hardMultiple ChoiceObjective-mapped
XK0-006 Practice Question: A developer reports that a Docker container on a…
A developer reports that a Docker container on a CentOS 7 host cannot connect to the internet. The host itself can access the internet. The container is started with default bridge network. The administrator checks iptables and sees the FORWARD policy is DROP. What is the most likely cause and solution?
⚠ Common exam trap
It's easy for candidates to assume DNS or network mode is the issue, but the explicit mention of the FORWARD policy being DROP directly points to a missing iptables forwarding rule, which is a classic Linux networking troubleshooting scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add iptables rules to allow forwarding and enable masquerading.
The default Docker bridge network relies on iptables NAT (masquerading) and FORWARD rules to allow containers to reach external networks. When the FORWARD policy is set to DROP, the host drops all forwarded packets from the container, blocking outbound internet access. Adding iptables rules to allow forwarding (e.g., `-A FORWARD -i docker0 -j ACCEPT`) and enabling masquerading (e.g., `-t nat -A POSTROUTING -s 172.17.0.0/16 -o eth0 -j MASQUERADE`) restores connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The container needs to be run with --network host.
Why it's wrong here
Host network mode bypasses bridge but does not fix the iptables issue.
- ✗
The container's DNS configuration is incorrect.
Why it's wrong here
DNS issues would affect name resolution, not connectivity to internet IPs.
- ✓
Add iptables rules to allow forwarding and enable masquerading.
Why this is correct
Docker manages iptables, but if the FORWARD policy is DROP without proper rules, container traffic is blocked. Adding rules or restarting Docker restores connectivity.
- ✗
AppArmor is blocking outbound connections.
Why it's wrong here
CentOS uses SELinux, not AppArmor.
Visual reference
Go deeper
Related to this question
Learn chapter
File Transfer and Remote Access
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
About these practice questions
This XK0-006 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.