RHCSA Firewalld and Network Configuration Questions and Answers

Question 1

A system administrator adds a new firewalld rule to allow HTTP traffic using `firewall-cmd --zone=public --add-service=http`.
After a system reboot, they discover that HTTP traffic is no longer allowed.
What is the correct procedure to ensure the rule persists across reboots?

Accepted Answer

Add the `--permanent` flag to the command and then run `firewall-cmd --reload`.

Answer

Use the `firewall-cmd --runtime-to-permanent` command after adding the rule.

Answer

Run `systemctl restart firewalld` immediately after adding the rule.

Answer

The rule should be added to `/etc/sysconfig/firewalld.conf` directly.

Question 2

A server has two network interfaces, `eno1` connected to an internal network and `eno2` connected to the public internet. The administrator wants to assign `eno1` to the 'internal' firewalld zone and `eno2` to the 'public' zone. Which of the following commands will correctly and persistently assign the interfaces to their respective zones?

Accepted Answer

nmcli con modify eno1 connection.zone internal && nmcli con modify eno2 connection.zone public

Answer

firewall-cmd --zone=internal --add-interface=eno1 && firewall-cmd --zone=public --add-interface=eno2

Answer

firewall-cmd --permanent --change-interface=eno1 --zone=internal && firewall-cmd --permanent --change-interface=eno2 --zone=public

Answer

firewall-cmd --permanent --zone=internal --change-interface=eno1 && firewall-cmd --permanent --zone=public --change-interface=eno2

Question 3

Which of the following `nmcli` commands correctly configures a static IPv4 address, gateway, and DNS server for a connection named 'eth0'?

Accepted Answer

nmcli con mod eth0 ipv4.addresses 192.168.1.100/24 ipv4.gateway 192.168.1.1 ipv4.dns 8.8.8.8 ipv4.method manual

Answer

nmcli con mod eth0 set ipv4.address 192.168.1.100/24 gw4 192.168.1.1 dns 8.8.8.8

Answer

nmcli device mod eth0 ipv4.addresses 192.168.1.100/24 ipv4.gateway 192.168.1.1 ipv4.dns 8.8.8.8 ipv4.method static

Answer

nmcli con add con-name eth0 type ethernet ifname eth0 ip4 192.168.1.100/24 gw4 192.168.1.1

Question 4

What is the primary function of the 'default zone' in firewalld?

Accepted Answer

It is the zone assigned to any network interface that is not explicitly assigned to a different zone.

Answer

It is the zone that contains the most restrictive set of rules.

Answer

It is the only zone that is active after a fresh installation.

Answer

It applies to any network traffic that does not explicitly match a rule in another active zone.

Question 5

A system administrator needs to allow access to a web server from a specific subnet (10.10.50.0/24) but deny it from all other sources. Which firewalld command will achieve this most effectively?

Accepted Answer

firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.10.50.0/24" service name="http" accept'

Answer

firewall-cmd --permanent --zone=public --add-source=10.10.50.0/24 --add-service=http

Answer

firewall-cmd --permanent --add-service=http && firewall-cmd --permanent --add-source=10.10.50.0/24

Answer

firewall-cmd --permanent --zone=public --add-port=80/tcp --source=10.10.50.0/24

Question 6

After making several changes to the permanent firewalld configuration, a sysadmin wants to activate them. What is the key difference between running `firewall-cmd --reload` and `systemctl restart firewalld`?

Accepted Answer

`--reload` keeps existing stateful connections alive, while `restart` drops all active connections.

Answer

`--reload` only applies new rules, while `restart` applies new rules and removes old ones.

Answer

`--reload` applies both runtime and permanent rules, while `restart` only applies permanent rules.

Answer

There is no functional difference; both commands achieve the same outcome.