LFCS Certification Firewall and Packet Filtering 3

Question 1

Which command removes a specific firewalld service from the public zone permanently?

Accepted Answer

firewall-cmd --zone=public --remove-service=http --permanent

Answer

The --remove-service flag is used to remove a service from a firewalld zone, combined with --permanent for persistence.

Question 2

In iptables, which chain processes packets destined for the local system?

Accepted Answer

INPUT

Answer

The INPUT chain handles all packets whose final destination is the local host.

Question 3

What nftables command displays the full current ruleset?

Accepted Answer

nft list ruleset

Answer

'nft list ruleset' outputs the entire active nftables configuration in a human-readable format.

Question 4

Which iptables module allows matching packets based on connection state such as ESTABLISHED or NEW?

Accepted Answer

-m state

Answer

The '-m state' module (or '-m conntrack') allows matching packets based on their connection tracking state.

Question 5

What is the default policy action when a packet does not match any rule in an iptables chain?

Accepted Answer

The chain's default policy is applied

Answer

When no rule matches, iptables applies the chain's default policy, which is typically ACCEPT or DROP.

LFCS Certification Practice Test