RHCSA RHCSA Firewalld and Network Configuration 5 — Questions and Answers
Question 1: Which directory contains firewalld's default (read-only) service definition files?
- /etc/firewalld/services/
- /usr/lib/firewalld/services/ (Correct answer)
- /var/lib/firewalld/services/
- /run/firewalld/services/
Correct answer: /usr/lib/firewalld/services/
/usr/lib/firewalld/services/ holds the system-provided XML service definitions installed by the package.
Question 2: To add a secondary IP address 172.16.0.5/16 to an existing connection 'ens3' without removing the current IP, which nmcli command is used?
- nmcli con mod ens3 +ipv4.addresses 172.16.0.5/16 (Correct answer)
- nmcli con mod ens3 ipv4.addresses +172.16.0.5/16
- nmcli con add ens3 ipv4.addresses 172.16.0.5/16
- nmcli dev mod ens3 +ipv4.addresses 172.16.0.5/16
Correct answer: nmcli con mod ens3 +ipv4.addresses 172.16.0.5/16
Prepending '+' to a property name in nmcli appends to the list rather than replacing it.
Question 3: Which command displays the active zone assignment for all network interfaces?
- firewall-cmd --get-active-zones (Correct answer)
- firewall-cmd --list-interfaces
- firewall-cmd --zone --list-all
- firewall-cmd --active --show
Correct answer: firewall-cmd --get-active-zones
--get-active-zones lists every active zone along with the interfaces or sources currently assigned to it.
Question 4: A port-forwarding rule should redirect traffic arriving on port 80 to port 8080 on the same machine. Which rich rule syntax is correct?
- firewall-cmd --add-forward-port=port=80:proto=tcp:toport=8080 --permanent (Correct answer)
- firewall-cmd --add-rich-rule='rule forward-port port=80 protocol=tcp to-port=8080' --permanent
- firewall-cmd --forward=80:8080/tcp --permanent
- firewall-cmd --add-masquerade --port=80 --toport=8080 --permanent
Correct answer: firewall-cmd --add-forward-port=port=80:proto=tcp:toport=8080 --permanent
--add-forward-port uses the colon-delimited syntax port=:proto=:toport= to define local port forwarding.
Question 5: Which command enables IP masquerading on the 'external' zone permanently?
- firewall-cmd --zone=external --add-masquerade --permanent (Correct answer)
- firewall-cmd --zone=external --enable-masquerade --permanent
- firewall-cmd --zone=external --nat=masquerade --permanent
- firewall-cmd --zone=external --masquerade=yes --permanent
Correct answer: firewall-cmd --zone=external --add-masquerade --permanent
--add-masquerade enables NAT masquerading in the specified zone so outgoing packets use the interface's IP.
Question 6: What does setting 'ipv4.method manual' in NetworkManager mean?
- The connection requires manual activation each boot
- The IP address is assigned statically without DHCP (Correct answer)
- IPv4 is disabled on that interface
- The route metric must be set manually
Correct answer: The IP address is assigned statically without DHCP
Setting ipv4.method to 'manual' tells NetworkManager to use the static address defined in ipv4.addresses instead of DHCP.
Question 7: Which command tests whether the 'ssh' service is permanently enabled in the 'public' zone?
- firewall-cmd --zone=public --query-service=ssh --permanent (Correct answer)
- firewall-cmd --zone=public --list-services --permanent
- firewall-cmd --permanent --zone=public --check-service=ssh
- firewall-cmd --zone=public --verify-service=ssh --permanent
Correct answer: firewall-cmd --zone=public --query-service=ssh --permanent
--query-service combined with --permanent checks the on-disk (permanent) configuration rather than the live runtime.
RHCSA RHCSA Firewalld and Network Configuration 5
Which directory contains firewalld's default (read-only) service definition files?