mediumMultiple ChoiceObjective-mapped
XK0-006 Practice Question: A security policy requires that SSH access be…
A security policy requires that SSH access be allowed only from the internal management subnet 10.10.10.0/24. Which firewalld rich rule should be added?
⚠ Common exam trap
Candidates often confuse `--add-source` (which binds a source to a zone) with a rule filter, or they think `--add-port` combined with `--add-source` creates a source-restricted port rule, when in fact firewalld requires a rich rule to enforce source-based service restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.10.10.0/24" service name="ssh" accept'
It uses the firewalld rich-rule syntax to explicitly define an IPv4 rule that accepts SSH traffic only from the 10.10.10.0/24 source subnet. Rich rules provide granular control over source addresses, services, and actions, which is required by the security policy. The `--add-rich-rule` option allows specifying the rule family, source address, service name, and accept action in a single, persistent rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
firewall-cmd --permanent --add-port=22/tcp --add-source=10.10.10.0/24
Why it's wrong here
This adds source address and port as separate rules; the source does not restrict the port rule.
- ✓
firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.10.10.0/24" service name="ssh" accept'
Why this is correct
This rich rule binds the source address to the SSH service.
- ✗
firewall-cmd --add-source=10.10.10.0/24 --add-service=ssh
Why it's wrong here
This adds the source and service separately, but does not link them; all sources can access SSH.
- ✗
iptables -A INPUT -s 10.10.10.0/24 -p tcp --dport 22 -j ACCEPT
Why it's wrong here
While this iptables command works, the question asks for a firewalld command.
Visual reference
Go deeper
Related to this question
Learn chapter
Installing Linux and Package Management
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
About these practice questions
Courseiva writes every XK0-006 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.