In connection tracking, what does the NEW state represent?

A packet that is part of an existing connection

A packet that is related to an existing connection

A packet that cannot be identified as part of any connection

A packet that starts a new connection

Two firewalls in an active-passive HA pair protect a DMZ. The active firewall handles all traffic and maintains connection tracking state. When it fails, the passive firewall takes over but has no knowledge of existing connections, causing all active sessions to be dropped. The administrator wants to minimize session disruption during failover. What should they implement?

Configure the firewalls to use a stateless filtering approach with no connection tracking.

Use a load balancer in front of the firewalls to distribute traffic and maintain session persistence.

Configure conntrackd on both firewalls to synchronize connection tracking tables over a dedicated link.

Set the passive firewall to accept all traffic during failover and then rebuild state.

Why is it important to configure both iptables and ip6tables when securing a Linux host?

Because iptables is deprecated and ip6tables is the replacement

Because ip6tables is required for NAT configuration

Because iptables only filters IPv4 traffic and ip6tables only filters IPv6 traffic

Because iptables cannot be used on systems with IPv6 enabled

What is the primary advantage of using IP sets with iptables?

They provide encryption for traffic between hosts

They allow matching against a large list of IP addresses more efficiently than individual rules

They replace the need for connection tracking

They automatically update firewall rules based on DNS changes

LPIC-3 Security

Domain 4Objective 3

328.3 Packet Filtering (weight: 5) LPIC-3-SECURITY Practice Questions (Page 3)

Part of the Topic 328: Network Security domain, which makes up ~27% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–16 in this domain), expect 2–4 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

11concepts

Questions 11–15

11foundation · easy
In connection tracking, what does the NEW state represent?
Select an answer first
12expert · medium
Two firewalls in an active-passive HA pair protect a DMZ. The active firewall handles all traffic and maintains connection tracking state. When it fails, the passive firewall takes over but has no knowledge of existing connections, causing all active sessions to be dropped. The administrator wants to minimize session disruption during failover. What should they implement?
Select an answer first
13foundation · easy
Which iptables target is used to rewrite the source IP address of outgoing packets to the IP address of the outgoing interface?
Select an answer first
14foundation · easy
Why is it important to configure both iptables and ip6tables when securing a Linux host?
Select an answer first
15foundation · easy
What is the primary advantage of using IP sets with iptables?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-SECURITY

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-SECURITY” is a trademark of its owner, used for identification only.

328.3 Packet Filtering (weight: 5) LPIC-3-SECURITY Practice Questions (Page 3)

Questions 11–15

In connection tracking, what does the NEW state represent?

Which iptables target is used to rewrite the source IP address of outgoing packets to the IP address of the outgoing interface?

Why is it important to configure both iptables and ip6tables when securing a Linux host?

What is the primary advantage of using IP sets with iptables?

Keep studying — Topic 328: Network Security