mediumMultiple Choice
XK0-006 Practice Question: A Linux administrator needs to configure a…
A Linux administrator needs to configure a firewall to allow incoming SSH connections only from the 192.168.1.0/24 subnet. The current iptables INPUT policy is ACCEPT. Which set of rules should be added?
⚠ Common exam trap
Candidates often assume the order of rules doesn't matter or that a DROP rule can be placed before an ACCEPT rule for the same port, not realizing that iptables stops processing on the first match, which would drop all traffic including from the allowed subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP
Iptables processes rules in order, and the first matching rule determines the action. By placing the ACCEPT rule for the 192.168.1.0/24 subnet first, SSH traffic from that subnet is accepted. The subsequent DROP rule for port 22 then denies all other SSH traffic. This ensures that only the specified subnet can connect, while the default ACCEPT policy on the INPUT chain would otherwise allow all traffic if no rule matched.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
Why it's wrong here
Appending the DROP before the ACCEPT means the subnet's SSH packets match the DROP rule first and are discarded, so the intended allow never triggers. It is tempting because ordering an ACCEPT after a broad DROP resembles a whitelist, which is correct only when the ACCEPT is inserted ahead of the DROP.
- ✓
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j DROP
Why this is correct
The first rule accepts TCP port 22 traffic sourced only from 192.168.1.0/24; the second drops all remaining SSH traffic from any other source. Since the INPUT policy is ACCEPT, the explicit DROP is required to deny non-subnet SSH connections.
- ✗
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j DROP
Why it's wrong here
The second rule drops only traffic from 10.0.0.0/8, leaving every other source subnet able to reach port 22 because the INPUT policy remains ACCEPT. It is tempting because pairing an ACCEPT with a DROP appears to restrict access, and that pattern works when the policy is DROP and the DROP rule targets all remaining traffic.
- ✗
iptables -I INPUT -p tcp --dport 22 -j DROP; iptables -A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
Why it's wrong here
Inserting the DROP at the top of INPUT discards all port 22 traffic, including packets from 192.168.1.0/24, before the appended ACCEPT can match them. It is tempting because -I places the rule first, which is the right technique for a preceding ACCEPT, but here it precedes the wrong target.
Visual reference
Go deeper
Related to this question
Learn chapter
Installing Linux and Package Management
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 781 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.