hardMultiple ChoiceObjective-mapped
CV0-004 Practice Question: A cloud administrator is troubleshooting…
Exhibit
Refer to the exhibit. # iptables -L -n -v Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 100 12000 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 50 6000 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 20 2400 ACCEPT tcp -- eth0 * 10.0.0.0/8 0.0.0.0/0 tcp dpt:443 10 1200 DROP tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
A cloud administrator is troubleshooting connectivity to a web server running on a Linux VM. The web server is configured to listen on ports 80 (HTTP) and 443 (HTTPS). The administrator runs the iptables command shown in the exhibit. Based on the output, what is the MOST likely reason that external users cannot access the web server on port 443?
⚠ Common exam trap
A common mix-up: candidates assume a default ACCEPT policy means all traffic is allowed, overlooking that an explicit rule with a restrictive source match will only permit traffic from that source, effectively denying all others by not matching.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The iptables rule for port 443 only allows traffic from the 10.0.0.0/8 subnet, which does not include external IP addresses.
The iptables rule for port 443 specifies a source IP range of 10.0.0.0/8, which is a private RFC 1918 address space. External users have public IP addresses that do not fall within this subnet, so their HTTPS traffic is implicitly dropped by the rule's match condition. The default policy being ACCEPT does not override the explicit rule that only permits traffic from the 10.0.0.0/8 subnet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The web server is not configured to listen on port 443, so iptables rules are irrelevant.
Why it's wrong here
The question states the web server is configured to listen on both ports; the issue is firewall-related.
- ✗
The iptables default policy is ACCEPT, but the rule for port 443 explicitly drops traffic from external sources.
Why it's wrong here
The rule for port 443 does not drop traffic; it accepts from a specific subnet. Traffic from other sources is subject to the default policy.
- ✗
The rule for port 80 is placed before the rule for port 443, causing all HTTPS traffic to be evaluated as HTTP and dropped.
Why it's wrong here
The rules are evaluated in order, but the port numbers are different; HTTPS traffic matches the port 443 rule, not port 80.
- ✓
The iptables rule for port 443 only allows traffic from the 10.0.0.0/8 subnet, which does not include external IP addresses.
Why this is correct
The rule for HTTPS only accepts from the private subnet, so external traffic is dropped by the default DROP policy.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.