Linux Firewall and Network Security 3

Question 1

Which tool is the recommended modern replacement for iptables on systems using nftables as the backend?

Accepted Answer

iptables-nft

Answer

iptables-nft is a compatibility layer that translates iptables syntax to nftables rules, bridging the two frameworks.

Question 2

What does the 'INVALID' connection state mean in iptables stateful filtering?

Accepted Answer

The packet doesn't match any known connection or is malformed

Answer

INVALID means the packet cannot be associated with any tracked connection and may indicate a scan or attack.

Question 3

In firewalld, which command lists all available predefined services that can be added to a zone?

Accepted Answer

firewall-cmd --get-services

Answer

'--get-services' lists all predefined service names available in firewalld's service directory.

Question 4

Which iptables module allows you to match packets based on the time of day or day of the week?

Accepted Answer

-m time

Answer

The 'time' match module lets you apply rules based on time ranges, dates, and days of the week.

Question 5

What does 'ip6tables' manage compared to 'iptables'?

Accepted Answer

IPv6 packet filtering rules

Answer

ip6tables is the IPv6-specific counterpart to iptables and manages netfilter rules for IPv6 traffic.

Linux Practice Test