LFCS Certification Firewall and Packet Filtering 3 — Questions and Answers
Question 1: Which command removes a specific firewalld service from the public zone permanently?
- firewall-cmd --zone=public --delete-service=http --permanent
- firewall-cmd --zone=public --remove-service=http --permanent (Correct answer)
- firewall-cmd --public --remove http --permanent
- firewall-cmd --zone=public --disable-service=http --permanent
Correct answer: firewall-cmd --zone=public --remove-service=http --permanent
The --remove-service flag is used to remove a service from a firewalld zone, combined with --permanent for persistence.
Question 2: In iptables, which chain processes packets destined for the local system?
- FORWARD
- OUTPUT
- INPUT (Correct answer)
- PREROUTING
Correct answer: INPUT
The INPUT chain handles all packets whose final destination is the local host.
Question 3: What nftables command displays the full current ruleset?
- nft show ruleset
- nft list ruleset (Correct answer)
- nft display rules
- nft get all
Correct answer: nft list ruleset
'nft list ruleset' outputs the entire active nftables configuration in a human-readable format.
Question 4: Which iptables module allows matching packets based on connection state such as ESTABLISHED or NEW?
- -m state (Correct answer)
- -m conntrack
- -m track
- -m connection
Correct answer: -m state
The '-m state' module (or '-m conntrack') allows matching packets based on their connection tracking state.
Question 5: What is the default policy action when a packet does not match any rule in an iptables chain?
- LOG
- ACCEPT
- The chain's default policy is applied (Correct answer)
- RETURN
Correct answer: The chain's default policy is applied
When no rule matches, iptables applies the chain's default policy, which is typically ACCEPT or DROP.
Question 6: Which command checks whether a specific port is allowed through firewalld in the public zone?
- firewall-cmd --zone=public --query-port=22/tcp (Correct answer)
- firewall-cmd --zone=public --check-port=22/tcp
- firewall-cmd --zone=public --list-port=22/tcp
- firewall-cmd --query --port=22/tcp --zone=public
Correct answer: firewall-cmd --zone=public --query-port=22/tcp
The --query-port flag returns whether a specific port/protocol is permitted in the specified zone.
Question 7: In iptables, which table and chain combination is used to implement port forwarding (DNAT)?
- filter:FORWARD
- nat:PREROUTING (Correct answer)
- mangle:INPUT
- nat:OUTPUT
Correct answer: nat:PREROUTING
DNAT rules in the nat table's PREROUTING chain rewrite the destination IP/port before routing decisions are made.
LFCS Certification Firewall and Packet Filtering 3
Which command removes a specific firewalld service from the public zone permanently?