CV0-004 Troubleshooting Practice Question
Exhibit
Refer to the exhibit.
```
$ iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
123 4567 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED,RELATED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
Chain FORWARD (policy DROP 0 packets, 0 bytes)
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
```A cloud administrator is configuring a Linux VM as a router. The iptables rules are shown. The administrator can SSH into the VM from the network but cannot forward traffic between interfaces. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently confuse the INPUT chain (for local traffic) with the FORWARD chain (for transit traffic), assuming that allowing SSH implies forwarding is also allowed, when in fact they are handled by completely separate chains.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The FORWARD chain's default policy is DROP and no rules allow forwarding
The FORWARD chain in iptables controls traffic that passes through the VM (i.e., traffic not destined for the VM itself). If its default policy is DROP and no explicit ACCEPT rules exist for forwarding, the kernel will drop all forwarded packets, preventing the VM from acting as a router. SSH access works because it uses the INPUT chain, which is separate from FORWARD.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The INPUT chain has a rule dropping invalid packets
Why it's wrong here
Dropping invalid packets on INPUT affects only traffic destined for the VM itself, not packets traversing it; SSH still works because those packets terminate locally. Forwarded traffic is evaluated by the FORWARD chain, so this rule cannot explain the failure. Such invalid-drop rules are standard hardening on INPUT in host-firewall scenarios.
- ✗
The INPUT chain is missing a rule to allow forwarded traffic
Why it's wrong here
Forwarded packets never traverse INPUT; they are evaluated by the FORWARD chain, so a missing INPUT rule cannot block them. INPUT governs traffic addressed to the VM itself, which is why SSH succeeds. Adding an INPUT allow rule would be relevant only for services hosted on the router itself, not for inter-interface routing.
- ✓
The FORWARD chain's default policy is DROP and no rules allow forwarding
Why this is correct
SSH works because INPUT accepts it, but forwarding relies on the FORWARD chain. A default DROP policy with no ACCEPT rules silently discards packets traversing the VM, so inter-interface traffic never passes despite routing being enabled.
- ✗
The NAT table is misconfigured
Why it's wrong here
The NAT table handles address translation for outbound traffic, not interface-to-interface forwarding; SSH working locally proves routing and firewall rules permit management access. Enabling IP forwarding in the kernel is what allows packets to traverse the VM's interfaces.
Go deeper
Related to this question
About these practice questions
One of 834 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.