LPIC-2 Advanced Networking Configuration Practice Question
A system administrator needs to configure a VPN tunnel using WireGuard. The private key of the local peer is stored in /etc/wireguard/private.key. Which command should be used to set the private key via wg-quick?
⚠ Common exam trap
Watch out — candidates often confuse the `PrivateKey` directive with a file path, similar to how some other tools (like OpenVPN) accept a file reference, but WireGuard requires the literal key value in the configuration file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PrivateKey = $(cat /etc/wireguard/private.key)
The `PrivateKey` directive in a WireGuard configuration file expects the actual private key value, not a file path. Using `$(cat /etc/wireguard/private.key)` performs command substitution to read the key file and insert its contents directly into the configuration, which is the proper method for `wg-quick`.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PostUp = wg set %i private-key /etc/wireguard/private.key
Why it's wrong here
PostUp is for running commands after interface is up, not for setting key directly.
- ✗
PrivateKey = /etc/wireguard/private.key
Why it's wrong here
This would set the private key to the literal string '/etc/wireguard/private.key', not its content.
- ✗
Key = private-key /etc/wireguard/private.key
Why it's wrong here
Invalid syntax; correct directive is PrivateKey.
- ✓
PrivateKey = $(cat /etc/wireguard/private.key)
Why this is correct
Command substitution reads the file and expands to its content.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-2 question from scratch — 507 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-2 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-2 exam.