LFCS Certification Firewall and Packet Filtering 2 — Questions and Answers
Question 1: Which iptables table is used for Network Address Translation (NAT)?
- filter
- mangle
- nat (Correct answer)
- raw
Correct answer: nat
The 'nat' table is specifically designed for NAT operations including SNAT, DNAT, and MASQUERADE.
Question 2: What iptables command lists all rules in the filter table with line numbers?
- iptables -L --line-numbers
- iptables -S -n
- iptables -L -v --line-numbers (Correct answer)
- iptables --list -n --line-numbers
Correct answer: iptables -L -v --line-numbers
The '-L -v --line-numbers' flags list all rules verbosely with line numbers for easy reference and deletion.
Question 3: Which firewalld zone is most appropriate for a network interface connected to the public internet?
- trusted
- home
- public (Correct answer)
- dmz
Correct answer: public
The 'public' zone assumes the network is untrusted and only allows selected incoming connections.
Question 4: How do you make firewalld rule changes permanent so they survive a reboot?
- firewall-cmd --save
- firewall-cmd --reload
- firewall-cmd --permanent followed by --reload (Correct answer)
- systemctl save firewalld
Correct answer: firewall-cmd --permanent followed by --reload
The --permanent flag writes rules to disk, and --reload applies them to the running configuration.
Question 5: In nftables, what command adds a new table named 'mytable' with the inet family?
- nft create table inet mytable
- nft add table inet mytable (Correct answer)
- nft new table inet mytable
- nft insert table inet mytable
Correct answer: nft add table inet mytable
The 'nft add table' command creates a new nftables table with the specified address family.
Question 6: Which iptables target silently discards a packet without sending any response to the sender?
- REJECT
- DROP (Correct answer)
- DENY
- NULL
Correct answer: DROP
DROP silently discards the packet, while REJECT sends an ICMP error message back to the sender.
Question 7: What does the iptables MASQUERADE target do?
- Hides the destination IP address
- Replaces the source IP with the outgoing interface's IP dynamically (Correct answer)
- Blocks packets from specific MAC addresses
- Logs packets without modifying them
Correct answer: Replaces the source IP with the outgoing interface's IP dynamically
MASQUERADE automatically substitutes the source IP with the current IP of the outgoing interface, ideal for dynamic IPs.
LFCS Certification Firewall and Packet Filtering 2
Which iptables table is used for Network Address Translation (NAT)?