RHCSA RHCSA Firewalld and Network Configuration 3 — Questions and Answers
Question 1: Which command shows all available firewalld zones?
- firewall-cmd --get-zones (Correct answer)
- firewall-cmd --list-zones
- firewall-cmd --show-zones
- firewall-cmd --query-zones
Correct answer: firewall-cmd --get-zones
--get-zones prints a space-separated list of all zones defined on the system.
Question 2: A developer needs traffic from 10.0.0.0/8 to always be treated as 'trusted'. What is the best approach?
- firewall-cmd --zone=trusted --add-source=10.0.0.0/8 --permanent (Correct answer)
- firewall-cmd --zone=internal --add-source=10.0.0.0/8 --permanent
- firewall-cmd --add-rich-rule='family=ipv4 source address=10.0.0.0/8 accept' --permanent
- firewall-cmd --trusted=10.0.0.0/8 --permanent
Correct answer: firewall-cmd --zone=trusted --add-source=10.0.0.0/8 --permanent
Adding a source CIDR to the trusted zone routes all packets from that network through the trusted zone policy.
Question 3: Which nmcli property sets the DNS server for a connection?
- ipv4.dns (Correct answer)
- ipv4.nameserver
- ipv4.dns-server
- network.dns
Correct answer: ipv4.dns
The ipv4.dns property in NetworkManager holds one or more DNS server addresses for a connection.
Question 4: What does 'firewall-cmd --zone=public --query-service=https' return?
- The HTTPS port number assigned to the public zone
- yes or no indicating if the https service is currently enabled in the public zone (Correct answer)
- The full rule definition for HTTPS traffic
- An error if HTTPS is not enabled
Correct answer: yes or no indicating if the https service is currently enabled in the public zone
--query-service returns 'yes' if the service is active in the zone at runtime, 'no' otherwise.
Question 5: To configure NetworkManager to use a connection only for specific traffic and not set it as the default route, which setting is used?
- ipv4.route-metric 0
- ipv4.never-default yes (Correct answer)
- connection.autoconnect no
- ipv4.ignore-auto-routes yes
Correct answer: ipv4.never-default yes
Setting ipv4.never-default to yes prevents NetworkManager from using that connection as the default gateway.
Question 6: Which command removes the 'ftp' service from the 'public' zone permanently?
- firewall-cmd --zone=public --remove-service=ftp --permanent (Correct answer)
- firewall-cmd --zone=public --delete-service=ftp --permanent
- firewall-cmd --zone=public --disable-service=ftp --permanent
- firewall-cmd --zone=public --add-service=ftp --remove --permanent
Correct answer: firewall-cmd --zone=public --remove-service=ftp --permanent
--remove-service removes a predefined service from the specified zone when combined with --permanent.
Question 7: What is the purpose of 'firewall-cmd --runtime-to-permanent'?
- Copies all current runtime rules to the permanent configuration (Correct answer)
- Reloads permanent rules into the runtime environment
- Exports rules to a backup file
- Converts service definitions to port rules
Correct answer: Copies all current runtime rules to the permanent configuration
--runtime-to-permanent saves everything currently active at runtime into the permanent on-disk configuration.
RHCSA RHCSA Firewalld and Network Configuration 3
Which command shows all available firewalld zones?