hardMultiple ChoiceObjective-mapped
XK0-006 Practice Question: Scenario: A financial services company runs a…
Scenario: A financial services company runs a critical application on a Linux server that stores sensitive customer data. The server is configured with a firewall (iptables) that only allows SSH (port 22) and HTTPS (port 443) from the internal network (10.0.0.0/8). Recently, the security team detected unauthorized access attempts from an external IP address (203.0.113.5) targeting port 22. The administrator needs to block this specific IP while maintaining current access rules. The existing iptables rules are: - INPUT chain policy ACCEPT - Rule 1: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT - Rule 2: -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT - Rule 3: -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT - Rule 4: -A INPUT -j DROP The administrator wants to block 203.0.113.5 from any access. Which command should be added?
⚠ Common exam trap
The trap here is that candidates often append a DROP rule with `-A` or insert it after the default DROP rule, not realizing that rules added after a final DROP are never processed, or they mistakenly use `-j ACCEPT` thinking it will override the default policy, when in fact it would allow the unwanted IP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
iptables -I INPUT 1 -s 203.0.113.5 -j DROP
Inserting the DROP rule at position 1 with `-I INPUT 1` ensures it is evaluated before the existing ESTABLISHED,RELATED rule (Rule 1). Since iptables processes rules sequentially, placing the block early prevents the malicious IP from being matched by the ESTABLISHED,RELATED rule, which would otherwise accept its packets if a related connection existed. This maintains the existing SSH and HTTPS access rules for the internal network while explicitly dropping all traffic from 203.0.113.5.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
iptables -I INPUT 1 -s 203.0.113.5 -j DROP
Why this is correct
Inserts a DROP rule at the top, blocking the IP before any ACCEPT rules.
- ✗
iptables -I INPUT 5 -s 203.0.113.5 -j DROP
Why it's wrong here
Inserting at position 5 is after the final DROP rule; still ineffective.
- ✗
iptables -A INPUT -s 203.0.113.5 -j DROP
Why it's wrong here
Appending after the final DROP rule is ineffective.
- ✗
iptables -I INPUT 1 -s 203.0.113.5 -j ACCEPT
Why it's wrong here
This would allow the IP instead of blocking.
Go deeper
Related to this question
Learn chapter
Linux Fundamentals and History
Key term
Customer
In IT service management, a customer is the person or organization that defines requirements and agrees to pay for services, but does not necessarily use them directly.
Key term
SSH
SSH (Secure Shell) is a cryptographic network protocol that provides secure, encrypted communication and remote administration between two devices over an unsecured network.
About these practice questions
This XK0-006 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.