mediumMultiple ChoiceObjective-mapped
iptables Output Chain Default ACCEPT Security Risk
Exhibit
Refer to the exhibit.
```
# iptables -L -n -v
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
0 0 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
0 0 ACCEPT icmp -- eth0 * 0.0.0.0/0 0.0.0.0/0 icmptype 8
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
```An administrator runs the above iptables command on a Linux server. The server is directly connected to the internet. Which of the following is the MOST significant security issue with this configuration?
Quick Answer
The answer is the OUTPUT chain default policy being set to ACCEPT, which creates a critical security issue by permitting any outbound traffic without restriction. This is technically dangerous because a default ACCEPT policy on the OUTPUT chain means that if the server is compromised—especially one directly connected to the internet—an attacker can freely exfiltrate sensitive data, establish outbound connections to command-and-control servers, or launch further attacks without any firewall-level barrier. On the CompTIA SecurityX CAS-004 exam, this concept tests your understanding of defense in depth and the principle of least privilege applied to firewall rules; a common trap is focusing only on inbound rules while ignoring that outbound controls are equally vital for preventing data exfiltration. To remember this, think of the mnemonic “OUTbound = OUTgoing threats”—a default DROP on OUTPUT forces explicit permission for every outbound connection, closing the door on covert channels.
⚠ Common exam trap
The trap here is that candidates focus on inbound rules (like SSH or ICMP) because they are more familiar, but the exam tests understanding that a default ACCEPT on the OUTPUT chain is a critical security gap that enables data exfiltration and is often overlooked in firewall configurations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The OUTPUT chain default policy is ACCEPT, allowing any outbound traffic
The most significant security issue is that the OUTPUT chain default policy is ACCEPT, allowing any outbound traffic from the server. Since the server is directly connected to the internet, this means that if the server is compromised, an attacker can freely exfiltrate data, initiate outbound connections to command-and-control servers, or perform other malicious activities without any firewall restriction. A default DROP policy on the OUTPUT chain would require explicit rules for allowed outbound traffic, providing defense in depth.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The INPUT chain default policy is DROP, which will block legitimate traffic
Why it's wrong here
DROP is a secure default.
- ✓
The OUTPUT chain default policy is ACCEPT, allowing any outbound traffic
Why this is correct
This could allow data exfiltration or command and control traffic.
- ✗
SSH (port 22) is allowed from any source, which is overly permissive
Why it's wrong here
SSH may be needed, but the rule is permissive; however, the output policy is the bigger issue.
- ✗
ICMP echo requests are allowed, which could be used for network reconnaissance
Why it's wrong here
While true, it's less critical than the outbound issue.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CAS-005
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network administrator is troubleshooting connectivity issues. Based on the exhibit, which of the following is true about the iptables rules?
hard- A.New connections from the internet to 10.0.1.0/24 are allowed.
- B.All traffic is allowed by default because the policy is ACCEPT.
- ✓ C.Traffic from 10.0.1.0/24 to the internet is allowed, but return traffic is only allowed if it is part of an established connection.
- D.The rules apply to incoming traffic on the firewall itself.
Why C: The iptables rules show a default FORWARD policy of DROP (as indicated by the 'policy DROP' line), which drops all traffic not explicitly allowed. The rule '-A FORWARD -s 10.0.1.0/24 -j ACCEPT' allows outbound traffic from the 10.0.1.0/24 subnet to the internet. The rule '-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT' ensures that return traffic belonging to an existing connection is permitted back, while new inbound connections from the internet are implicitly dropped by the default DROP policy.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.