RHCSA Firewalld and Network Configuration Flashcards

Which directory contains firewalld's default (read-only) service definition files?

Answer: /usr/lib/firewalld/services/

/usr/lib/firewalld/services/ holds the system-provided XML service definitions installed by the package.

To add a secondary IP address 172.16.0.5/16 to an existing connection 'ens3' without removing the current IP, which nmcli command is used?

Answer: nmcli con mod ens3 +ipv4.addresses 172.16.0.5/16

Prepending '+' to a property name in nmcli appends to the list rather than replacing it.

Which command displays the active zone assignment for all network interfaces?

Answer: firewall-cmd --get-active-zones

--get-active-zones lists every active zone along with the interfaces or sources currently assigned to it.

A port-forwarding rule should redirect traffic arriving on port 80 to port 8080 on the same machine. Which rich rule syntax is correct?

Answer: firewall-cmd --add-forward-port=port=80:proto=tcp:toport=8080 --permanent

--add-forward-port uses the colon-delimited syntax port=:proto=:toport= to define local port forwarding.

Which command enables IP masquerading on the 'external' zone permanently?

Answer: firewall-cmd --zone=external --add-masquerade --permanent

--add-masquerade enables NAT masquerading in the specified zone so outgoing packets use the interface's IP.

What does setting 'ipv4.method manual' in NetworkManager mean?

Answer: The IP address is assigned statically without DHCP

Setting ipv4.method to 'manual' tells NetworkManager to use the static address defined in ipv4.addresses instead of DHCP.

Which command tests whether the 'ssh' service is permanently enabled in the 'public' zone?

Answer: firewall-cmd --zone=public --query-service=ssh --permanent

--query-service combined with --permanent checks the on-disk (permanent) configuration rather than the live runtime.