XK0-006 Security Practice Question
A Linux administrator is configuring a server to use firewalld. The administrator wants to allow incoming traffic on TCP port 8080 only from the 192.168.1.0/24 subnet, while denying it from all other sources, without affecting other services. Which firewalld command should the administrator use to achieve this?
⚠ Common exam trap
The trap here is assuming that --add-port can be combined with --source to restrict access, when source restrictions require a rich rule or zone-based source assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="8080" protocol="tcp" accept'
Rich rules in firewalld allow combining source addresses, ports, and actions in a single rule. The correct syntax uses --add-rich-rule with a rule that specifies source address, port, protocol, and accept action. This precisely allows TCP 8080 from 192.168.1.0/24. Adding a port with a source argument is not supported, and adding a source to a zone does not restrict individual ports.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="8080" protocol="tcp" accept'
Why this is correct
This rich rule adds a permanent rule that accepts TCP traffic to port 8080 only from the specified source subnet. Rich rules allow granular control based on source address, port, and protocol. After adding it, the administrator must reload firewalld for the rule to take effect in the running configuration.
- ✗
firewall-cmd --permanent --add-source=192.168.1.0/24 --add-port=8080/tcp
Why it's wrong here
Adding a source to a zone applies all rules of that zone to the source, but it does not restrict the port to that source. The port would be opened for the entire zone. This command could inadvertently allow port 8080 from other sources depending on zone configuration, and it does not create a source-specific rule for the port.
- ✗
firewall-cmd --permanent --add-port=8080/tcp --source=192.168.1.0/24
Why it's wrong here
The --add-port option does not accept a --source argument. This command would either fail or add the port to the default zone without source restriction, opening it to all sources. It does not meet the requirement to limit access to the 192.168.1.0/24 subnet.
- ✗
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="8080" protocol="tcp" drop'
Why it's wrong here
This rich rule drops traffic from the specified subnet to port 8080, which is the opposite of the requirement. It would block the allowed subnet while leaving other sources unaffected. The action should be accept, not drop, to permit the desired traffic.
Visual reference
Go deeper
Related to this question
Learn chapter
Linux Fundamentals and History
Key term
firewalld
firewalld is a dynamic firewall management tool for Linux systems that controls incoming and outgoing network traffic using zones and rules.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 781 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.