LFCS Firewall and Packet Filtering Questions and Answers

Question 1

A system administrator needs to allow HTTP traffic to a web server.
Which of the following `firewall-cmd` commands correctly opens the standard HTTP port in the `public` zone and ensures the rule persists after a system reboot?

Accepted Answer

firewall-cmd --permanent --zone=public --add-service=http

Answer

firewall-cmd --zone=public --add-port=80/tcp

Answer

firewall-cmd --reload --add-service=http

Answer

firewall-cmd --add-service=http --runtime-to-permanent

Question 2

What is the primary function of the `firewall-cmd --reload` command?

Accepted Answer

It applies the permanent configuration to the runtime environment without dropping existing connections.

Answer

It restarts the entire firewalld service, dropping all active connections.

Answer

It saves the current runtime rules to the permanent configuration.

Answer

It lists all the rules in the permanent configuration without applying them.

Question 3

An administrator wants to enhance security by allowing SSH access (port 22) ONLY from the internal administrative subnet `192.168.50.0/24`. Which of the following `firewall-cmd` commands correctly implements this using a rich rule?

Accepted Answer

firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.50.0/24" service name="ssh" accept'

Answer

firewall-cmd --permanent --zone=public --add-source=192.168.50.0/24 --add-service=ssh

Answer

firewall-cmd --permanent --zone=public --add-rich-rule='rule service name="ssh" source-address="192.168.50.0/24" accept'

Answer

firewall-cmd --permanent --zone=public --add-rule='family=ipv4 source=192.168.50.0/24 service=ssh accept'

Question 4

In the context of `firewalld`, what is the primary purpose of a 'zone'?

Accepted Answer

To group rules into predefined sets based on the level of trust for a network connection or interface.

Answer

To define a specific hardware network interface card (NIC) on the system.

Answer

To create a log file for a specific set of rules.

Answer

To schedule when specific firewall rules should be active.

Question 5

A sysadmin adds a temporary rule to allow traffic on port 5000/tcp using `firewall-cmd --add-port=5000/tcp`. They do not use the `--permanent` flag. What happens to this rule if the `firewalld` service is restarted?

Accepted Answer

The rule is removed from the runtime configuration and is no longer active.

Answer

The rule is automatically saved to the permanent configuration and remains active.

Answer

The rule remains active in the runtime configuration but is not saved permanently.

Answer

The system prompts the administrator to save the rule before restarting.

Question 6

Which of the following best describes the fundamental operation of a packet filtering firewall?

Accepted Answer

It examines the header information of a packet, such as source/destination IP and port, against a set of rules.

Answer

It inspects the data payload of each packet for malicious code before allowing it to pass.

Answer

It analyzes application-level data to understand the context of a conversation between two hosts.

Answer

It authenticates the user sending the packet before allowing it through the network.

A system administrator needs to allow HTTP traffic to a web server.Which of the following `firewall-cmd` commands correctly opens the standard HTTP port in the `public` zone and ensures the rule persists after a system reboot?

A system administrator needs to allow HTTP traffic to a web server.
Which of the following `firewall-cmd` commands correctly opens the standard HTTP port in the `public` zone and ensures the rule persists after a system reboot?