mediumMultiple ChoiceObjective-mapped
XK0-006 Practice Question: A web server is running on the system but clients…
Network Topology
A web server is running on the system but clients cannot connect to port 8080. Based on the exhibit, which command should the administrator run to allow traffic on port 8080?
⚠ Common exam trap
Candidates often confuse `--add-port` with `--add-service` or use the wrong protocol (UDP instead of TCP), or incorrectly format a rich rule, because the exam tests precise syntax and the distinction between service-based and port-based rules in firewalld.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
firewall-cmd --add-port=8080/tcp --permanent
The correct command is `firewall-cmd --add-port=8080/tcp --permanent` because it opens TCP port 8080 in firewalld, which is the default firewall management tool on RHEL/CentOS 8/9. Since the web server is running but clients cannot connect, the firewall is likely blocking inbound traffic on that port. The `--add-port` option with the `tcp` protocol explicitly allows TCP connections, and `--permanent` makes the rule persist across reboots.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
firewall-cmd --add-rich-rule='rule port port=8080 protocol=tcp accept' --permanent
Why it's wrong here
This command employs a rich rule, which is an overly granular method for simply opening a port. While technically capable of allowing traffic on port 8080, the standard `firewall-cmd` operation for this basic scenario is `firewall-cmd --add-port`. Rich rules are designed for more sophisticated firewall policies, such as permitting traffic from specific source IP addresses, redirecting ports, or applying rules based on interfaces. It would be the correct choice if the requirement involved conditional access, like allowing port 8080 only from a particular network range.
- ✓
firewall-cmd --add-port=8080/tcp --permanent
Why this is correct
This command adds TCP port 8080 permanently to the firewall rules, which is required for HTTPS on a non-standard port.
- ✗
firewall-cmd --add-port=8080/udp --permanent
Why it's wrong here
Web traffic uses TCP, not UDP; opening UDP port 8080 would not help.
- ✗
firewall-cmd --add-service=http --permanent
Why it's wrong here
Adding service 'http' only opens port 80, not port 8080.
Visual reference
Go deeper
Related to this question
About these practice questions
This XK0-006 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.