hardMultiple Choice
XK0-006 Practice Question: A developer reports that a Docker container on a…
A developer reports that a Docker container on a CentOS 7 host cannot connect to the internet. The host itself can access the internet. The container is started with default bridge network. The administrator checks iptables and sees the FORWARD policy is DROP. What is the most likely cause and solution?
⚠ Common exam trap
It's easy for candidates to assume DNS or network mode is the issue, but the explicit mention of the FORWARD policy being DROP directly points to a missing iptables forwarding rule, which is a classic Linux networking troubleshooting scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add iptables rules to allow forwarding and enable masquerading.
The default Docker bridge network relies on iptables NAT (masquerading) and FORWARD rules to allow containers to reach external networks. When the FORWARD policy is set to DROP, the host drops all forwarded packets from the container, blocking outbound internet access. Adding iptables rules to allow forwarding (e.g., `-A FORWARD -i docker0 -j ACCEPT`) and enabling masquerading (e.g., `-t nat -A POSTROUTING -s 172.17.0.0/16 -o eth0 -j MASQUERADE`) restores connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The container needs to be run with --network host.
Why it's wrong here
Host networking bypasses the bridge and its FORWARD chain entirely, masking rather than fixing the DROP policy, and removes container isolation. It is tempting because it restores connectivity, but the correct fix is a FORWARD ACCEPT rule or Docker's iptables integration.
- ✗
The container's DNS configuration is incorrect.
Why it's wrong here
DNS failure would break name resolution while leaving direct IP connectivity intact, yet the FORWARD DROP policy blocks all container traffic. It is tempting because DNS misconfiguration commonly causes container connectivity complaints, but the observed iptables policy is the concrete fault.
- ✓
Add iptables rules to allow forwarding and enable masquerading.
Why this is correct
Docker's default bridge network relies on the host's IP forwarding and NAT masquerading to reach external networks. With the FORWARD chain policy set to DROP, container traffic is discarded before masquerading occurs. Adding FORWARD accept rules plus a MASQUERADE rule for the bridge subnet restores outbound connectivity, satisfying the host-forwarding constraint.
- ✗
AppArmor is blocking outbound connections.
Why it's wrong here
AppArmor mediates file and capability access, not IP forwarding, and CentOS 7 ships SELinux rather than AppArmor by default. It is tempting because mandatory access control can block network syscalls, but the FORWARD DROP policy is the actual cause here.
Visual reference
Go deeper
Related to this question
Learn chapter
File Transfer and Remote Access
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
About these practice questions
This XK0-006 question is part of Courseiva's 781-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.