LFCS Certification Firewall and Packet Filtering 4 — Questions and Answers
Question 1: Which file is commonly used to persist iptables rules on RHEL/CentOS systems?
- /etc/iptables.conf
- /etc/sysconfig/iptables (Correct answer)
- /etc/firewall/iptables.rules
- /var/lib/iptables/rules
Correct answer: /etc/sysconfig/iptables
On RHEL/CentOS systems, iptables rules are saved to /etc/sysconfig/iptables and loaded at boot by the iptables service.
Question 2: What does the iptables '-j RETURN' target do when used inside a user-defined chain?
- Drops the packet immediately
- Stops processing and returns to the calling chain (Correct answer)
- Accepts the packet unconditionally
- Logs the packet and continues processing
Correct answer: Stops processing and returns to the calling chain
RETURN causes the packet to stop traversing the current chain and resume processing in the calling (parent) chain.
Question 3: Which firewalld feature allows grouping multiple IP addresses or ranges for use in rules?
- firewalld sets
- IP groups
- ipsets (Correct answer)
- address pools
Correct answer: ipsets
Firewalld supports ipsets, which allow efficient matching against large sets of IP addresses or networks.
Question 4: In nftables, what keyword is used to specify the hook and priority when creating a chain?
- attach
- type ... hook ... priority (Correct answer)
- bind ... at ... order
- chain-type ... position
Correct answer: type ... hook ... priority
An nftables base chain is defined with 'type <type> hook <hookname> priority <value>' to attach it to the netfilter framework.
Question 5: What iptables command saves current rules to a file for later restoration?
- iptables --save > file
- iptables-save > file (Correct answer)
- iptables -S > file
- service iptables save file
Correct answer: iptables-save > file
The 'iptables-save' command outputs all current iptables rules in a format suitable for restoration with iptables-restore.
Question 6: Which iptables module is used to match packets based on the incoming network interface?
- -m interface --in-iface
- Built-in flag -i (Correct answer)
- -m physdev --iface
- -m ifmatch --in
Correct answer: Built-in flag -i
The built-in '-i' flag (--in-interface) matches packets arriving on a specific network interface without needing an extra module.
Question 7: What happens when you run 'firewall-cmd --reload'?
- Restarts the firewalld service and loses runtime rules
- Applies permanent rules to the runtime configuration without losing other runtime changes (Correct answer)
- Reboots the system firewall subsystem
- Resets all zones to their default settings
Correct answer: Applies permanent rules to the runtime configuration without losing other runtime changes
A --reload applies the permanent configuration to the runtime, but any runtime-only changes not saved permanently will be lost.
LFCS Certification Firewall and Packet Filtering 4
Which file is commonly used to persist iptables rules on RHEL/CentOS systems?