Linux Firewall and Network Security 4

Question 1

Which nftables hook corresponds to locally generated outbound traffic on a Linux host?

Accepted Answer

output

Answer

The 'output' hook in nftables processes packets generated by local processes before they leave the network interface.

Question 2

What firewall technique does 'iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE' implement?

Accepted Answer

IP masquerading (source NAT)

Answer

MASQUERADE is a form of SNAT that dynamically replaces the source IP with the outbound interface's IP, used for internet sharing.

Question 3

Which iptables module limits the rate of log messages to prevent log flooding?

Accepted Answer

-m limit

Answer

The 'limit' module restricts how frequently a rule matches, commonly paired with LOG to prevent syslog from being overwhelmed.

Question 4

In SELinux, what does the 'enforcing' mode do to policy violations?

Accepted Answer

Blocks and logs violations

Answer

Enforcing mode actively blocks actions that violate SELinux policy and records denials in the audit log.

Question 5

Which command adds a rich rule in firewalld to block all traffic from the IP 192.168.1.100?

Accepted Answer

firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.168.1.100 drop'

Answer

firewalld rich rules use the '--add-rich-rule' flag with a structured rule string to allow complex matching conditions.

Linux Practice Test