easyMultiple ChoiceObjective-mapped
XK0-006 iptables default policy Practice Question
You are a systems administrator for a small company. The company uses a Linux server running Ubuntu 22.04 LTS that hosts a web application and a PostgreSQL database. The server has two network interfaces: eth0 (public IP) and eth1 (private IP). The web application listens on port 443 (HTTPS) on eth0, and the PostgreSQL database listens on port 5432 on eth1. The company security policy requires that only the web application should be accessible from the internet; all other ports must be blocked on the public interface. Additionally, SSH access should be allowed only from the internal network (192.168.1.0/24). The current iptables rules are as follows:
-P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT
There are no other rules. You need to implement the security policy using iptables. Which of the following sets of commands will achieve the required security policy?
⚠ Common exam trap
The trap is to assume that only specific ports need to be opened on the internal interface. With a default DROP policy, forgetting to allow all traffic on eth1 would block critical internal services like PostgreSQL. Option A correctly includes the allow-all rule for eth1.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
iptables -P INPUT DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT iptables -A INPUT -i eth1 -j ACCEPT
Option A correctly implements the security policy. It sets the default policy to DROP, allows established and related connections, permits HTTPS (port 443) on the public interface eth0, restricts SSH (port 22) to the internal network 192.168.1.0/24 on the private interface eth1, and allows all other traffic on eth1, which is necessary for internal services like PostgreSQL. The order of rules is irrelevant because each matches distinct conditions. Option B is incorrect because it omits the allow-all rule for eth1, causing internal traffic (including PostgreSQL) to be blocked by the default DROP policy. Option C is incorrect because it allows SSH on the public interface eth0 instead of the private eth1, violating the policy that SSH should be accessible only from the internal network. Option D is incorrect because it permits SSH from any source, not just the internal network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
iptables -P INPUT DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT iptables -A INPUT -i eth1 -j ACCEPT
Why this is correct
Correct. Sets default DROP, allows established/related, permits HTTPS on eth0, restricts SSH to the internal network on eth1, and allows all traffic on eth1 (needed for internal services).
- ✗
iptables -P INPUT DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT iptables -A INPUT -i eth1 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
Why it's wrong here
Incorrect. Omits the allow-all rule for eth1, so internal traffic like PostgreSQL is blocked by the default DROP policy.
- ✗
iptables -P INPUT DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT
Why it's wrong here
Incorrect. Places the SSH rule on the public interface eth0 instead of the private eth1, exposing SSH to the internet.
- ✗
iptables -P INPUT DROP iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT iptables -A INPUT -i eth1 -j ACCEPT
Why it's wrong here
Incorrect. The SSH rule has no source restriction, allowing connections from any network.
Go deeper
Related to this question
Learn chapter
Linux Fundamentals and History
Key term
Linux
Linux is an open-source operating system that manages computer hardware and software, widely used in servers, desktops, and embedded systems.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 979 original XK0-006 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This XK0-006 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the XK0-006 exam.