Courseiva
← CAS-005
Full test
mediumMultiple ChoiceObjective-mapped

CAS-004 Practice Question: A security architect reviews the iptables…

Exhibit

Refer to the exhibit.

```
$ iptables -L -n -v --line-numbers
Chain INPUT (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
2        0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22
3        0     0 ACCEPT     tcp  --  *      *       192.168.1.0/24       0.0.0.0/0            tcp dpt:443
4        0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0
5        0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0
Chain FORWARD (policy DROP)
Chain OUTPUT (policy ACCEPT)
```

A security architect reviews the iptables firewall rules above. A new web server with IP 192.168.1.100 must be reachable from the internet on ports 80 and 443. Which of the following changes is necessary to allow inbound HTTPS while maintaining security?

⚠ Common exam trap

CASP+ often tests the misconception that adding a new rule for HTTPS is sufficient, without considering the existing rule order and the need to restrict management access; candidates overlook that a preceding rule might block the new rule or that SSH should be limited to a management subnet.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Change rule 3 source to 0.0.0.0/0 and restrict rule 2 to a management subnet

The existing rule 3 (likely ACCEPT tcp from any to any dpt 80) would allow HTTP but not HTTPS (port 443). By changing rule 3's source to 0.0.0.0/0 and restricting rule 2 to a management subnet, you create a clean, stateful rule that permits inbound HTTPS (port 443) from any source while limiting SSH or other management access to a trusted subnet, maintaining a least-privilege posture. This avoids opening unnecessary ports or weakening the default deny policy.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Delete rule 3 and add a rule: ACCEPT tcp from any to 192.168.1.100 dpt 80,443

    Why it's wrong here

    This allows HTTP as well, but the question only mentions HTTPS for now; also need to address SSH exposure.

  • ✓

    Change rule 3 source to 0.0.0.0/0 and restrict rule 2 to a management subnet

    Why this is correct

    This allows global HTTPS and secures SSH to a trusted subnet.

  • ✗

    Change default INPUT policy to ACCEPT and rely on application security

    Why it's wrong here

    Changing default policy to ACCEPT reduces security and is not recommended.

  • ✗

    Add a new rule before rule 5: ACCEPT tcp from any to 192.168.1.100 dpt 443

    Why it's wrong here

    Adding a rule would work, but rule 3 still restricts to 192.168.1.0/24; better to fix the existing rule.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.