CV0-004 Troubleshooting Practice Question
Exhibit
Refer to the exhibit.
```
$ iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
123 4567 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED,RELATED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
Chain FORWARD (policy DROP 0 packets, 0 bytes)
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
```A cloud administrator is configuring a Linux VM as a router. The iptables rules are shown. The administrator can SSH into the VM from the network but cannot forward traffic between interfaces. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently confuse the INPUT chain (for local traffic) with the FORWARD chain (for transit traffic), assuming that allowing SSH implies forwarding is also allowed, when in fact they are handled by completely separate chains.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The FORWARD chain's default policy is DROP and no rules allow forwarding
The FORWARD chain in iptables controls traffic that passes through the VM (i.e., traffic not destined for the VM itself). If its default policy is DROP and no explicit ACCEPT rules exist for forwarding, the kernel will drop all forwarded packets, preventing the VM from acting as a router. SSH access works because it uses the INPUT chain, which is separate from FORWARD.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The INPUT chain has a rule dropping invalid packets
Why it's wrong here
The INPUT chain is for incoming packets to the VM itself, not for forwarded traffic.
- ✗
The INPUT chain is missing a rule to allow forwarded traffic
Why it's wrong here
Forwarded traffic uses the FORWARD chain, not INPUT.
- ✓
The FORWARD chain's default policy is DROP and no rules allow forwarding
Why this is correct
With default policy DROP and no FORWARD rules, all forwarded packets are dropped.
- ✗
The NAT table is misconfigured
Why it's wrong here
NAT is not required for simple routing between interfaces.
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.