Firewalls XK0-006 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of UFW (Uncomplicated Firewall)?

   • ATo monitor network traffic and generate reports
   • BTo replace iptables with a completely new firewall engine
   • CTo provide a simplified interface for managing iptables rules
   • DTo provide a graphical user interface for firewall configuration
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which iptables command appends a rule to the INPUT chain that drops all incoming TCP packets destined for port 23?

   • Aiptables -I INPUT -p tcp --sport 23 -j DROP
   • Biptables -A OUTPUT -p tcp --dport 23 -j DROP
   • Ciptables -D INPUT -p tcp --dport 23 -j DROP
   • Diptables -A INPUT -p tcp --dport 23 -j DROP
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary benefit of zone-based firewall rules?

   • AThey automatically block all traffic between zones.
   • BThey eliminate the need for packet filtering.
   • CThey only work with IPv6 traffic.
   • DThey allow grouping interfaces into security zones with distinct policies.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An administrator needs to allow inbound traffic on port 443 from any source, but the server also has a rule that drops all traffic from the 203.0.113.0/24 network. The administrator wants the HTTPS rule to take precedence over the drop rule for traffic from that network. Which iptables command should be used?

   • Aiptables -D INPUT -p tcp --dport 443 -j ACCEPT
   • Biptables -A INPUT -p tcp --dport 443 -j ACCEPT
   • Ciptables -I INPUT -p tcp --dport 443 -j ACCEPT
   • Diptables -R INPUT -p tcp --dport 443 -j ACCEPT
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An organization uses firewalld with three zones: 'public' for the internet-facing interface, 'internal' for the trusted LAN, and 'dmz' for servers. A new application server in the 'dmz' zone must accept HTTPS from the 'public' zone and accept SSH only from the 'internal' zone. The administrator wants the most specific and maintainable configuration. Which approach should be used?

   • AAdd both HTTPS and SSH as services to the 'dmz' zone, and set the default target of the 'dmz' zone to DROP.
   • BAdd the 'public' zone as a source to the 'dmz' zone, and add HTTPS and SSH as services to the 'dmz' zone.
   • CCreate a new zone for the application server and add both HTTPS and SSH as services, then assign the 'public' and 'internal' zones as sources.
   • DAdd HTTPS as a service to the 'dmz' zone, and add a rich rule to the 'dmz' zone allowing SSH from the 'internal' zone.
   Reveal Solution Discussion Select an answer first