Linux Firewall Ruleset Configuration Quiz

1. In firewalld, what is the difference between adding a rule with --permanent and without it?

No difference; both are permanent

Without --permanent, the rule is lost after reboot

With --permanent, rules take effect immediately

Permanent rules only apply to the public zone

2. What is stateful packet inspection in firewall rulesets?

Blocking all packets based on their size

Tracking connection states and allowing related reply packets

Inspecting every byte of every packet

Rejecting packets with invalid headers

3. Which command saves iptables rules so they persist after a system reboot?

Iptables-save > /etc/iptables/rules.v4

Iptables --save

Iptables -P SAVE

Iptables --persist

4. Which iptables target sends an ICMP error message back to the sender?

DROP

REJECT

DENY

BLOCK

5. What is port forwarding in the context of Linux firewall rules?

Redirecting traffic from one port to another on the same machine

Blocking all traffic to a specific port

Logging all packets to a port

Encrypting traffic on a specific port

6. In iptables, what does the -i flag specify?

Input protocol type

Incoming network interface

Internal chain name

IP version (IPv4 or IPv6)

7. Which iptables rule would block all traffic from a specific IP address 192.168.1.100?

Iptables -A INPUT -s 192.168.1.100 -j ACCEPT

Iptables -A INPUT -s 192.168.1.100 -j DROP

Iptables -A OUTPUT -d 192.168.1.100 -j DROP

Iptables -A FORWARD -s 192.168.1.100 -j REJECT

8. Which command displays all current iptables rules with line numbers in the INPUT chain?

Iptables -L INPUT -n -v

Iptables -L INPUT --line-numbers

Iptables -S INPUT -n

Iptables -P INPUT -v

9. What is the purpose of the PREROUTING chain in the nat table?

Modify packets leaving the system

Modify destination addresses before routing

Filter incoming traffic

Log all packets

10. Which iptables chain processes packets destined for the local machine?

INPUT

OUTPUT

FORWARD

PREROUTING

11. In firewalld, which command adds a service to the current zone permanently?

Firewall-cmd --add-service=http

Firewall-cmd --add-service=http --permanent

Firewall-cmd --enable-service=http

Firewall-cmd --zone=public --add-service=http

12. Which iptables table is used for Network Address Translation (NAT)?

Filter

Nat

Mangle

Raw

13. To allow SSH access (port 22) from anywhere, which iptables rule is correct?

Iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT

Iptables -A FORWARD -p tcp --dport 22 -j ACCEPT

Iptables -A INPUT -p udp --dport 22 -j ACCEPT

14. What is the default policy for the FORWARD chain in most Linux firewall configurations?

ACCEPT

DROP

REJECT

QUEUE

15. Which command resets all iptables rules to default policies?

Iptables -F

Iptables -X

Iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F

Iptables --reset

16. What does SNAT (Source NAT) accomplish in a firewall ruleset?

Changes the source IP of outgoing packets

Changes the destination IP of incoming packets

Blocks all source addresses

Logs all source IP addresses

17. What does the -m state --state ESTABLISHED,RELATED match do in iptables?

Blocks all established connections

Allows replies to outgoing connections

Drops new incoming connections

Logs all connection states

18. Which firewalld command lists all available services?

Firewall-cmd --list-services

Firewall-cmd --get-services

Firewall-cmd --show-services

Firewall-cmd --view-services

19. In firewalld, what is the default zone applied to interfaces without explicit zone assignment?

Public

Internal

External

Dmz

20. Which firewalld zone provides the least restrictive security policy?