LFCS Certification Firewall and Packet Filtering 5 — Questions and Answers
Question 1: Which iptables option is used to insert a rule at a specific position in a chain rather than appending it?
- -A
- -I (Correct answer)
- -P
- -R
Correct answer: -I
The '-I' (--insert) option inserts a rule at a specified position, while '-A' always appends to the end of the chain.
Question 2: In firewalld, which command lists all active zones along with their associated interfaces?
- firewall-cmd --get-zones
- firewall-cmd --list-zones
- firewall-cmd --get-active-zones (Correct answer)
- firewall-cmd --show-zones --active
Correct answer: firewall-cmd --get-active-zones
The --get-active-zones option shows only zones that have interfaces or sources assigned, along with those assignments.
Question 3: Which nftables verdict terminates packet processing and accepts the packet?
- pass
- accept (Correct answer)
- allow
- permit
Correct answer: accept
In nftables, 'accept' is the terminal verdict that allows the packet to continue through the network stack.
Question 4: What kernel parameter must be set to '1' to enable IPv4 packet forwarding for firewall/routing use?
- net.ipv4.ip_forward (Correct answer)
- net.ipv4.conf.all.forwarding
- kernel.ipv4.forward
- net.core.ip_forward
Correct answer: net.ipv4.ip_forward
Setting net.ipv4.ip_forward=1 via sysctl enables the kernel to forward packets between network interfaces.
Question 5: Which iptables module allows rate limiting connections to prevent brute-force attacks?
- -m ratelimit
- -m limit (Correct answer)
- -m hashlimit
- -m connlimit
Correct answer: -m limit
The '-m limit' module throttles rule matching to a maximum rate, commonly used to limit log entries or new connection attempts.
Question 6: In firewalld rich rules, which action blocks traffic and sends an ICMP rejection message?
- action='drop'
- action='block'
- action='reject' (Correct answer)
- action='deny'
Correct answer: action='reject'
The 'reject' action in a firewalld rich rule drops the packet and sends an ICMP error back to the source.
Question 7: What is the purpose of the iptables PREROUTING chain in the nat table?
- To filter packets before they are routed
- To modify packets after they leave the system
- To alter packet destination addresses before the routing decision (Correct answer)
- To log all incoming packets for auditing
Correct answer: To alter packet destination addresses before the routing decision
PREROUTING in the nat table runs before routing, making it the correct place to perform DNAT and change a packet's destination.
LFCS Certification Firewall and Packet Filtering 5
Which iptables option is used to insert a rule at a specific position in a chain rather than appending it?