LFCS Firewall and Packet Filtering Questions and Answers

Question 1

A system administrator needs to allow HTTP traffic to a web server. Which of the following `firewall-cmd` commands correctly opens the standard HTTP port in the `public` zone and ensures the rule persists after a system reboot?

Accepted Answer

firewall-cmd --permanent --zone=public --add-service=http

Answer

The command `firewall-cmd --permanent --zone=public --add-service=http` correctly adds the 'http' service (which corresponds to TCP port 80) to the permanent configuration of the 'public' zone. The `--permanent` flag is crucial for ensuring the rule is saved and reapplied after a reboot or firewall reload. The other options are incorrect because they either only affect the runtime configuration, use incorrect syntax, or misuse the flags.

Question 2

What is the primary function of the `firewall-cmd --reload` command?

Accepted Answer

It applies the permanent configuration to the runtime environment without dropping existing connections.

Answer

The `firewall-cmd --reload` command reads the permanent configuration files and applies them as the new runtime configuration. A key feature of `--reload` is that it does this without interrupting or dropping existing connections, making it the preferred way to apply saved changes on a live system. Restarting the service drops connections, and `--runtime-to-permanent` saves the current state.

Question 3

An administrator wants to enhance security by allowing SSH access (port 22) ONLY from the internal administrative subnet `192.168.50.0/24`. Which of the following `firewall-cmd` commands correctly implements this using a rich rule?

Accepted Answer

firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.50.0/24" service name="ssh" accept'

Answer

The correct syntax for adding a rich rule involves the `--add-rich-rule` option with the rule enclosed in single quotes. The rule must specify the address family (`ipv4`), the `source address` with its subnet mask, the `service name`, and the action (`accept`). The other options use incorrect syntax, such as `--add-rule`, or an incomplete/improperly formatted rich rule string.

Question 4

In the context of `firewalld`, what is the primary purpose of a 'zone'?

Accepted Answer

To group rules into predefined sets based on the level of trust for a network connection or interface.

Answer

Zones are the core concept in firewalld for managing rules. They represent a level of trust for a network. A network interface (like `eth0`) or a source IP address range is assigned to a zone, and that zone's rules (e.g., what services or ports are open) are applied to the traffic. This allows for easily switching between different security policies, for instance, a more restrictive 'public' zone and a more permissive 'internal' zone.

Question 5

A sysadmin adds a temporary rule to allow traffic on port 5000/tcp using `firewall-cmd --add-port=5000/tcp`. They do not use the `--permanent` flag. What happens to this rule if the `firewalld` service is restarted?

Accepted Answer

The rule is removed from the runtime configuration and is no longer active.

Answer

Changes made to the firewalld configuration without the `--permanent` flag only apply to the current runtime environment. When the `firewalld` service is restarted or reloaded, it discards the current runtime configuration and loads the saved rules from the permanent configuration. Since the rule for port 5000/tcp was never saved to the permanent configuration, it is lost.

LFCS Certification Practice Test

LFCS Certification Practice Test

LFCS Firewall and Packet Filtering Questions and Answers