RHCSA RHCSA Firewalld and Network Configuration 5

Question 1

Which directory contains firewalld's default (read-only) service definition files?

Accepted Answer

/usr/lib/firewalld/services/

Answer

/usr/lib/firewalld/services/ holds the system-provided XML service definitions installed by the package.

Question 2

To add a secondary IP address 172.16.0.5/16 to an existing connection 'ens3' without removing the current IP, which nmcli command is used?

Accepted Answer

nmcli con mod ens3 +ipv4.addresses 172.16.0.5/16

Answer

Prepending '+' to a property name in nmcli appends to the list rather than replacing it.

Question 3

Which command displays the active zone assignment for all network interfaces?

Accepted Answer

firewall-cmd --get-active-zones

Answer

--get-active-zones lists every active zone along with the interfaces or sources currently assigned to it.

Question 4

A port-forwarding rule should redirect traffic arriving on port 80 to port 8080 on the same machine. Which rich rule syntax is correct?

Accepted Answer

firewall-cmd --add-forward-port=port=80:proto=tcp:toport=8080 --permanent

Answer

--add-forward-port uses the colon-delimited syntax port=:proto=:toport= to define local port forwarding.

Question 5

Which command enables IP masquerading on the 'external' zone permanently?

Accepted Answer

firewall-cmd --zone=external --add-masquerade --permanent

Answer

--add-masquerade enables NAT masquerading in the specified zone so outgoing packets use the interface's IP.

RHCSA Exam Practice Test