Firewalls XK0-006 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a zone-based firewall, what is the default policy for traffic between two zones when no policy is explicitly defined?

   • ARoute all traffic
   • BAllow all traffic
   • CLog all traffic
   • DDeny all traffic
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which statement accurately describes a key difference between nftables and iptables?

   • Anftables requires a separate daemon to manage rules, while iptables runs entirely in kernel space.
   • Bnftables only supports IPv4 traffic, while iptables supports both IPv4 and IPv6.
   • Cnftables uses a single tool and a unified rule syntax, while iptables uses separate tools for different tables.
   • Dnftables rules are stored in a single flat list, while iptables uses a hierarchical chain structure.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which component of iptables is used to group rules that are evaluated in order for packets traversing the firewall?

   • ATarget
   • BChain
   • CTable
   • DMatch
   Reveal Solution Discussion Select an answer first
5. 14application · easy

   A Linux administrator needs to delete a UFW rule that was previously added to allow SSH from a specific IP address. The rule was added with the command 'ufw allow from 198.51.100.10 to any port 22'. Which command removes this rule?

   • Aufw delete 22/tcp
   • Bufw deny from 198.51.100.10 to any port 22
   • Cufw delete allow from 198.51.100.10 to any port 22
   • Dufw remove allow from 198.51.100.10 to any port 22
   Reveal Solution Discussion Select an answer first
6. 15application · hard

   A company uses firewalld to segment its network. The web server is in the 'web' zone, and the database server is in the 'db' zone. The web server must be able to connect to the database on TCP port 3306, but the database must not initiate connections to the web server. Which firewalld configuration achieves this?

   • AAdd a direct rule to the 'db' zone allowing TCP port 3306 from any source.
   • BAdd a rich rule to the 'web' zone allowing outbound TCP to port 3306, and add a rich rule to the 'db' zone allowing inbound TCP from the 'web' zone on port 3306.
   • CAdd the 'db' zone as a source to the 'web' zone and set the default target of the 'web' zone to ACCEPT.
   • DSet the default target of the 'db' zone to ACCEPT and add the 'web' zone as a source.
   Reveal Solution Discussion Select an answer first