Linux Firewall and Network Security 5

Question 1

Which iptables target sends a TCP RST packet back to the sender instead of silently dropping?

Accepted Answer

REJECT --reject-with tcp-reset

Answer

REJECT with '--reject-with tcp-reset' sends a TCP RST, causing the sender to see a closed port rather than a timeout.

Question 2

What does the 'hashlimit' iptables module do differently compared to the 'limit' module?

Accepted Answer

It applies rate limits per source IP, destination, or port combination

Answer

hashlimit allows per-source-IP (or per-connection) rate limiting, unlike 'limit' which applies a single global rate.

Question 3

In nftables, what keyword is used to create a stateful firewall rule accepting established and related traffic?

Accepted Answer

ct state { established, related } accept

Answer

nftables uses 'ct state' (connection tracking state) with set notation to match multiple states in one expression.

Question 4

Which file defines the default firewalld zone for network interfaces not explicitly assigned to a zone?

Accepted Answer

/etc/firewalld/firewalld.conf

Answer

The DefaultZone setting in /etc/firewalld/firewalld.conf determines which zone is applied to interfaces without an explicit zone assignment.

Question 5

What iptables rule would block all outbound SMTP traffic from a Linux server on port 25?

Accepted Answer

iptables -A OUTPUT -p tcp --dport 25 -j DROP

Answer

To block locally-initiated outbound connections on port 25, add a DROP rule to the OUTPUT chain matching destination port 25.

Linux Practice Test