hardMultiple Choice
CV0-004 Practice Question: A cloud administrator is troubleshooting…
Exhibit
Refer to the exhibit. # iptables -L -n -v Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 100 12000 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 50 6000 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 20 2400 ACCEPT tcp -- eth0 * 10.0.0.0/8 0.0.0.0/0 tcp dpt:443 10 1200 DROP tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
A cloud administrator is troubleshooting connectivity to a web server running on a Linux VM. The web server is configured to listen on ports 80 (HTTP) and 443 (HTTPS). The administrator runs the iptables command shown in the exhibit. Based on the output, what is the MOST likely reason that external users cannot access the web server on port 443?
⚠ Common exam trap
A common mix-up: candidates assume a default ACCEPT policy means all traffic is allowed, overlooking that an explicit rule with a restrictive source match will only permit traffic from that source, effectively denying all others by not matching.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The iptables rule for port 443 only allows traffic from the 10.0.0.0/8 subnet, which does not include external IP addresses.
The iptables rule for port 443 specifies a source IP range of 10.0.0.0/8, which is a private RFC 1918 address space. External users have public IP addresses that do not fall within this subnet, so their HTTPS traffic is implicitly dropped by the rule's match condition. The default policy being ACCEPT does not override the explicit rule that only permits traffic from the 10.0.0.0/8 subnet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The web server is not configured to listen on port 443, so iptables rules are irrelevant.
Why it's wrong here
The stem states the web server is configured to listen on both 80 and 443, so a missing listener contradicts the given facts; iptables filtering remains the relevant layer. It is tempting because a service not bound to a port is a common cause of connection refusals, and would be correct if netstat showed no listener on 443.
- ✗
The iptables default policy is ACCEPT, but the rule for port 443 explicitly drops traffic from external sources.
Why it's wrong here
A default ACCEPT policy applies only when no rule matches; it does not override an explicit DROP or REJECT rule for port 443, which would still block HTTPS. It is tempting because a permissive default suggests traffic should flow, and would be correct if the exhibit showed no matching rule for port 443.
- ✗
The rule for port 80 is placed before the rule for port 443, causing all HTTPS traffic to be evaluated as HTTP and dropped.
Why it's wrong here
Iptables evaluates rules sequentially, but a port 80 rule matches only destination port 80 traffic; packets to port 443 never match it, so no reclassification as HTTP occurs. It is tempting because rule order genuinely matters in iptables, and would be correct if an earlier broad DROP or REJECT rule shadowed the port 443 rule.
- ✓
The iptables rule for port 443 only allows traffic from the 10.0.0.0/8 subnet, which does not include external IP addresses.
Why this is correct
The INPUT chain rule for port 443 specifies source 10.0.0.0/8, a private range covering only internal addresses. External users' public source IPs never match this criterion, so the packet is dropped before reaching the web server. Port 80 lacks this restriction, explaining why only HTTPS fails.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 834 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.