XK0-006 Security Practice Question
A Linux administrator is troubleshooting a firewall issue using nftables. The ruleset is complex. Which two commands are useful for listing the current ruleset and adding a new rule? (Choose TWO.)
⚠ Common exam trap
A common mix-up: candidates confuse `nft show ruleset` (invalid) with `nft list ruleset` (valid), or think that `nft insert rule` is used for listing rules instead of adding them at a specific position.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
nft list ruleset
`nft list ruleset` is the standard command to display the entire current nftables ruleset in a human-readable format, which is essential for troubleshooting complex firewall configurations. Option C is correct because `nft add rule inet filter input tcp dport 443 accept` is the proper syntax to append a new rule to the specified chain (here, the 'input' chain of the 'filter' table in the 'inet' family) that accepts TCP traffic on port 443.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
nft insert rule
Why it's wrong here
nft insert rule exists but requires more syntax; add rule is more common for simplest addition.
- ✓
nft list ruleset
Why this is correct
Lists all current rules.
- ✓
nft add rule inet filter input tcp dport 443 accept
Why this is correct
Adds a rule to accept HTTPS.
- ✗
nft show ruleset
Why it's wrong here
nft show is not a valid command.
- ✗
nft -a list ruleset
Why it's wrong here
-a adds handles, but not a separate command.
Go deeper
Related to this question
Learn chapter
Linux Fundamentals and History
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
nftables
nftables is a modern Linux kernel packet classification framework that replaces the older iptables, ip6tables, arptables, and ebtables tools for configuring network packet filtering, NAT, and firewall rules.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.