrong because restarting systemd-resolved does not change the configuration; it only reloads the existing settings, which still lack a per-interface DNS server for eth0. Option D is wrong because /etc/resolv.conf is a symlink to /run/systemd/resolve/stub-resolv.conf, which is managed by systemd-resolved; manually editing it would be overwritten by systemd-resolved and is not the correct way to configure per-interface DNS in systemd-resolved.

Practice this question →

57

Drag & Dropmedium

Order the steps to mount an NFS share from a remote server.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

NFS mounting requires the client package, a local directory, and the mount command with server and export path.

Practice this question →

58

MCQeasy

A user submitted a print job to a CUPS printer but used the wrong options. Which command should the administrator use to cancel the job?

A.lpstat

B.cancel

C.lprm

D.lpadmin

AnswerB

The cancel command is part of CUPS and cancels print jobs.

Why this answer

The `cancel` command is the correct CUPS utility to terminate a print job that has already been submitted. It accepts either a job ID (e.g., `cancel 123`) or a printer name (e.g., `cancel printer-name`) to cancel the currently active job on that printer. This command directly communicates with the CUPS daemon to remove the job from the queue.

Exam trap

The trap here is that candidates familiar with legacy BSD/LPD printing systems may instinctively choose `lprm`, but CUPS uses the `cancel` command as its standard job cancellation tool, and `lprm` is not the correct CUPS command.

How to eliminate wrong answers

Option A is wrong because `lpstat` is used to display the status of printers and print jobs, not to cancel them. Option C is wrong because `lprm` is the BSD/LPD print system command for removing jobs; CUPS does not use `lprm` natively (though it may be aliased for compatibility, the standard CUPS command is `cancel`). Option D is wrong because `lpadmin` is used for printer configuration and administration (adding, removing, or setting default printers), not for canceling individual print jobs.

Practice this question →

59

MCQmedium

A sysadmin notices that after modifying iptables rules, the SSH service is unreachable from a specific subnet (192.168.1.0/24). Which command should be used to view the current rules with line numbers for easier identification?

A.iptables -L

B.iptables -L --line-numbers

C.iptables -t raw -L

D.iptables -t nat -L

AnswerB

Shows rules with line numbers for easier editing.

Why this answer

The `iptables -L --line-numbers` command displays all current iptables rules in the default filter table with line numbers prepended to each rule. This allows the sysadmin to easily identify and reference specific rules (e.g., for deletion or insertion) when troubleshooting why SSH traffic from 192.168.1.0/24 is being dropped or rejected.

Exam trap

The trap here is that candidates may choose `iptables -L` (Option A) because it shows rules, but they overlook the `--line-numbers` flag, which is critical for efficient rule management and is a common LPIC-1 exam detail.

How to eliminate wrong answers

Option A is wrong because `iptables -L` lists rules without line numbers, making it harder to pinpoint the exact rule affecting SSH traffic. Option C is wrong because `iptables -t raw -L` shows rules in the raw table, which is used for connection tracking exemptions (e.g., NOTRACK), not for filtering SSH traffic. Option D is wrong because `iptables -t nat -L` shows rules in the NAT table, which handles address translation (SNAT/DNAT) and does not affect packet filtering decisions for SSH reachability.

Practice this question →

60

MCQeasy

An organization wants to implement a centralized logging solution for multiple Linux servers. Which service should run on the central server to receive syslog messages?

A.journald

B.syslogd

C.rsyslogd

D.syslog-ng

AnswerC

Standard syslog daemon used for receiving remote logs.

Why this answer

rsyslogd is the correct choice because it is the modern, enhanced syslog daemon that supports reliable TCP-based logging, advanced filtering, and centralized log collection. It is the default syslog daemon on most major Linux distributions and is designed to receive syslog messages from remote servers over the network, making it ideal for a centralized logging solution.

Exam trap

The trap here is that candidates may confuse journald (which is the local log collector in systemd) with a network syslog receiver, or assume that any syslog daemon (like syslogd or syslog-ng) is equally correct, but rsyslogd is the standard, modern, and most commonly tested solution for centralized logging in LPIC-1.

How to eliminate wrong answers

Option A is wrong because journald is the systemd journal daemon that collects and stores binary log data locally; it does not natively act as a network syslog receiver without additional configuration or a forwarding agent. Option B is wrong because syslogd is the original, legacy syslog daemon that lacks support for TCP, advanced filtering, and reliable message delivery, making it unsuitable for modern centralized logging. Option D is wrong because syslog-ng is a valid alternative syslog daemon that can receive remote messages, but it is not the standard or default choice on most Linux distributions, and the question asks which service should run on the central server—rsyslogd is the most common and expected answer in an LPIC-1 context.

Practice this question →

61

MCQmedium

A web server running on this host is not accessible from clients. Based on the exhibit, what is the most likely reason?

A.The FORWARD chain policy is DROP.

B.The OUTPUT chain policy is ACCEPT.

C.Incoming HTTP traffic is blocked by a DROP rule on port 80.

D.SSH traffic is blocked.

AnswerC

The rule explicitly drops TCP port 80.

Why this answer

The exhibit shows a firewall rule set where the INPUT chain has a DROP rule for destination port 80 (HTTP). Since incoming HTTP traffic from clients must traverse the INPUT chain to reach the local web server process, this DROP rule explicitly blocks all inbound HTTP requests, making the web server inaccessible. The FORWARD chain is irrelevant because traffic destined for the local host uses the INPUT chain, not FORWARD.

Exam trap

The trap here is that candidates often confuse the FORWARD chain with the INPUT chain, assuming that blocking traffic to a local service requires a FORWARD rule, when in fact the INPUT chain governs packets destined for the host itself.

How to eliminate wrong answers

Option A is wrong because the FORWARD chain policy only affects traffic routed through the host (e.g., acting as a router), not traffic destined for the local host; the web server is local, so FORWARD is not involved. Option B is wrong because the OUTPUT chain policy being ACCEPT controls outbound traffic from the local host, not inbound HTTP requests from clients; it has no effect on incoming connections. Option D is wrong because SSH traffic (port 22) is not mentioned in the exhibit as being blocked; the issue is specifically HTTP on port 80, and SSH is irrelevant to web server accessibility.

Practice this question →

62

MCQeasy

A user reports that they cannot connect to a remote server using SSH. The administrator checks the SSH server status and it is running. Which of the following is the most likely cause?

A.A firewall is blocking port 22.

B.The client's subnet mask is incorrect.

C.The client cannot resolve the server's hostname.

D.The SSH server is using UDP instead of TCP.

AnswerA

Firewall blocking SSH port is a common issue.

Why this answer

SSH operates over TCP port 22 by default. If the SSH server is running but the client cannot connect, a firewall blocking port 22 is the most likely cause because it would prevent the TCP handshake from completing, even though the SSH daemon (sshd) is active and listening.

Exam trap

The trap here is that candidates may assume a running SSH server guarantees connectivity, overlooking that a firewall can block the port even when the service is active, or they may confuse SSH's TCP usage with UDP-based protocols like DNS.

How to eliminate wrong answers

Option B is wrong because an incorrect subnet mask would prevent the client from reaching any host outside its local subnet, but the question specifies a remote server, so routing or gateway issues would be more relevant; a subnet mask error alone would not selectively block SSH while allowing other traffic. Option C is wrong because if the client cannot resolve the server's hostname, the user would likely receive a 'Name or service not known' error, not a connection failure to a running SSH server; the administrator could test with the server's IP address to isolate DNS issues. Option D is wrong because SSH uses TCP (Transmission Control Protocol) for reliable, connection-oriented communication, not UDP; UDP is used by protocols like DNS or DHCP, and SSH has no UDP mode.

Practice this question →

63

MCQeasy

A user reports that they cannot access the company's web server. The administrator confirms the server is running and network connectivity is fine. Which command should be used to verify that the HTTP service is listening on the correct port?

A.ping 127.0.0.1

B.netstat -rn

C.iperf3 -c localhost

D.ss -tlnp

AnswerD

Shows listening TCP sockets with port and process.

Why this answer

`ss -tlnp`, is correct because it lists TCP listening sockets with their port numbers and associated processes. The `-t` flag filters for TCP, `-l` shows only listening sockets, `-n` displays numeric addresses and ports (avoiding DNS lookups), and `-p` reveals the process ID/name. This directly verifies whether the HTTP service (typically port 80 or 443) is actively listening on the expected interface.

Exam trap

The trap here is that candidates may confuse general network connectivity tools (ping, iperf3) or routing commands (netstat -rn) with service-specific port listening checks, failing to recognize that only `ss` (or `netstat -tlnp`) directly confirms the HTTP daemon is bound to the correct port.

How to eliminate wrong answers

Option A is wrong because `ping 127.0.0.1` tests only local loopback connectivity and does not check whether a specific service (like HTTP) is listening on a port. Option B is wrong because `netstat -rn` displays the routing table, not listening sockets or service ports. Option C is wrong because `iperf3 -c localhost` is a network throughput testing tool that measures bandwidth between client and server, not a command to verify whether a specific service is listening on a port.

Practice this question →

64

MCQmedium

A system administrator wants to monitor network traffic on a specific port (TCP/443) entering the server. Which command will capture packets on interface eth0 and display them in real-time?

A.netstat -tulpn | grep :443

B.ss -tulpn | grep :443

C.tcpdump -i eth0 port 443

D.iptables -L -n -v

AnswerC

tcpdump captures packets on specified port.

Why this answer

C is correct because `tcpdump -i eth0 port 443` captures packets on interface eth0 filtering for TCP port 443 (HTTPS) and displays them in real-time as they arrive. This command uses the libpcap library to intercept raw network frames, making it the standard tool for live packet capture and analysis.

Exam trap

The trap here is that candidates confuse commands that show socket state (netstat/ss) with commands that capture live packets (tcpdump), leading them to pick a command that only lists current connections rather than monitoring traffic in real-time.

How to eliminate wrong answers

Option A is wrong because `netstat -tulpn | grep :443` shows listening sockets and established connections, not live packet capture; it only displays current socket states from /proc/net/tcp, not real-time traffic. Option B is wrong because `ss -tulpn | grep :443` similarly lists socket statistics from kernel data, not packet-level capture; it cannot show individual packets or their contents. Option D is wrong because `iptables -L -n -v` lists firewall rules and their packet/byte counters, but it does not capture or display packet contents in real-time; it only shows accumulated statistics for rules.

Practice this question →

65

MCQeasy

A junior system administrator is tasked with setting up a new Linux server that will act as a network time client. The server must synchronize its clock with the external NTP pool servers 0.pool.ntp.org, 1.pool.ntp.org, and 2.pool.ntp.org. The administrator installs the ntp package and edits /etc/ntp.conf to include the following lines: server 0.pool.ntp.org server 1.pool.ntp.org server 2.pool.ntp.org However, after restarting the ntpd service, the administrator notices that the system time does not appear to be synchronized. The command 'ntpq -p' returns no output. The administrator checks the status of the ntpd service with 'systemctl status ntp' and sees that the service is active (running). What is the most likely reason for the synchronization failure?

A.The NTP servers are unreachable due to a firewall blocking UDP port 123.

B.The ntpd daemon is configured to only adjust the clock gradually and refuses to make large time jumps by default.

C.The ntp.conf file is missing the 'pool' directive; instead, 'server' lines are used incorrectly.

D.The ntpd service is not enabled to start at boot, so it stopped after the administrator logged out.

AnswerB

ntpd will not step the time if the offset is too large; the -g flag or ntpdate command should be used initially.

Why this answer

The ntpd daemon, by default, refuses to make large time jumps (typically more than 128 ms) to prevent abrupt time changes. If the clock is significantly out of sync, ntpd will not adjust it, even if it eventually contacts the NTP servers. The empty output from 'ntpq -p' could indicate that no server associations have been formed yet, but the fundamental reason for the synchronization failure is ntpd's conservative stepping policy.

To synchronize the clock, the administrator should manually set the system time close to the correct time or use the 'ntpd -g' option to allow a one-time large step.

Exam trap

The trap here is that candidates assume a running service with configured servers should immediately synchronize, overlooking ntpd's default conservative behavior of refusing large time jumps, which is a common cause of apparent synchronization failure in exam scenarios.

How to eliminate wrong answers

Option A is wrong because if UDP port 123 were blocked by a firewall, the ntpd service would still be active and 'ntpq -p' would typically show the configured servers with a 'reach' value of 0, not return no output at all. Option C is wrong because the 'server' directive is perfectly valid for specifying NTP servers; the 'pool' directive is an alternative for a pool of servers but not required, and using 'server' lines does not cause synchronization to fail. Option D is wrong because the service is shown as 'active (running)' via systemctl, so it is currently running regardless of whether it is enabled at boot; the administrator's logout does not stop a running systemd service.

Practice this question →

66

MCQeasy

An administrator is configuring a DHCP server to assign IP addresses to clients in the 192.168.10.0/24 subnet. The server should provide the default gateway as 192.168.10.1 and DNS server as 8.8.8.8. Which option in /etc/dhcp/dhcpd.conf defines the default gateway?

A.option subnet-mask 255.255.255.0;

B.option routers 192.168.10.1;

C.option broadcast-address 192.168.10.255;

D.option domain-name-servers 8.8.8.8;

AnswerB

routers is the DHCP option for default gateway.

Why this answer

The `option routers` directive in the ISC DHCP server configuration file `/etc/dhcp/dhcpd.conf` explicitly defines the default gateway (router) that clients should use. This directive sends the Router Option (option 3) in the DHCPOFFER and DHCPACK messages, instructing clients to set their default route to the specified IP address.

Exam trap

The trap here is that candidates may confuse the `option routers` directive with `option domain-name-servers` or `option subnet-mask`, especially since all three are commonly used together in a subnet declaration, but only `option routers` sets the default gateway.

How to eliminate wrong answers

Option A is wrong because `option subnet-mask 255.255.255.0;` defines the subnet mask (option 1) for the client, not the default gateway. Option C is wrong because `option broadcast-address 192.168.10.255;` sets the broadcast address (option 28) for the subnet, which is a separate parameter from the router. Option D is wrong because `option domain-name-servers 8.8.8.8;` specifies the DNS server (option 6) for name resolution, not the default gateway.

Practice this question →

67

MCQhard

An administrator wants to combine two network interfaces into a single logical interface for redundancy and increased throughput. The system uses NetworkManager. Which method is currently recommended to achieve this?

A.Use ifenslave to enslave interfaces

B.Configure a bond using nmcli

C.Set up a team interface using teamd

D.Edit /proc/net/bonding directly

AnswerB

NetworkManager can manage bonded interfaces using nmcli, making it the recommended method.

Why this answer

NetworkManager is the default network service on modern Linux distributions, and its recommended tool for managing network bonds is `nmcli`. Using `nmcli`, an administrator can create a bond master interface and assign slave interfaces with the `nmcli connection add type bond` and `nmcli connection add type bond-slave` commands, which ensures proper integration with NetworkManager's configuration and state management. This method is preferred over legacy tools like `ifenslave` or `teamd` because it aligns with the current systemd and NetworkManager ecosystem.

Exam trap

The trap here is that candidates may confuse the older `ifenslave` or `teamd` tools with the modern NetworkManager approach, or mistakenly think that `/proc/net/bonding` is writable, when in fact `nmcli` is the correct, supported method for bond configuration on current systems.

How to eliminate wrong answers

Option A is wrong because `ifenslave` is a legacy tool for enslaving interfaces to a bond, but it does not integrate with NetworkManager; its use is deprecated in favor of NetworkManager-native methods. Option C is wrong because `teamd` implements the libteam teaming driver, which is a separate technology from bonding (IEEE 802.3ad/LACP) and is not the recommended method for bonding; teaming is a different approach that is less commonly used and not the default for redundancy/throughput bonding. Option D is wrong because `/proc/net/bonding` is a read-only pseudo-filesystem that reports bond status; it cannot be edited to create or configure bonds, and any changes must be made through proper configuration tools.

Practice this question →

68

MCQhard

A system administrator notices that the system time is slowly drifting from the actual time. The system uses chrony for NTP synchronization. The administrator runs 'chronyc sources' and sees no reachable sources. The firewall is enabled and configured. Which action should the administrator take to resolve the time synchronization issue?

A.Configure chrony to use a different port for NTP.

B.Restart chronyd service.

C.Add a firewall rule to allow UDP 123 outbound to NTP servers.

D.Use ntpdate to set the time manually once.

AnswerC

Opening the correct port allows chrony to communicate with NTP sources.

Why this answer

Chrony uses UDP port 123 for NTP communication. Since the firewall is enabled and configured, and 'chronyc sources' shows no reachable sources, the most likely cause is that outbound NTP traffic is being blocked. Adding a firewall rule to allow UDP 123 outbound to NTP servers will permit chrony to reach its NTP sources and synchronize the system clock, resolving the drift.

Exam trap

The trap here is that candidates may assume restarting the service (Option B) will fix connectivity issues, but the root cause is a firewall blocking UDP 123, which requires a firewall rule change, not a service restart.

How to eliminate wrong answers

Option A is wrong because NTP is standardized on UDP port 123; changing the port would break compatibility with NTP servers and is not a supported configuration in chrony. Option B is wrong because restarting chronyd would not fix the underlying firewall block; the service would still be unable to reach NTP sources. Option D is wrong because ntpdate is a deprecated one-shot synchronization tool that does not address the persistent drift; it also relies on the same UDP 123 port and would fail if the firewall blocks it, and it does not provide ongoing correction.

Practice this question →

69

Multi-Selectmedium

Which THREE of the following are valid files or directories used by the Domain Name System (DNS) resolution process on a Linux system?

Select 3 answers

A./etc/host.conf

B./etc/resolv.conf

C./etc/named.conf

D./etc/sysconfig/network

E./etc/nsswitch.conf

AnswersA, B, E

Specifies resolver options like order and multi.

Why this answer

`/etc/host.conf` controls the order in which hostname resolution methods are tried (e.g., 'order hosts,bind'), directly influencing whether the system queries DNS or checks local files first. This file is part of the glibc resolver's configuration and is consulted during the DNS resolution process on Linux.

Exam trap

The trap here is that candidates confuse server-side DNS configuration files (like `/etc/named.conf`) with client-side resolution files, or they overlook `/etc/host.conf` and `/etc/nsswitch.conf` as essential parts of the DNS resolution chain.

Practice this question →

70

MCQmedium

A system administrator wants to configure NTP client on a server running systemd and using systemd-timesyncd. Which file should be edited to set the NTP server?

A./etc/chrony.conf

B./etc/systemd/timesyncd.conf

C./etc/ntp.conf

D./etc/ntp/ntp.conf

AnswerB

This is the configuration file for systemd-timesyncd, the default NTP client on systemd systems.

Why this answer

On a system using systemd-timesyncd, the NTP server configuration is stored in /etc/systemd/timesyncd.conf. This file is read by the systemd-timesyncd service to determine which NTP servers to synchronize with. Editing this file is the correct method for configuring NTP clients under systemd.

Exam trap

The trap here is that candidates often confuse the configuration files for different NTP implementations (ntpd, chrony, and systemd-timesyncd) and may default to the traditional /etc/ntp.conf without recognizing that systemd-timesyncd uses its own dedicated file.

How to eliminate wrong answers

Option A is wrong because /etc/chrony.conf is the configuration file for chrony, a different NTP implementation, not for systemd-timesyncd. Option C is wrong because /etc/ntp.conf is the configuration file for the traditional ntpd service, not for systemd-timesyncd. Option D is wrong because /etc/ntp/ntp.conf is an alternative path for ntpd configuration (often used on some distributions like FreeBSD), but it is not used by systemd-timesyncd.

Practice this question →

71

MCQeasy

After updating the SSH configuration, a sysadmin restarts the sshd service, but remote connections still use the old settings. Which command should be used to reload the configuration without dropping existing connections?

A.systemctl restart sshd

B.systemctl reload sshd

C.systemctl refresh sshd

D.systemctl restart sshd

AnswerB

Reloads config without dropping connections.

Why this answer

`systemctl reload sshd` sends a SIGHUP signal to the sshd process, instructing it to re-read its configuration file without terminating existing connections. This is the proper method to apply configuration changes while maintaining uninterrupted service for active sessions.

Exam trap

The trap here is that candidates often confuse 'restart' with 'reload', assuming both apply configuration changes, but only 'reload' preserves active connections by using a signal instead of a full process stop/start cycle.

How to eliminate wrong answers

Option A is wrong because `systemctl restart sshd` stops and then starts the service, which drops all existing SSH connections. Option C is wrong because `systemctl refresh sshd` is not a valid systemctl command; systemctl does not have a 'refresh' action. Option D is wrong because it is identical to option A and also drops existing connections by restarting the service.

Practice this question →

72

MCQhard

A security administrator needs to allow SSH access from the 10.0.0.0/8 network but deny all other traffic to port 22. The firewall uses iptables with default policy ACCEPT on the INPUT chain. Which set of rules should be added?

A.iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT

B.iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 22 -j ACCEPT

C.iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT

D.iptables -A INPUT -s 10.0.0.0/8 -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP

AnswerD

Allows subnet first, then drops all other SSH.

Why this answer

Iptables processes rules in order, and the first match determines the action. By placing the ACCEPT rule for the 10.0.0.0/8 source first, traffic from that network is allowed. The subsequent DROP rule for all other traffic to port 22 ensures that any packet not matching the first rule is denied, effectively implementing the required allow-from-specific-source, deny-all-others policy.

Exam trap

The trap here is that candidates often forget that iptables processes rules sequentially and that a default ACCEPT policy requires an explicit DROP rule after the ACCEPT rule to deny other traffic, leading them to choose options that either block the allowed source or fail to deny other sources.

How to eliminate wrong answers

Option A is wrong because it places the DROP rule first, which would drop all SSH traffic (including from 10.0.0.0/8) before the ACCEPT rule is ever reached, effectively blocking all SSH access. Option B is wrong because it drops traffic from 10.0.0.0/8 and then accepts all other traffic, which is the opposite of the required policy. Option C is wrong because it only adds an ACCEPT rule for the 10.0.0.0/8 network, but with a default ACCEPT policy on the INPUT chain, all other traffic to port 22 would still be allowed, failing to deny other sources.

Practice this question →

73

MCQmedium

A company is deploying a new web application and needs to ensure high availability. They have two web servers and want to use DNS round-robin. Which DNS record type is most appropriate?

A.MX

B.PTR

C.CNAME

D.A

AnswerD

Multiple A records enable DNS round-robin.

Why this answer

DNS round-robin distributes traffic across multiple servers by returning multiple A records for a single hostname in a rotating order. An A record maps a hostname to an IPv4 address, so using multiple A records for the same name is the standard method for DNS-based load balancing. This allows each web server to be reached via its own IP address, enabling high availability without additional hardware or software.

Exam trap

The trap here is that candidates may confuse CNAME records with A records, thinking a CNAME can point to multiple servers, but CNAMEs are single-target aliases and cannot provide round-robin distribution.

How to eliminate wrong answers

Option A is wrong because MX records are used for mail exchange routing, specifying mail servers for a domain, not for web server load balancing. Option B is wrong because PTR records perform reverse DNS lookups (IP to hostname), which are irrelevant for distributing web traffic. Option C is wrong because CNAME records create an alias from one hostname to another, but they cannot point to multiple IP addresses or provide round-robin functionality; they only map a name to a single canonical name.

Practice this question →

74

MCQhard

A database server on a Linux system is configured to listen on TCP port 3306. The administrator wants to restrict access to the database server to only the local network (192.168.1.0/24) using iptables. Which of the following iptables rules achieves this?

A.iptables -A INPUT -p tcp --dport 3306 -d 192.168.1.0/24 -j DROP

B.iptables -A OUTPUT -p tcp --dport 3306 -d 192.168.1.0/24 -j ACCEPT

C.iptables -A INPUT -p tcp --dport 3306 -s 192.168.1.0/24 -j ACCEPT

D.iptables -A OUTPUT -p tcp --sport 3306 -s 192.168.1.0/24 -j ACCEPT

AnswerC

Correct rule to allow incoming MySQL from local subnet.

Why this answer

It adds an INPUT chain rule that accepts TCP traffic destined for port 3306 only when the source address is within the 192.168.1.0/24 subnet. This effectively restricts incoming database connections to the local network, while all other sources are implicitly dropped by the default INPUT policy or subsequent rules.

Exam trap

The trap here is confusing the -s (source) and -d (destination) flags, leading candidates to pick Option A which drops traffic to the local network instead of accepting traffic from it.

How to eliminate wrong answers

Option A is wrong because it uses the -d (destination) flag instead of -s (source), and then jumps to DROP, which would block traffic destined for the 192.168.1.0/24 network (i.e., traffic going out to that subnet) rather than restricting incoming connections from it. Option B is wrong because it applies to the OUTPUT chain, which controls outgoing traffic; restricting access to an incoming database server requires an INPUT chain rule, not OUTPUT. Option D is wrong because it uses the OUTPUT chain with --sport 3306 (source port) and -s (source address), which would match outgoing packets originating from port 3306 with a source address in 192.168.1.0/24 — this is irrelevant for controlling incoming connections to the database server.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Essential System Services and Networking questions.

Start 20-question session